F1_Auth / Auth

人の同一性を確定し、認証と認可を分ける入口。

訪問者が同一オリジンの return_to を伴う magic link を要求し、サーバー検証済みセッションとして戻る。

入力 → 状態 → 出力

線形テキスト代替: Action Registryが検証したpayloadをengineへ渡す。engineはこの器官のdurable state sliceを更新し、resultまたはerrorをAction Coreへ返す。光は実行中、琥珀の境界はarmed状態、外縁はこの器官の作用半径を表す。

入力validated JSON payload
状態engine-owned durable slice
承認必要な外部 / 不可逆操作だけ
出力result / receipt / explicit error
回復emailを保持したまま error から再送できる。allowlist不一致は unauthorized として残り、再ログインで隠さない。

2 registered actionsnone dependencies(D5.2 decision required) binding reference

保存状態はAction Coreのfilesystem state store内の capabilities sliceとして再起動可能なplain dataで保持される。functionや秘密値をstateへ保存しない。

全Action

以下はAction Registryに実在するF1_Authの全actionである。クリックでpayload境界、状態、出力、回復を開ける。

capability.auth.configureConfigure authlocal or validated transition

payload: provider
状態: state transition defined by the capability engine
result: Capability engine の ok result、または明示的な validation / provider error。plan・receipt・stateは持続sliceへ返る。
recovery: error codeと状態を残し、必要に応じて再計画・再承認・retryへ戻る。

capability.auth.signinSign in capabilitylocal or validated transition

payload: identity
状態: state transition defined by the capability engine
result: Capability engine の ok result、または明示的な validation / provider error。plan・receipt・stateは持続sliceへ返る。
recovery: error codeと状態を残し、必要に応じて再計画・再承認・retryへ戻る。

Capability Spec

F1 Auth — Capability Spec

Provider-independent authentication capability for MikaAir LIGHTNESS and bound MikaAirWeb sites.

Purpose

Establish identity for a human visitor, restore sessions across visits, and expose an explicit server-verified authorization boundary separate from authentication.

States

State	Meaning
`unknown`	Session not yet resolved (initial load).
`loading`	Session resolution or auth action in flight.
`signed_out`	No verified session.
`link_sending`	Magic-link / OTP dispatch in progress.
`link_sent`	Dispatch succeeded; email retained for recovery.
`signed_in`	Verified session and authorization passed.
`signing_out`	Logout in progress.
`error`	Recoverable failure; email retained when applicable.
`unauthorized`	Verified identity exists but allowlist authorization failed.

Session Shape

{
  "userId": "string",
  "email": "string",
  "displayName": "string | null",
  "issuedAt": "ISO-8601",
  "expiresAt": "ISO-8601 | null",
  "provider": "string"
}

Sessions are verified only on the server. Client-visible state is derived from server responses, never from localStorage trust.

Actions

Action	From states	To states
`resolve_session`	`unknown`	`loading` → `signed_out` \	`signed_in` \	`unauthorized` \	`error`
`send_magic_link`	`signed_out`, `error`	`link_sending` → `link_sent` \	`error`
`complete_callback`	`signed_out`, `loading`	`loading` → `signed_in` \	`unauthorized` \	`error`
`sign_out`	`signed_in`, `unauthorized`	`signing_out` → `signed_out` \	`error`

Authorization Boundary

Authentication proves identity. Authorization is a separate server-side allowlist check.

Env name: MIKAAIR_AUTH_ALLOWED_EMAILS
Format: comma-separated email addresses, case-insensitive match after trim
Empty or unset allowlist: no authenticated user is authorized

Error Contract

Code	Recoverable	Meaning
`config_missing`	no	Required env names are absent at runtime.
`invalid_email`	yes	Email failed validation.
`link_send_failed`	yes	Provider rejected magic-link dispatch.
`callback_invalid`	yes	Callback token or code could not be verified.
`session_expired`	yes	Session could not be restored or refreshed.
`not_authorized`	yes	Identity verified but not on allowlist.
`provider_error`	yes	Provider returned an unexpected error.

Errors expose code, message, and optional email for recovery. Secret values must never appear in errors or logs.

Environment Names (values never in repo)

Name	Role
`SUPABASE_URL`	Provider API base URL
`SUPABASE_PUBLISHABLE_KEY`	Client-safe key for OTP / magic-link lane
`SUPABASE_SECRET_KEY`	Server-only elevated key when required by binding
`MIKAAIR_AUTH_ALLOWED_EMAILS`	Authorization allowlist
`MIKAAIR_AUTH_SITE_URL`	Canonical same-origin site URL for return/callback
`MIKAAIR_AUTH_ACCESS_COOKIE`	Access token cookie name override
`MIKAAIR_AUTH_REFRESH_COOKIE`	Refresh token cookie name override

Lifecycle / Return URL Rules

return_to must be same-origin relative path starting with /
Paths /auth/login, /auth/callback, /auth/sign-out are reserved
Protocol-relative, absolute off-origin, and // paths are rejected to /
Callback completes on server, then redirects to sanitized return_to

Provider Binding

F1 does not choose a provider. Binding manifests reference an approved D BUS adapter. Current reference adapter: MikaAirWeb/D_BUS_Dynamic_Capability/adapter_library/supabase/auth/.

binding / secret boundary

provider設定はbinding templateから参照する。環境変数は名前だけを扱い、値はsource repository・画面・reportに書かない。

環境変数名	扱い
`SUPABASE_URL`	configuration reference — 値は表示・保存しない
`SUPABASE_PUBLISHABLE_KEY`	configuration reference — 値は表示・保存しない
`SUPABASE_SECRET_KEY`	secret reference — 値は表示・保存しない
`MIKAAIR_AUTH_ALLOWED_EMAILS`	configuration reference — 値は表示・保存しない
`MIKAAIR_AUTH_SITE_URL`	configuration reference — 値は表示・保存しない
`MIKAAIR_AUTH_ACCESS_COOKIE`	configuration reference — 値は表示・保存しない
`MIKAAIR_AUTH_REFRESH_COOKIE`	configuration reference — 値は表示・保存しない

emailを保持したまま error から再送できる。allowlist不一致は unauthorized として残り、再ログインで隠さない。

source trace

../MikaAir LIGHTNESS/F_BUS_Capability/F1_Auth/spec/capability_spec.md 08ed02b5c5d3
../MikaAir LIGHTNESS/F_BUS_Capability/F1_Auth/binding/binding_manifest.template.json 2277714a482e
../MikaAir LIGHTNESS/F_BUS_Capability/F1_Auth/agent.md c59f1b3fc373
../MikaAir LIGHTNESS/F_BUS_Capability/runtime_bridge.mjs 7e7384638a41
../MikaAir LIGHTNESS/F_BUS_Capability/action_surface.mjs e5bae5f48648
../MikaAir LIGHTNESS/A_BUS_Action_Core/A2_State_Store/filesystem_store.mjs b1cc32d3f456
../MikaAir LIGHTNESS/F_BUS_Capability/F1_Auth/contract/index.mjs 7e16210a168e