core.auth Roadmap

Living task list for core.auth — the centralized identity provider for the UNVRSL ecosystem.

Current State (audit 2026-07-17)

Legacy stub — scrapped. The repo contained a pre-docs prototype (direct app_token JSON router, TODO-only handlers, broken bootstrap includes, empty composer.json). It predated the L1/L2 architecture and shared nothing with it. No code carried over — repo wiped 2026-07-17 (history preserved in git).

Status: greenfield implementation of the finalized L2 design. All architecture decisions are made (13 L2 articles); this roadmap is purely execution order.

→ L4 code reference will be initialized once the Phase 0 scaffold lands.

Dependencies

Depends On	For

core.assets	Stylesheets/JS for auth frontend (via DocumentShell)
core.backend	DocumentShell for auth pages; SDK consumes token helpers later
core.console	Delegates session validation + quota queries to core.auth
MySQL	All identity/session/quota tables (L2 08-database-schemas)
SMTP	Verification codes, welcome emails, security alerts
SMS provider (optional)	Phone verification

Current Sprint — Phase 0: Foundation

• [ ] Repo scaffold — fresh structure per L4 conventions (public/, src/, bootstrap/, env/), real composer.json (PSR-4)


• [ ] DB schema — all tables from L2 08: users, sessions, registered_apps, user_app_access, connection_tokens, ident_events, user_third_party_auths, verification_codes, account_types, user_quota_usage, 2FA/recovery tables


• [ ] JWT core — create/verify in ~30 lines PHP, HS256, no library (L2 05)


• [ ] Session core — sessions table, session_ref cookie (HttpOnly/Secure/SameSite=Lax, Path=/session/refresh), POST /session/refresh, logout, logout-all


• [ ] Rate limiting — per-IP + per-user table (login 5/15min, codes 3/10min)

Backlog

Phase 1: Email/Password Identity

• [ ] Registration backend: /api/register/validate, send-code, verify-code, complete (Argon2id, min 10 chars, 6-digit codes, 10-min expiry, 3-attempt lockout)


• [ ] Login backend: /api/login (credential check, 2fa_required response shape), ident_events logging


• [ ] Password reset flow

Phase 2: Auth Frontend

• [ ] Single-page progressive UI (all screens rendered, JS-driven reveal, vanilla JS + core.assets via DocumentShell)


• [ ] Connection tokens (connection_ref carry-through, app redirect-back)


• [ ] Consent screen (app authorization, binary allow/deny)


• [ ] Silent-refresh JS pattern (T+13min timer)

Phase 3: Third-Party Auth

• [ ] Google OAuth + callback + account linking by email


• [ ] Apple Sign-In; Facebook OAuth


• [ ] Social-register: random 16-char password + welcome email


• [ ] Multi-provider linking from account settings

Phase 4: 2FA & Passkeys

• [ ] TOTP setup/verify (±1 window), encrypted secrets, recovery codes


• [ ] WebAuthn/passkey registration + biometric-first login screen


• [ ] Critical-scope 2FA re-verification

Phase 5: Account Dashboard

• [ ] /account pages: Overview, Settings, Personal Data, Security, App Access, Terms (sidebar nav)


• [ ] Session list + per-session revoke + logout-all


• [ ] Recent activity view (ident_events, 30-day window)

Phase 6: Quotas

• [ ] account_types tiers + user_quota_usage tracking


• [ ] 4 quota types + special-credit overflow conversion


• [ ] Quota query API (consumed by core.console enforcement)


• [ ] Monthly reset cron

Phase 7: Multi-Device & SSO Polish

• [ ] QR login (generate/status/confirm endpoints)


• [ ] Multi-session support + sticky sessions + hard cap (30d)


• [ ] Anomaly detection (new-device alerts from ident_events)


• [ ] Per-app TTL config (registered_apps)

Phase 8: User Circle

• [ ] user-circle.js built by core.auth (session context), delivered to apps through core.console; avatar images loaded from core.storage (S3)


• [ ] Multi-account switching (localStorage list + per-user sessions)

Completed

• [x] L2 architecture finalized (13 articles, 2026-06-20 → 06-25)


• [x] Legacy repo wiped for greenfield rebuild (2026-07-17)