boundary.user.shell.auth — org.boundary-app/boundary-user 1.0.0-beta-1

Shell Layer - Authentication service with side effects.

This is the SHELL layer for authentication operations:

• Password hashing and verification (bcrypt)
• JWT token creation and validation
• Session token generation
• Authentication coordination
• MFA verification

All I/O and side effects happen here. Pure business logic is delegated to boundary.user.core.authentication.

authenticate-user clj

(authenticate-user auth-service email password login-context)

Coordinate user authentication with all security checks including MFA.

Args: auth-service: AuthenticationService instance email: User email password: Plain text password login-context: Map with :ip-address, :user-agent, :mfa-code (optional)

Returns: Authentication result map with :success?, :user, :session, :requires-mfa?, etc.

change-user-password clj

(change-user-password user-id
                      old-password
                      new-password
                      user-repository
                      auth-config)

Shell function: Change user password with validation.

Args: user-id: User ID old-password: Current password (for verification) new-password: New password to set user-repository: IUserRepository implementation auth-config: Authentication configuration

Returns: {:success? boolean :error optional-string}

Side effects: Password hashing, I/O operations

create-authentication-service clj

(create-authentication-service user-repository
                               session-repository
                               mfa-service
                               auth-config)

Factory function: Create authentication service instance.

Args: user-repository: IUserRepository implementation session-repository: IUserSessionRepository implementation mfa-service: MFAService implementation
auth-config: Authentication configuration map

Returns: AuthenticationService instance

create-jwt-token clj

(create-jwt-token user session-duration-hours)

Shell function: Create JWT token for authenticated user.

Args: user: User entity session-duration-hours: How long token should be valid

Returns: JWT token string

Side effects: Crypto operations, time-dependent

create-user-with-password clj

(create-user-with-password user-data _user-repository)

Shell function: Create user with hashed password.

Args: user-data: User creation data with plain text password user-repository: IUserRepository implementation

Returns: User entity with password-hash field populated

Side effects: Password hashing, I/O operations

generate-session-token clj

(generate-session-token)

Shell function: Generate cryptographically secure session token.

Returns: URL-safe base64-encoded random token string (no +, /, or = chars). Uses URL-safe encoding so tokens can safely appear in URL paths without triggering Jetty 'Ambiguous URI path separator' errors.

Side effects: Secure random generation

hash-password clj

(hash-password password)

Shell function: Hash password using bcrypt.

Args: password: Plain text password

Returns: Bcrypt hash string (60 characters)

Side effects: Crypto operations with secure random

validate-jwt-secret! clj

(validate-jwt-secret!)

Fail-fast startup check: force resolution + validation of JWT_SECRET so a missing or too-short secret aborts boot, rather than booting green and failing on the first authentication request. Call from system wiring.

validate-jwt-token clj

(validate-jwt-token token)

Shell function: Validate and decode JWT token.

Args: token: JWT token string

Returns: {:valid? true :claims {...}} or {:valid? false :error string}

Side effects: Crypto operations

verify-password clj

(verify-password password hash)

Shell function: Verify password against bcrypt hash.

Args: password: Plain text password
hash: Bcrypt hash string

Returns: Boolean - true if password matches

Side effects: Crypto operations