Verify Authendpoints

Verify AuthEndpoints

AuthEndpoints is a library, not a GUI app. The user-facing surface to drive is the HTTP API composed by the in-repo test host in tests/AuthEndpoints.Tests/Program.cs. A later agent that has never seen the repo should launch that host, call the same routes a first-party client would, and keep response files as proof.

xUnit under tests/AuthEndpoints.Tests is complementary regression coverage. It does not replace this skill. Do not treat dotnet test as evidence that a live cookie/CSRF/token path works.

The Nuxt docs site in Documentation/ is a separate surface. Do not use this skill to verify docs UI.

Launch

Preconditions:

• .NET 10 SDK on PATH (dotnet --version starts with 10.).
• Run from the repository root.
• Pick a unique AE_RUN_ID and a free AE_PORT. Do not attach to an already-running host.

export PATH="$HOME/.dotnet:$PATH"   # if the SDK was installed with dotnet-install.sh
export AE_RUN_ID="${AE_RUN_ID:-$(date +%Y%m%dT%H%M%S)-$$}"
export AE_PORT="${AE_PORT:-5088}"
export AE_EVIDENCE_DIR="${AE_EVIDENCE_DIR:-/tmp/authendpoints-verify-${AE_RUN_ID}/evidence}"
HARNESS=".cursor/skills/verify-authendpoints/scripts/ae-http.sh"

chmod +x "$HARNESS"
"$HARNESS" launch
"$HARNESS" doctor

Ready signal for the default compose host: GET {AE_BASE_URL}/identity/csrfToken returns 200 and JSON with csrfToken (Pascal CsrfToken is also accepted). The helper polls that URL after start.

launch turns on OpenTelemetry export when OTEL_EXPORTER_OTLP_ENDPOINT is unset (http://localhost:4317, service name authendpoints-demo). Set OTEL_EXPORTER_OTLP_ENDPOINT to empty before launch to skip export. How to read those traces is in the repository AGENTS.md.

Identity bearer facade: set AE_HOST_MODE=bearer-facade before launch. Ready signal is GET /identity/manage/info returning 401. Doctor prints mode=bearer-facade. See bearer-facade.md.

Teardown: "$HARNESS" stop kills only the PID in $AE_RUN_DIR/host.pid. It must not delete $AE_EVIDENCE_DIR.

What the host actually is (tests/AuthEndpoints.Tests/Program.cs):

Default AE_HOST_MODE=compose:

AE_HOST_MODE=bearer-facade uses AddAuthEndpoints(..., AuthEndpointsSignIn.IdentityBearer) / MapAuthEndpoints instead of the compose maps:

Host defaults that differ from production library defaults:

• SignIn.RequireConfirmedAccount = false (library facade default is true). Set AE_REQUIRE_CONFIRMED_ACCOUNT=true before launch to match the library default for confirmation-gated sign-in.
• Confirm-email SPA redirect is unset. Set AE_CONFIRM_EMAIL_REDIRECT_URI (and AE_CONFIRM_EMAIL_ALLOWED_ORIGINS for an absolute URI) before launch. The launch whitelist passes both through exec env.
• Password rules are relaxed (RequiredLength = 6, no digit/case/symbol requirements). Use Passw0rd!.
• EF Core SQLite file under the temp directory (TestDbName). All users vanish when that file is removed; a new AE_RUN_ID uses a new file.
• JWT signing key is the test-only value in Program.cs. Never treat it as a production secret.
• IEmailSender<TUser> is a capturing sender. GET /test/mailbox lists {email,kind,body} (confirmation links are HTML-encoded). This is a test-only probe.
• Software WebAuthn: POST /test/webauthn/attestation and POST /test/webauthn/assertion turn options JSON into credentialJson. These are test-only probes. The library still verifies attestation/assertion on /account/passkeys/register and /login.

Isolation: two hosts may run on different ports. Refuse to drive a port that was already listening when launch ran. Never kill by process name (pkill, killall).

Doctor

Run "$HARNESS" doctor before the first drive, after any failed drive, and whenever the host looks wrong. It is read-only and must report:

1. $AE_RUN_DIR/host.pid exists and that PID is alive.
2. AE_BASE_URL accepts connections (the port we chose).
3. Compose host: GET /identity/csrfToken is 200 with a non-empty csrfToken. Bearer facade host: GET /identity/manage/info is 401.

If doctor fails, stop (if we started the process) and launch again. Do not keep driving a surprising instance.

Drive

Use the harness. It wraps curl with a cookie jar, retries 429 (login is a token bucket: 10 tokens, +2 / 10s), and can attach CSRF, Authorization: Bearer, and X-AuthEndpoints-Reauth.

HARNESS=".cursor/skills/verify-authendpoints/scripts/ae-http.sh"
EMAIL="verify-${AE_RUN_ID}@test.local"
PASS='Passw0rd!'

"$HARNESS" post /identity/register "{\"email\":\"${EMAIL}\",\"password\":\"${PASS}\"}" --out register
"$HARNESS" post /identity/login "{\"email\":\"${EMAIL}\",\"password\":\"${PASS}\"}" --out login
"$HARNESS" get /identity/manage/info --out info
"$HARNESS" post --csrf /identity/logout --out logout

Stable handles (paths and headers), not coordinates:

Read the feature map before driving. Cover the mapped entry points for the feature you claim, not a single convenient alias.

AE_BEARER and AE_REAUTH are honored by the helper on every request when set:

export AE_BEARER='...'    # Identity bearer or JWT access token
export AE_REAUTH='...'    # reauthToken from confirmIdentity