Skip to main content

confirm_own_password

teamcraft::services::users

Function confirm_own_password 

Source 
pub async fn confirm_own_password(
    pool: &PgPool,
    throttle: &SignInThrottle,
    actor: &Actor,
    password: &str,
) -> AppResult<()>
Expand description

Confirms the actor’s own password for a sign-off (#152 step 4).

§Invariants

  • Permission: a local account (single sign-on accounts sign in again instead, 400); not throttled (429 with the wait); the password must be right (400, counted like a failed sign-in).
  • Audit: a wrong password writes user.password_failed (never the password); a right one writes nothing (the decision records the method).