Password Login

var discovery = await discoveryService.DiscoverAsync(
    new SqlOSHomeRealmDiscoveryRequest("user@acme.com"), ct);
 
// discovery.Mode → "password" or "sso"

const res = await fetch("/api/v1/auth/discover", {
  method: "POST",
  body: JSON.stringify({ email }),
});
const { mode, organizationId } = await res.json();
 
if (mode === "sso") {
  // Start SSO flow
} else {
  // Show password input
}

var outcome = await authService.LoginWithPasswordAsync(
    new SqlOSPasswordLoginRequest(email, password, clientId, OrganizationId: null),
    httpContext, ct);
 
if (outcome.RequiresOrganizationSelection)
{
    // Present outcome.Organizations, then keep handling the login state machine.
    outcome = await authService.SelectOrganizationForLoginAsync(
        new SqlOSSelectOrganizationRequest(outcome.PendingAuthToken!, selectedOrgId),
        httpContext, ct);
}
 
if (outcome.RequiresMfa)
{
    // Return the MFA challenge or enrollment state to the UI.
    return Results.Ok(new
    {
        next = outcome.RequiresMfaEnrollment ? "enroll_totp" : "verify_mfa",
        outcome.MfaToken,
        outcome.MfaMethods
    });
}
 
var tokens = outcome.Tokens
    ?? throw new InvalidOperationException("Login returned no next state.");

// 1. Discover login mode
const discover = await apiPost("/api/v1/auth/discover", { email });
 
// 2. Login with password
let outcome = await apiPost("/api/v1/auth/login", {
  email,
  password,
  organizationId: discover.organizationId,
});
 
if (outcome.requiresOrganizationSelection) {
  // Show org picker, then:
  outcome = await apiPost("/api/v1/auth/select-organization", {
    pendingAuthToken: outcome.pendingAuthToken,
    organizationId: selectedOrgId,
  });
}
 
if (outcome.requiresMfa) {
  showMfaStep(outcome);
  return;
}
 
// 3. Let the server-side endpoint keep the SqlOS tokens and establish
// an encrypted, Secure, HttpOnly application session cookie.
navigateToApp();

POST /sqlos/auth/password/forgot
POST /sqlos/auth/headless/password/forgot

await authService.RequestPasswordResetEmailAsync(
    new SqlOSForgotPasswordRequest(
        Email: email,
        ClientId: clientId),
    httpContext,
    ct);

POST /sqlos/admin/auth/api/users/{userId}/password-reset-email

builder.AddSqlOS<AppDbContext>(options =>
{
    options.AuthServer.EnableLocalPasswordAuth = false;
});

builder.AddSqlOS<AppDbContext>(options =>
{
    options.AuthServer.RequireVerifiedEmailForPasswordLogin = true;
});

builder.AddSqlOS<AppDbContext>(options =>
{
    options.AuthServer.ConfigurePasswordLoginAbuse(password =>
    {
        password.MaxFailedAttemptsPerAccount = 5;
        password.MaxFailedAttemptsPerIp = 20;
        password.MaxFailedAttemptsPerClient = 50;
        password.FailureWindow = TimeSpan.FromMinutes(15);
        password.LockoutDuration = TimeSpan.FromMinutes(15);
    });
});

builder.AddSqlOS<AppDbContext>(options =>
{
    options.AuthServer.ConfigurePasswordReset(reset =>
    {
        reset.TokenLifetime = TimeSpan.FromHours(1);
        reset.ResendCooldown = TimeSpan.FromSeconds(30);
        reset.MaxRequestsPerEmailPerWindow = 5;
        reset.MaxRequestsPerIpPerWindow = 60;
        reset.MaxRequestsPerClientPerWindow = 300;
        reset.BuildResetUrl = context => context.ClientId switch
        {
            "web" => $"https://app.example.com/reset-password?token={Uri.EscapeDataString(context.Token)}",
            _ => $"https://auth.example.com/sqlos/auth/password/reset?token={Uri.EscapeDataString(context.Token)}"
        };
    });
});