go-authcrunch: Skill for Codex

SQLite Registration

plugins/registration-workflows/sqlite composes the SQLite identity store and message outbox. Its Workflow implements registry.Provider and the optional registry.ConfirmationProvider. Fresh confirmation creates an enabled account with only authp/user; there is no administrative approval step. Recovery of an already-created enrollment preserves subsequent account management changes, including disabled state.

Configuration and attachment

Use parser.NewSQLiteRegistrationConfigFromDirectives([]string). Required: name, absolute path, identity_store, realm, email_provider, and public_origin (a canonical HTTPS origin without path, userinfo, query or fragment; explicit ports must be 1–65535). Optional base_path defaults to /auth; it accepts / or slash-separated ASCII letters/digits/underscore/hyphen segments without a trailing slash, at most 512 bytes. Typed and parser validation also apply portalpath.Validate and the shared reserved mount rules: whole namespace segments (including connected-accounts) and legacy prefixes such as register cannot appear in any mount segment. Unicode and semicolons cannot preserve browser cookie Path scope; SQLite's narrower segment rule stays in force. Realm values remain data. Align the declared host mount with this backend path so confirmation links reach the selected portal; validation does not create routes. Optional timeout defaults to 1s and permits 1ms..30s. Each setting takes one value once. Realm is 1–64 ASCII letters/digits/underscore/hyphen. Parser validation is pure.

Construct New(ctx, config, *accounts.Store, *notifications.Outbox) using the public SQLite identity-store and messaging packages. The store's name/realm must match configuration. The constructor creates an internal messaging binding under email_provider; no host-global lookup occurs. Backend configuration is snapshotted. The workflow owns only its pending database. Supplied account/outbox lifetimes remain with the host. Read the shared private SQLite contract. All three files must be distinct. This plugin uses pure Go and no background job.