catalog / services

Auth Service

Registration, sessions, password reset, OAuth providers and role checks.

15 capabilities 2 sections reference specification

Build against it

# give your agent the catalog — no account, no install
claude mcp add provespec -- npx -y provespec-mcp

# then, from any agent session
spec_get(slug: "auth-service")                → the capability tree
spec_checklist(slug: "auth-service")          → the questions to answer
spec_grade(slug: "auth-service", grades: [...])  → parity % + the gap list

# or just fetch it
curl https://provespec.com/catalog/auth-service/spec.json

Grade every capability below as yes · partial · no · na, with a file reference as evidence. Whatever you leave ungraded counts as missing — the gap list is the work queue.

Or just paste this to your agent

Use the ProveSpec MCP server. Fetch the "auth-service" spec with
spec_get, then walk spec_checklist and grade this repository against it —
one verdict per capability, each with a file reference as the note.
Call spec_grade with the results and give me the gap list as the plan.

If the server is not registered, add it first:
  claude mcp add provespec -- npx -y provespec-mcp

The specification

AI 12

Accounts
  • Register with email + password password hashed argon2/bcrypt, never stored plain
  • Email verification signed token link unverified accounts limited
  • Password reset flow expiring token single-use; invalidates sessions on reset
  • Change password (authenticated) requires current password
Sessions
  • Login issues JWT access + refresh short/long lived
  • Refresh-token rotation reuse detection revokes family
  • Logout / revoke single session and all-sessions
Security
  • Rate limiting on auth endpoints per IP + per account
  • Account lockout / backoff on failures with unlock path
  • Audit log of auth events login, reset, revoke, lockout
API
  • Standard error contract no user enumeration same response for unknown email vs wrong password
  • Health + readiness endpoints

UI 3

Pages
  • Login and register forms inline validation
  • Forgot/reset password pages
  • Session management view active sessions, revoke
Download spec.json All 53 specs