Interface SignInConfig

Route prefix. Defaults to /auth.

MFA policy: decides when a second factor is required at sign-in. Absent means no second factor is ever required.

Passkeys (WebAuthn): registers the four ceremony routes under <basePath>/passkeys and lets a passkey assertion with user verification count as the second factor for mfa. Requires the session capability.

The providers to offer. An empty list configures a password-only sign-in: the application records its own principal through IAuthSessionService.signIn, and signIn supplies the auth-session capability, the per-request refreshPrincipal and sessionStamp checks, the pending second-factor state when mfa is set, and the logout route.

Re-read the principal on every request instead of trusting the session snapshot. Return null to make the request anonymous — that is how a deactivation or a revoked role takes effect before the session ends. Absent, the snapshot is used and stays in force until sign-out.

Reads the user's current session stamp. Recorded at sign-in and compared on every request; changing the stamp on the user record ends every session the user holds. Absent, no stamp is recorded or compared. See SessionStamp.