---
title: "mova-serve-auth — Mova code model"
description: "Mova code model of tools/mova-serve/src/auth.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/auth.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Translate](https://md.translate.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/auth.rs.groupant/>

# mova-serve-auth

The groupant beside tools/mova-serve/src/auth.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/mova-serve/src/auth.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/mova-serve/src/auth.rs)
- **repository folder:** [`tools/mova-serve/src/auth.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/mova-serve/src/auth.rs.groupant)

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **Approximant** | partial | [Approximant](#approximant) |
| **Ast** | partial | `syntax.json` |
| **Cost** | symbolic source derived | [Cost](#cost) |
| **Descriptant** | present | [Descriptant](#descriptant) |
| **Invariant** | partial | [Invariant](#invariant) |
| **Tests** | executed bounded checks | [Tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | [Behavior complement](#behavior-complement) |
| Reverse reconstruction | reverse reconstruction | partial source derived model | [Reverse reconstruction](#reverse-reconstruction) |
| Model presence | model presence | partial source derived model | [Model presence](#model-presence) |

## Model text


### Descriptant

Accounts: OpenID Connect authorization code flow with PKCE (S256) against Google; the ID token's RS256 signature
checked against the JWKS with iss, aud, exp, nonce and a verified e-mail; sessions and API keys as SHA-256 hashes;
the terms version and time of every acceptance; CSRF tokens as HMAC of the session.

### Approximant

`begin → (state, nonce, verifier)`; `callback(code, state) = verify(exchange(code, verifier), jwks, aud, nonce) →
sign_in`; `by_key(k) = account(hash(k)) if key.terms = current`.

### Invariant

No session token or key is stored in clear; a pending login is used once and expires in ten minutes; keys and
sessions of outdated terms do not authenticate; deletion removes the account, its keys and its sessions.

### Cost

Two HTTPS calls a sign-in (token, JWKS when expired); O(log n) lookups.

### Behavior complement

No password, no e-mail sending, no OAuth server of its own (MCP uses API keys, not OAuth 2.1).

### Reverse reconstruction

A key's prefix and hash identify it; the acceptance records recover who accepted which terms when.

### Model presence

Without the settings file there are no accounts.

### Tests

`auth::tests`: a token signed by a test key verifies, and each of audience, nonce, expiry, issuer, a changed claim,
an unknown key and an unverified e-mail is refused; PKCE equals RFC 7636 appendix B; accounts, sessions and keys
survive a restart as hashes, outdated terms refused, revoke and delete; CSRF bound to the session.

## Provenance

- **source SHA-256:** `2f547e7c960e562b…`
- **repository commit:** `2e25d7bfae9a`