Dowe

SERVER / PASSWORDS

Protect account credentials

password is Dowe's server-only capability for salted Argon2id hashing and constant-interface verification. Password values and hashes never enter Views.

1 / ACCOUNT FLOW

Hash on registration, verify on login

Store only the PHC result. Login reads the account by a public identifier and verifies the submitted password against that hash.

handler registerAccount
  const body:RegisterInput value:req.json
  password passwordHash source:"hash" value:body.password
  query user conn:CloudDb.insert table:"users" value:{ email:body.email passwordHash:passwordHash }
  return status:201 json:{ ok:true }

handler loginAccount
  const body:LoginInput value:req.json
  query user conn:CloudDb.read table:"users" where:{ email:body.email } required:true
  password verified source:"verify" value:body.password hash:user.passwordHash required:true
  return json:{ ok:true }

Rule	Behavior
No data There are no records to display

2 / SECURITY BOUNDARY

Never return or log credentials

Dowe rejects empty and non-string password inputs. Keep submitted values, PHC hashes, Database fields, and verification bindings inside Server handlers and functions.

A password hash is still credential material. Store it only in the server data layer and never serialize it into a view response.

No data