🤖 lastsignin

amadan.net/rastrillo/rastrillo/lastsignin

Remembers, in one browser, which way it last used to sign in (keymail, an emailed link or a passkey) and the address for the first two, so the sign-in screen can offer a one-tap. It is a hint for the screen and nothing more: it signs nobody in, and a one-tap is checked from scratch.

You rarely build one yourself. auth.New builds the jar from its own configuration, and auth.RememberJar hands it to passkey.Config.Remember.

func New(cfg Config) (*Jar, error)
type Config struct {
	Origin, InstanceKey, AttemptCookie string
	Mode                               Mode // Off, Forgetting, On
	Now                                func() time.Time
}
func (j *Jar) Mode() Mode
func (j *Jar) CookieName() string
func (j *Jar) Remember(w http.ResponseWriter, rec Record)
func (j *Jar) Read(r *http.Request) (Record, ReadResult) // Absent, Valid, Invalid
func (j *Jar) Clear(w http.ResponseWriter)
func (j *Jar) EndAttempt(w http.ResponseWriter)
type Record struct{ Method, Address string } // MethodKeymail, MethodMagicLink, MethodPasskey

Off writes, reads and deletes nothing, so an app without the shipped screen sees no cookie at all. Forgetting deletes what was remembered and never reads it. On remembers. EndAttempt deletes the screen's attempt cookie; every sign-in path calls it once a first factor checks out.

The cookie is sealed, HttpOnly, and lasts 400 days, the longest browsers allow; each sign-in renews it. Signing out does not delete it.

Read this page as markdown — exact, unstyled, and cheap for an agent to fetch.