<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secure Authentication Architecture — API Reference

## agent.js CLI

```bash
# Assess current authentication posture
node scripts/agent.js --action assess

# Design authentication architecture
node scripts/agent.js --action design --mfa fido2 --sso oidc

# Generate IdP configuration
node scripts/agent.js --action configure --provider okta --output auth-config.json

# Validate configuration
node scripts/agent.js --action validate --config auth-config.json
```

## NIST SP 800-63B Authentication Assurance Levels

| Level | Description | Methods |
|-------|-------------|---------|
| AAL1 | Single factor | Password, SMS OTP |
| AAL2 | Two factors | Password + TOTP, Push notification |
| AAL3 | Hardware-backed | FIDO2, PIV, Hardware token |

## FIDO2/WebAuthn API

```javascript
// Registration
const credential = await navigator.credentials.create({
  publicKey: {
    challenge: serverChallenge,
    rp: { name: "App", id: "app.example.com" },
    user: { id: userId, name: username, displayName: displayName },
    pubKeyCredParams: [{ alg: -7, type: "public-key" }],
    authenticatorSelection: {
      residentKey: "required",
      userVerification: "required"
    }
  }
});

// Authentication
const assertion = await navigator.credentials.get({
  publicKey: {
    challenge: serverChallenge,
    rpId: "app.example.com",
    userVerification: "required"
  }
});
```

## Session Cookie Security

| Attribute | Recommended | Purpose |
|-----------|-------------|---------|
| `__Host-` prefix | Yes | Prevents domain scoping |
| `HttpOnly` | Yes | No JavaScript access |
| `Secure` | Yes | HTTPS only |
| `SameSite=Lax` | Yes | CSRF protection |
| `Max-Age` | 3600 | 1 hour maximum |
| `Path=/` | Yes | Full application scope |
