Poweradmin\Domain\Service\Auth

Creates, regenerates, disables and deletes API keys and enforces the per-user key limit.

Outcome of an API key write: the saved key on success, otherwise the reason, its code and the refusal.

Permission gate for the public API. A facade over PermissionService so the API and the web UI share one oracle; group and visible-zone lookups read the user repository.

Checks a DDNS client's password (with login-attempt lockout) and which zones that user may update.

TOTP, email-code and recovery-code verification, MFA enrolment, QR code rendering and enforcement checks.

AES-256-CBC encryption for the password held in the session, keyed from the configured session_key.

Answers permission questions for a user from their template and group grants, cached per request.

Gates perm_templ assignment on user create/update API paths.

Gates what a permission template may contain.

Gates auth-critical fields on user self-edit API paths (#1327).

Pure rules for which requests a session gate (required MFA setup, user agreement) holds back while the user still has to complete it.

Catalogue of the login and user identity $_SESSION keys.

Promotes the half-authenticated pending session into a fully authenticated one.

Session-backed identity of the current user (id, username, auth method) and the session storage controllers use. Domain rules read the actor through ActorInterface instead.

Pure rules for what a user may change on the zone edit screens.

Builds the ownership index the zone lists and the search page use to decide per-row edit/delete controls and owner-column visibility.