Documentation

the data a user maintains about a service they are signed up with.

FIXME: ToJSON instance should go away in order to avoid accidental leakage of cleartext passwords. but for the experimentation phase this is too much of a headache. (Under no circumstances render to something like "[password hidden]". Causes a lot of confusion.)

Information required to create a new User

(Service owner is an Agent, not a User, so that services can (but do not have to) be owned by their parent services in a service hierarchy.)

Service-side authoriziation classes. (For thentos-internal authorization classes, see Role.)

Groups are opaque strings that services can use to manage authorizations for their users in thentos. One reason why thentos offers this (rather than leaving the groups-to-users mapping to the internals of the service) is that this puts us in a position to do anonymized authentication: we can assert a request is issued by a user member in a certain group, but not leak the name of the user.

• Note on the external url field:* Since personas are exposed to the service, it sometimes makes sense for a service to maintain its own data item for each persona in thentos. The persona's external url can be used to point to that data item's rest url.

Some thing or body that deals with (and can authenticate itself before) thentos. Examples: User or Service. (We could have called this Principal, but that name is in use by LIO already.)

Thentos-internal authorization classes. (See Group for service-side authorization classes.)

Wrapper around URI with additional instance definitions.

Path concatenation for avoiding double slashes in paths. One optional / trailing left side / leading right side is removed, and one / is inserted.

Strip an optional slash from the start of a text. If the text doesn't start with a slash, it is returned unchanged.

Strip an optional slash from the end of a text. If the text doesn't end in a slash, it is returned unchanged.

20 bytes of randomness. For comparison: an UUID has 16 bytes, so that should be enough for all practical purposes.

Construct a Random20 from a bytestring. Returns Just a Random20 wrapping the input if its length is 20, Nothing otherwise.

Extract the wrapped 20 bytes from a Random20.