User authentication
RAIQL 0.8 can compile identity requirements into a PostgreSQL-backed user model, registration and login APIs, password hashing, JWT issuance and application login screens.
Declare an identity model
CREATE USER ENTITY User;This creates the compiler-owned identity entity with id, unique email, passwordHash and role fields. The password hash field is never accepted from public registration.
Enable email/password + JWT
ADD AUTHENTICATION EMAIL_PASSWORD, JWT;EMAIL_PASSWORD currently requires DATABASE POSTGRESQL and JWT. Registration and login persist users and return a signed access token used by generated API authorization.
Declare safe registration defaults
ADD ROLE ADMIN, USER;
DEFAULT ROLE USER;Public registration always receives the server-controlled default role. A client cannot submit ADMIN during registration. The default role must be declared with ADD ROLE.
Password storage
Generated applications hash passwords with Node.js scrypt using a random per-password salt. The generated database stores the encoded salt and derived hash, never the submitted password.
Generated identity routes
POST /api/auth/register
POST /api/auth/login
GET /api/auth/meRegistration validates email/password input, rejects duplicate email addresses and assigns the default role. Login verifies the stored password hash before issuing an HS256 JWT. /api/auth/me validates the bearer token and returns the authenticated principal.
Generated application UI
The PostgreSQL target emits /register and /login pages plus session-aware access controls. The browser stores the issued access token locally and attaches it to generated protected API requests.
Security boundary
RAIQL 0.8 provides a practical generated identity baseline, not a complete identity platform. Production deployments should use strong secrets, HTTPS, rate limiting and appropriate account recovery/verification policies. Password reset, MFA, refresh-token rotation and external identity providers are not generated in 0.8.