noy-db
stable

password

Tier-2 password authenticator slot — a separate, routinely-typed secret from the rarely-typed tier-1 master phrase.

@noy-db/on-password · pnpm add @noy-db/on-password Routine tier-2 login password, distinct from the master phrase.

What it does

enrollPasswordAuthenticator(keyring, { password, minLength, pattern, id }) validates the password (default minimum 12 characters, optional regex pattern) against an already-unlocked keyring's DEKs, then wraps the serialized DEK set — not the KEK — under a PBKDF2-SHA256, 600,000-iteration AES-GCM key: the "wrap-DEKs" variant of KeyringAuthenticator, matching the tier-1 phrase's iteration count. It returns an EnrollAuthenticatorOptions value the caller hands to db.team.enrollAuthenticator(vault, slot). Because it wraps DEKs and not the KEK, a password unlock produces an UnlockedKeyring with kek: null — sensitive operations (enrolling new methods, rotating the phrase) still require a tier-1 unlock with the master phrase.

Usage

import { enrollPasswordAuthenticator } from '@noy-db/on-password'

const keyring = await db.team.getKeyring('acme')
const slot = await enrollPasswordAuthenticator(keyring, {
  password: 'strong-password-2026',
  minLength: 14,
})
await db.team.enrollAuthenticator('acme', slot, { factors: [{ kind: 'totp' }] })

See also

oidc

pin