# `MishkaCmsCore.Accounts`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/accounts.ex#L5)

MishkaCms Accounts Domain - Complete user authentication and authorization system.

This Ash domain provides comprehensive user management capabilities including
authentication, authorization, permission management, and secure token handling
for the MishkaCms platform. Built with security-first principles and modern
authentication patterns.

## Domain Architecture

Organizes user and security resources into a cohesive system:
- **User Management**: User registration, authentication, and profile management
- **Permission System**: Role-based access control with granular permissions
- **Token Management**: Secure token generation and validation
- **Password Security**: Secure password handling with reset capabilities
- **API Integration**: RESTful endpoints for authentication workflows

## Resource Organization

```
MishkaCmsCore.Accounts/
├── User - Core user accounts with authentication
├── Token - Secure token management for sessions/API access
├── Permission - System permissions and capabilities
└── UserPermission - User-permission relationship mapping
```

## Key Features

- **Password Authentication**: Secure password-based user authentication
- **Token-based API Access**: JWT or similar token system for API authentication
- **Permission Management**: Granular permission assignment and validation
- **Password Reset**: Secure password reset via email tokens
- **User Registration**: Streamlined user onboarding process
- **Profile Management**: User profile updates and management
- **Admin Controls**: Administrative user and permission management

### Permission Management

An admin permission is `admin:<surface>:<area>`, a plain string written where it is used.
Accounts are managed with the user area, and what they hold with the permission area:

```elixir
alias MishkaCmsCore.Accounts.Checks.AccessPermissions

# Grant an account what the granter holds (`admin:<surface>:permission`, within its ceiling)
user
|> Ash.Changeset.for_update(:assign_permissions, %{permission_ids: ids}, actor: granter)
|> Ash.update()

# Ask what a user holds
AccessPermissions.match?(user, %{}, permissions: ["admin:dashboard:runtime:page"])
```

## Security Features

### Password Security
- Secure password hashing (likely Argon2 or bcrypt)
- Password strength validation
- Secure password reset workflow
- Protection against timing attacks

### Token Security
- Secure token generation and validation
- Token expiration and refresh capabilities
- API endpoint protection via token authentication
- Automatic token metadata in authentication responses

### Permission System
- Granular permission assignment
- Role-based access control (RBAC)
- Permission validation middleware
- Administrative permission management

## Error Handling

The domain includes comprehensive error handling:
- Authentication failures with proper HTTP status codes
- Invalid token handling
- Permission denied responses
- User not found scenarios
- Password reset token validation

## Multi-tenant Considerations

- Users can have different permissions per site/tenant
- Token validation respects tenant boundaries
- Permission checks include tenant context
- Administrative operations scoped to appropriate tenants

## Production Considerations

- Monitor authentication attempt rates and patterns
- Implement proper session timeout policies
- Regular audit of user permissions and access
- Secure token storage and transmission
- Password policy enforcement
- Account lockout policies for security
- Regular cleanup of expired tokens
- Comprehensive audit logging of authentication events

# `aggregate`

> This function is deprecated. Use `Ash.aggregate/3` instead.

# `aggregate!`

> This function is deprecated. Use `Ash.aggregate!/3` instead.

# `avg`

> This function is deprecated. Use `Ash.avg/3` instead.

# `avg!`

> This function is deprecated. Use `Ash.avg!/3` instead.

# `bulk_create`

> This function is deprecated. Use `Ash.bulk_create/4` instead.

# `bulk_create!`

> This function is deprecated. Use `Ash.bulk_create!/4` instead.

# `bulk_destroy`

> This function is deprecated. Use `Ash.bulk_destroy/4` instead.

# `bulk_destroy!`

> This function is deprecated. Use `Ash.bulk_destroy!/4` instead.

# `bulk_update`

> This function is deprecated. Use `Ash.bulk_update/4` instead.

# `bulk_update!`

> This function is deprecated. Use `Ash.bulk_update!/4` instead.

# `calculate`

> This function is deprecated. Use `Ash.calculate/3` instead.

# `calculate!`

> This function is deprecated. Use `Ash.calculate!/3` instead.

# `can`

> This function is deprecated. Use `Ash.can/3` instead.

```elixir
@spec can(
  action_or_query_or_changeset ::
    Ash.Query.t()
    | Ash.Changeset.t()
    | {Ash.Resource.t(), atom() | Ash.Resource.Actions.action()},
  actor :: term(),
  opts :: Keyword.t()
) ::
  {:ok, boolean() | :maybe}
  | {:ok, true, Ash.Changeset.t() | Ash.Query.t()}
  | {:ok, true, Ash.Changeset.t(), Ash.Query.t()}
  | {:ok, false, Exception.t()}
  | {:error, term()}
```

# `can?`

> This function is deprecated. Use `Ash.can?/3` instead.

```elixir
@spec can?(
  query_or_changeset_or_action ::
    Ash.Query.t()
    | Ash.Changeset.t()
    | {Ash.Resource.t(), atom() | Ash.Resource.Actions.action()},
  actor :: term(),
  opts :: Keyword.t()
) :: boolean() | no_return()
```

# `count`

> This function is deprecated. Use `Ash.count/2` instead.

# `count!`

> This function is deprecated. Use `Ash.count!/2` instead.

# `create`

> This function is deprecated. Use `Ash.create/2` instead.

# `create!`

> This function is deprecated. Use `Ash.create!/2` instead.

# `default_short_name`

# `destroy`

> This function is deprecated. Use `Ash.destroy/2` instead.

# `destroy!`

> This function is deprecated. Use `Ash.destroy!/2` instead.

# `exists`

> This function is deprecated. Use `Ash.exists/2` instead.

# `exists?`

> This function is deprecated. Use `Ash.exists?/2` instead.

# `first`

> This function is deprecated. Use `Ash.first/3` instead.

# `first!`

> This function is deprecated. Use `Ash.first!/3` instead.

# `get`

> This function is deprecated. Use `Ash.get/3` instead.

# `get!`

> This function is deprecated. Use `Ash.get!/3` instead.

# `json_api_match_route`

# `list`

> This function is deprecated. Use `Ash.list/3` instead.

# `list!`

> This function is deprecated. Use `Ash.list!/3` instead.

# `load`

> This function is deprecated. Use `Ash.load/3` instead.

# `load!`

> This function is deprecated. Use `Ash.load!/3` instead.

# `max`

> This function is deprecated. Use `Ash.max/3` instead.

# `max!`

> This function is deprecated. Use `Ash.max!/3` instead.

# `min`

> This function is deprecated. Use `Ash.min/3` instead.

# `min!`

> This function is deprecated. Use `Ash.min!/3` instead.

# `page`

> This function is deprecated. Use `Ash.page/2` instead.

# `page!`

> This function is deprecated. Use `Ash.page!/2` instead.

# `read`

> This function is deprecated. Use `Ash.read/2` instead.

# `read!`

> This function is deprecated. Use `Ash.read!/2` instead.

# `read_one`

> This function is deprecated. Use `Ash.read_one/2` instead.

# `read_one!`

> This function is deprecated. Use `Ash.read_one!/2` instead.

# `reload`

> This function is deprecated. Use `Ash.reload/2` instead.

# `reload!`

> This function is deprecated. Use `Ash.reload!/2` instead.

# `run_action`

> This function is deprecated. Use `Ash.run_action/2` instead.

# `run_action!`

> This function is deprecated. Use `Ash.run_action/2` instead.

# `stream!`

> This function is deprecated. Use `Ash.stream!/2` instead.

# `sum`

> This function is deprecated. Use `Ash.sum/3` instead.

# `sum!`

> This function is deprecated. Use `Ash.sum!/3` instead.

# `update`

> This function is deprecated. Use `Ash.update/2` instead.

# `update!`

> This function is deprecated. Use `Ash.update!/2` instead.

---

*Consult [api-reference.md](api-reference.md) for complete listing*