{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://docs.qauth.dev/interaction/v1-rc.0/steps/password.json",
  "title": "urn:qauth:ia:password:v1-rc.0",
  "description": "The password factor. A rejected password, an unknown account and a disabled account give the same `invalid_credentials`, after the same timing floor (ADR-017 Decisions 3 and 4). Works without JavaScript: the form posts straight to the auth server with the step’s CSRF value (ADR-019 Decision 5).",
  "x-qauth-transports": [
    "interaction",
    "fipa"
  ],
  "type": "object",
  "properties": {
    "type": {
      "const": "urn:qauth:ia:password:v1-rc.0",
      "description": "The step name."
    },
    "params": {
      "$ref": "#/$defs/params"
    },
    "answer": {
      "$ref": "#/$defs/answer"
    },
    "personal": {
      "$ref": "#/$defs/personal"
    },
    "error": {
      "$ref": "#/$defs/error"
    },
    "amr": {
      "$ref": "#/$defs/amr"
    }
  },
  "required": [
    "type",
    "params",
    "answer",
    "personal",
    "amr"
  ],
  "examples": [
    {
      "type": "urn:qauth:ia:password:v1-rc.0",
      "params": {},
      "answer": {
        "password": "correct horse battery staple x"
      },
      "personal": {
        "identifier": "alice@example.com"
      },
      "error": "invalid_credentials",
      "amr": [
        "pwd"
      ]
    }
  ],
  "$defs": {
    "params": {
      "type": "object",
      "properties": {},
      "additionalProperties": false,
      "examples": [
        {}
      ]
    },
    "answer": {
      "type": "object",
      "properties": {
        "password": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "The password. The server refuses one longer than 256 UTF-16 code units before anything else (ADR-017 Decision 8)."
        },
        "login_hint": {
          "type": "string",
          "minLength": 3,
          "maxLength": 254,
          "pattern": "^[^@\\s]+@[^@\\s]+$",
          "description": "The identifier: today an email address of at most 254 bytes in UTF-8 (ADR-017 Decision 3). The schema counts characters; the server counts bytes, checks the full email syntax and normalises the address before use. Sent only when the transaction holds no identifier yet: a page that asks for both at once."
        }
      },
      "required": [
        "password"
      ],
      "additionalProperties": false,
      "examples": [
        {
          "password": "correct horse battery staple x"
        }
      ]
    },
    "personal": {
      "type": "object",
      "description": "Who the transaction is for, so the screen can show it with a way to switch accounts. Absent until the transaction has an identifier.",
      "properties": {
        "identifier": {
          "type": "string",
          "minLength": 1,
          "maxLength": 254,
          "pattern": "^[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0](?:[^<>\\p{C}\\p{Zl}\\p{Zp}\\u115F\\u1160\\u3164\\uFFA0]*[^<>\\p{C}\\p{Z}\\u115F\\u1160\\u3164\\uFFA0])?$",
          "x-qauth-display": "account",
          "description": "The identifier of the account this transaction is for. Before a first factor succeeds it is the identifier exactly as the person gave it, after the one normalisation every input gets, whether or not an account holds it, so it tells nothing about which accounts exist; the form the account holds appears only after authentication. Personal data: only the personal-data read returns it."
        }
      },
      "additionalProperties": false,
      "examples": [
        {
          "identifier": "alice@example.com"
        }
      ]
    },
    "error": {
      "type": "string",
      "enum": [
        "invalid_credentials"
      ],
      "description": "Why the last answer was refused. A closed set."
    },
    "amr": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "const": [
        "pwd"
      ],
      "description": "The RFC 8176 `amr` values a successful answer adds to the transaction."
    }
  }
}