Repair the clinic access contract

Objectives

Halcyon's release owner proposes reversible password storage so support can recover forgotten passwords, and an eight-hour browser timer as the entire expiry control. They also say the API should accept any signed identity token.

Write the replacement YAML contract from the requirements below. This is a declarative control specification, not executable security middleware; each field must express the server-enforced requirement, with negative tests implemented separately.

Password storage: choose bcrypt, scrypt or argon2; unique random salt per credential.
Session: server-enforced idle limit exactly 15 minutes; absolute limit exactly 480 minutes; rotate at login; invalidate on logout.
Browser cookie: Secure and HttpOnly required.
Delegation: authorization_code flow with S256 PKCE; API accepts access_token only.
Invoice access: server-side ownership/tenant check required; default deny.
Current shortcut: browser hides foreign invoices but API fetches by identifier alone.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Separate verification from recovery

   Choose from the approved password-verifier families and make equal passwords independent at rest. A reset should replace a credential, not recover it.

   Password verifier uses a slow algorithm and unique salt

2. Step 2

   Trace a session through time

   Compare inactivity and total lifetime separately with the requirements. Then consider reuse of an identifier across authentication and after the user leaves.

   Both server-side expiry limits match the contractLogin rotation and logout invalidation are required

3. Step 3

   Constrain browser delivery

   Distinguish transport protection from whether page scripts may read the cookie. The contract requires both protections.

   Browser cookie blocks insecure transport and script reads

4. Step 4

   Follow the delegated exchange

   Read the specified grant, challenge transformation and resource-server token purpose as three separate requirements. A signed identity assertion is not interchangeable with delegated API access.

   Code redemption uses PKCE and the API receives the right token

5. Step 5

   Protect the selected object

   Locate the trusted enforcement boundary, describe the relationship being checked and decide what happens when no permission applies. A hidden interface element cannot protect a direct request.

   Server-side object policy denies unspecified access

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.