r-same-azure-ad-sso-deferred-v1-local-auth-only

Azure AD SSO was planned for v1 but deferred because Runwal’s AD infrastructure is not yet complete. v1 uses local auth only: argon2id (OWASP 2024 params), TOTP MFA via pyotp, JWT in HttpOnly+Secure+SameSite=Lax cookies (15min access / 7d refresh). Stub interfaces exist for future AD migration path: dual-mode → per-user email-match → deprecate local.

Related

• r-dash-auth-amendment-local-auth-v1-azure-ad-sso-deferred
• r-dash-azure-ad-deferred-local-auth-v1-stack
• r-same-local-auth-v1-azure-ad-deferred
• azure-ad-sso-deferred-local-auth-v1-stub-interfaces
• r-same-azure-ad-sso-deferred-local-auth-v1
• azure-ad-sso-deferred-v1-uses-local-auth
• azure-ad-sso-deferred-local-auth-is-v1
• r-same-azure-ad-deferred-local-auth-v1