Minn\Auth

Every application password of a user, as stored records without the hash's plain text.

One record by uuid, or null.

Mints a password, stores its hash, and returns the record with the plain text once.

Renames one password; null when the uuid is unknown.

Records a use: the time and the address it came from.

Removes one password and returns its record; null when unknown.

Removes every application password of a user and returns how many.

The record a plaintext (spaces ignored) unlocks for the user, or null.

Twenty-four letters and digits.

The plaintext as shown once: groups of four, space separated.

The hash suffixed onto every cookie name: md5 of the siteurl option.

The sign-in cookies as the reference settles them (suite login-hooks): their life through auth_cookie_expiration (two days, or fourteen when remembered, the cookies then kept twelve hours past it); the auth cookie's security through secure_auth_cookie, and the logged-in cookie's through secure_logged_in_cookie (secure only over HTTPS); a session made for that life when none is given; then set_auth_cookie and set_logged_in_cookie told the values, and send_auth_cookies asked whether to send them. Signing in always runs under the booted runtime (its sessions are WordPress's), so the hooks always run.

The response with the settled cookies on it: the auth cookie on the admin and plugins paths, the logged-in cookie on the site root; none when send_auth_cookies said not to.

Whether signing out clears the cookies: clear_auth_cookie told, then send_auth_cookies asked with no cookie in hand, as the reference asks them (suite login-hooks).

The response with every sign-in cookie expired.

A cookie value under any scheme's salt (auth, secure_auth, logged_in).

A good sign-in cookie sent without the nonce that would let it vouch for its user.

No usable session.

A session whose nonce did not verify.

The signed-in user's id.

An authenticator over the shared database door.

The session the cookie jar carries, or why there is none.

The session for a REST call: the cookie, then the nonce. A cookie sent without a nonce is no sign-in at all (the request goes on signed out, as the reference's cookie check makes it); one with a nonce that does not verify is refused (suite auth, checked against the reference).

A REST caller: the cookie session with its nonce first; failing that, HTTP Basic credentials carrying an application password, which need no nonce. A wrong Basic pair is reported as not logged in.

The user an Authorization: Basic header's application password unlocks, with the use recorded.

The login and password an Authorization: Basic header carries, or null.

Application passwords need HTTPS, unless plugin code says otherwise through the reference's filter.

Whether Basic auth may sign this user in; the runtime's filter has the last word.

Username and password to a user row, an outdated hash replaced as the sign-in succeeds; no session is created here.

The capability engine over the shared database door.

The role definitions.

The capabilities stored on the user, as stored: role names and the capabilities granted (or taken away) one by one.

The role slugs a user holds: each stored capability that names a registered role, whatever it is set to (probe: the reference counts 'editor' => false as a role). One a plugin granted but never registered does not count.

Everything a user holds, as the reference's allcaps: each role's capabilities in turn, then the user's own over them, role names included, so a capability taken away one by one stays away and current_user_can('administrator') is true for an administrator. Values are as stored.

Does the user hold every primitive the (possibly meta) capability maps to?

The primitives a capability requires, all of which must be held.

The cookie name this site uses: a hash of the siteurl option.

A sign-in cookie value for a user, expiry, and session token.

The session a logged_in cookie value proves, or null when any part fails.

A cookie's parts judged under a scheme, in the reference's order: expired (past its expiration plus $grace), bad_username, bad_hash (an unknown scheme never matches), bad_session_token, else valid with its user.

The logged_in cookie from a request's cookie jar: the canonical name first, then any logged_in cookie, since tooling may send a name derived from a different host.

A cookie's hmac under a scheme's salt, or null for a scheme with none.

Whether this PHP can make and check these hashes (the sodium extension).

The "$generic$" hash of a secret.

Whether a secret matches a "$generic$" hash; false for any other kind of hash.

Seconds the address must wait, or null when it may try.

Counts one failed sign-in from an address within the current window.

Forgets an address's failures.

Drops counters whose window has passed, at most a thousand in one statement, however many addresses have failed; the number dropped.

How long a nonce for an action lives, in seconds (nonce_life, handed the action as the caller gave it; probe filter-inputs-3). A plugin's filter reaches every nonce the engine makes and checks once plugins have loaded; a lifetime under a second keeps the default.

The current half-life tick a nonce for an action is bound to.

A wp_rest nonce for a user and session token at the current tick.

Whether a nonce is valid at this tick or the one before.

The nonce for a given tick.

Whether a password matches a stored hash: the "$wp$" scheme, legacy phpass, or any hash password_hash() makes. A password over 4,096 characters never matches and costs no hashing.

A stored hash: bcrypt in the "$wp$" scheme over the pre-hash, or, under any other algorithm, that algorithm's own hash of the password.

Whether a stored hash is not the one these settings would make: under bcrypt, anything outside the "$wp$" scheme or at another cost; under another algorithm, whatever PHP says is outdated for it.

The four characters of the hash the cookie key is derived from: offset 8 for legacy phpass ("$P$") and plain bcrypt ("$2y$"), the LAST four for anything else ("$wp$", argon2, whose offset 8 is the same for every password). Getting this wrong yields a cookie that verifies nowhere while every other check passes, so the branches are pinned by the auth suite and the 2026-10-13 audit's probe.

Mints a key, stores its hash, returns the key for the link.

A new key and the value that stores it (the time it was issued and its hash), for a caller that saves it itself.

True when the key matches the stored hash and has not expired: a day, or what password_reset_expiration makes it.

"valid", "expired" (a matching key past its lifetime, a day unless given), "unstamped" (a matching key stored without a time, which the reference counts expired after asking password_reset_key_expired), or "invalid".

Forgets a user's reset key.

The longest password hashed; a longer one is refused before any work, as the reference refuses it.

A portable hash of a password, 2^$countLog2 iterations (the reference's cookies carry 2^13); "*" for one too long.

A portable setting: "$P$", the count's character, and six bytes of salt encoded.

A bcrypt setting: "$2a$", the two-digit cost, and the first sixteen bytes in bcrypt's base64.

Whether a password matches a portable hash from the published algorithm.

The hash for a setting; for a setting it cannot use ("$P$" or "$H$", a count from 7 to 30, eight characters of salt) phpass's marker "*0", or "*1" when the setting is itself "*0".

phpass's base64: little-endian groups of three bytes, $count bytes of the input.

A post type's registered object (any but post and page), or null.

A plugin's taxonomy, or null.

The wp_user_level stored beside the capabilities meta.

The {role: true} capabilities meta in its serialized form.

Drops the parsed map so the next read sees a rewritten option.

Every role with its name and capabilities, from the option or the shipped defaults.

Each role is a string key over a two-entry array of "name" and "capabilities"; the capabilities map is {cap: bool}. Null when the blob has another shape, so the caller can fall back.

True when every key and salt is defined and none is the installer's placeholder.

Whether a scheme has a key and salt of its own (auth, secure_auth, logged_in, nonce).

The key and salt of a scheme joined, as the reference feeds them to its HMACs.

HMAC-md5 under the scheme's salt: the primitive every cookie and nonce is built from.

A 43-character token; only sha256(token) is ever stored or compared.

Whether a session token is still stored and unexpired for a user.

Creates a session, pruning expired ones, and returns the raw token.

A request-supplied field (the address, the user agent) as the store keeps it: the store is read back by shape, so it carries nothing that looks like the shape, and no more than 255 characters.

Ends every session of the user (a password change).

Removes one session; true when it existed.

Removes the session stored under a key (the sha256 of its token); true when it existed.

Ends every session of the user except the one stored under the given key.

Every stored session of a user, keyed by token hash. Each entry keeps its stored text under raw, so writing the store back leaves sessions this request did not make exactly as they were, including anything a plugin attached to them.

The map in PHP's serialized form: stored entries as they were read, new ones key by key in the order given.

Seconds this address must wait before another attempt, or null when it may try now.

Counts one failed attempt from an address.

The cookie-name hash the sign-in cookies, the postpass cookie, and the reset cookie share.

Signs a user in for two days: a new session, and the response with the cookies attached for the browser session.

Signs a user in for fourteen days, the cookies kept past the browser session: "remember me", and the one-time login link.

Ends one session and clears the cookies from the response, unless send_auth_cookies says not to (AuthCookies::clearing).

Ends every session of a user (a password reset) and clears the cookies from the response.

The response with the sign-in cookies cleared.

A cap name built from the post/page family, folded when the type folds, or the plugin type's own name for it (probe rest-plugin-caps).

The capability creating a post of the type needs: the edit capability, or a plugin type's create_posts.

The capability stem of a type: pages for page, posts for everything else.

The edit capability of a type.

The edit-others capability of a type.

The publish capability of a type.

The read-private capability of a type.