GenerateRecoveryCodes creates a fresh batch of single-use recovery codes, replacing any existing ones, and returns the plaintext codes for one-time di

isCommonPassword reports whether the password appears in the blocklist.

renderRedeemError re-renders the redemption form with an error message. The form is a plain HTML POST, so a JSON body here would replace the page with

ValidateRedirectURL safely validates and sanitizes a redirect URL

invalidateSession removes a session token and both its user and per-IP index entries, so HasActiveSessions does not keep seeing a stale ip_sessions en

rateLimitedUnauthorized applies the validate rate limit and returns 429 once it is exceeded, otherwise 401. Used for every pre-authentication failure

reconcileIndexSets prunes dead token members from every index set matching pattern and returns the number of live members across those sets.

CreateIPExtractor returns a function that extracts the real client IP from request headers. It prioritizes explicit trust configuration but falls back

EnsureUserUIDs backfills UIDs for any legacy users created before UIDs existed. Run once at startup so GetUser can remain read-only.