--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/connectors/auth_http_adapter.c	Mon Aug 17 22:22:36 2026 -0700
@@ -0,0 +1,141 @@
+#include "connectors/auth_http_adapter.h"
+
+#include <openssl/crypto.h>
+
+#include <string.h>
+#include <time.h>
+
+static int32 hex_value(char value)
+{
+  if (value >= '0' && value <= '9')
+    return value - '0';
+  if (value >= 'a' && value <= 'f')
+    return value - 'a' + 10;
+  if (value >= 'A' && value <= 'F')
+    return value - 'A' + 10;
+  return -1;
+}
+
+static boolean decode_secret(
+    const char *hex, uint8 *output, size_t capacity, size_t *length_out)
+{
+  if (!hex || !output || !length_out)
+    return FALSE;
+  size_t length = strlen(hex);
+  if (length % 2 != 0 || length / 2 > capacity ||
+      length / 2 < AUTH_CRYPTO_COOKIE_SECRET_MIN_BYTES)
+    return FALSE;
+  for (size_t i = 0; i < length; i += 2) {
+    int32 high = hex_value(hex[i]);
+    int32 low = hex_value(hex[i + 1]);
+    if (high < 0 || low < 0) {
+      OPENSSL_cleanse(output, capacity);
+      return FALSE;
+    }
+    output[i / 2] = (uint8)((high << 4) | low);
+  }
+  *length_out = length / 2;
+  return TRUE;
+}
+
+boolean Connector_Auth_HTTP_Init(
+    Connector_Auth_HTTP_Context *context,
+    const char *database_path,
+    const char *cookie_secret_hex,
+    int64 session_idle_ttl_secs)
+{
+  if (!context || !database_path || !cookie_secret_hex ||
+      session_idle_ttl_secs <= 0)
+    return FALSE;
+  memset(context, 0, sizeof(*context));
+  if (!decode_secret(
+          cookie_secret_hex, context->cookie_secret,
+          sizeof(context->cookie_secret), &context->cookie_secret_length))
+    return FALSE;
+  context->store = Auth_Store_Create(database_path);
+  if (!context->store) {
+    OPENSSL_cleanse(context->cookie_secret, sizeof(context->cookie_secret));
+    context->cookie_secret_length = 0;
+    return FALSE;
+  }
+  context->session_idle_ttl_secs = session_idle_ttl_secs;
+  return TRUE;
+}
+
+void Connector_Auth_HTTP_Destroy(Connector_Auth_HTTP_Context *context)
+{
+  if (!context)
+    return;
+  if (context->store)
+    Auth_Store_Destroy(context->store);
+  OPENSSL_cleanse(context, sizeof(*context));
+}
+
+static const char *resolve_user(
+    Seobeo_Request_Entry *request,
+    boolean require_csrf,
+    Dowa_Arena *arena,
+    void *opaque)
+{
+  Connector_Auth_HTTP_Context *context = opaque;
+  if (!context || !context->store || !arena)
+    return NULL;
+  Auth_HTTP_Authenticated_User authenticated;
+  Auth_HTTP_Resolve_Result result = Auth_HTTP_Resolve_Authenticated_User(
+      request, context->store, context->cookie_secret,
+      context->cookie_secret_length, (int64)time(NULL),
+      context->session_idle_ttl_secs, &authenticated);
+  if (result != AUTH_HTTP_RESOLVE_OK)
+    return NULL;
+  if (require_csrf && !Auth_HTTP_Verify_CSRF(
+          request, context->cookie_secret, context->cookie_secret_length,
+          authenticated.token_digest)) {
+    OPENSSL_cleanse(&authenticated, sizeof(authenticated));
+    return NULL;
+  }
+  size_t id_length = strlen(authenticated.user.id);
+  char *user_id = Dowa_Arena_Allocate(arena, id_length + 1);
+  if (user_id)
+    memcpy(user_id, authenticated.user.id, id_length + 1);
+  OPENSSL_cleanse(&authenticated, sizeof(authenticated));
+  return user_id;
+}
+
+static boolean resolve_session(
+    Seobeo_Request_Entry *request,
+    Connector_Auth_Session *session,
+    void *opaque)
+{
+  Connector_Auth_HTTP_Context *context = opaque;
+  if (!context || !context->store || !session)
+    return FALSE;
+  Auth_HTTP_Authenticated_User authenticated;
+  Auth_HTTP_Resolve_Result result = Auth_HTTP_Resolve_Authenticated_User(
+      request, context->store, context->cookie_secret,
+      context->cookie_secret_length, (int64)time(NULL),
+      context->session_idle_ttl_secs, &authenticated);
+  if (result != AUTH_HTTP_RESOLVE_OK)
+    return FALSE;
+  memset(session, 0, sizeof(*session));
+  snprintf(session->user_id, sizeof(session->user_id), "%s",
+           authenticated.user.id);
+  snprintf(session->username, sizeof(session->username), "%s",
+           authenticated.user.username);
+  snprintf(session->role, sizeof(session->role), "%s",
+           authenticated.user.role);
+  snprintf(session->csrf_token, sizeof(session->csrf_token), "%s",
+           authenticated.csrf_token);
+  OPENSSL_cleanse(&authenticated, sizeof(authenticated));
+  return TRUE;
+}
+
+Connector_Auth_Adapter Connector_Auth_HTTP_Create_Adapter(
+    Connector_Auth_HTTP_Context *context)
+{
+  Connector_Auth_Adapter adapter = {
+    .resolve_user = resolve_user,
+    .resolve_session = resolve_session,
+    .context = context
+  };
+  return adapter;
+}