Module loginflow 

Signing in to a Nextcloud through its own page, in the browser: its Login Flow v2 (docs/database.md, “Joining through your Nextcloud’s sign-in”). A device with nothing set up yet gets an app password of its own, made by the server, without a password typed into Sioul; with it, the sharing folder is found there and joined, and the contacts and calendars come.

• Begun (begin): POST <server>/index.php/login/v2, signed in as nobody; the server answers the page to open (login) and where to ask for the result (poll: an address, and a token).
• The page opens in the system’s browser: you sign in there as on the server’s own site, its second step included, and grant Sioul access.
• Asked (wait): the poll address asked every three seconds, the token in the request’s body, until it answers the server, your login name and an app password; stopped at Cancel, after twenty minutes (the server’s own limit for a sign-in), or when it answers.
• Kept to the server you chose: HTTPS only; the page, the poll address and the server the answer names, each on the origin you chose (scheme, host and port); one elsewhere is refused, and nothing is kept. Never redirected.
• Secret: the poll token and the app password are never written to a file or a log, never shown by Debug, and go to that origin only. The window keeps the app password in the keyring (secret), as every account’s password.
• Given back (revoke): an app password not used after all (Cancel pressed after it came) is deleted on the server (DELETE /ocs/v2.php/core/apppassword, Nextcloud’s own way).

Murena’s server is MURENA: its sign-in answers there itself (16 October 2026: the page and the poll address on https://murena.io, without index.php). Any other Nextcloud by its address.

Structs

Answered 🔒

Begun 🔒

Flow

A sign-in under way: the page to open, and where to ask for its result. Its token and the page’s address are secrets: no Debug shows them.

Grant

What the sign-in gave: the server, as it named itself (on the origin chosen), the login name, and the app password. No Debug shows the password.

Poll 🔒

Enums

Refusal

Why a sign-in did not go, for the window’s words, each with the server’s name.

Constants

ANSWER 🔒

An answer is never read past this.

EVERY

How often the poll address is asked while you sign in.

FAILURES 🔒

Polls in a row that may fail (the network down a moment, the server busy) before the sign-in says so: half a minute at EVERY.

LIMIT

How long a sign-in may take: the server forgets it after twenty minutes.

MURENA

Murena’s Nextcloud (the cloud of /e/OS).

Functions

address_of

The server’s address as typed, made whole: cloud.example.org → https://cloud.example.org; https://cloud.example.org/nextcloud/ → https://cloud.example.org/nextcloud; the server’s own pages after it (/index.php/…, /login…, /apps/files/…) left out. A plain http:// is refused: the app password would travel unencrypted.

agent 🔒

The agent for the sign-in’s requests: never redirected, each bounded.

begin

A sign-in begun on base (address_of’s), Sioul saying it is client there (“Sioul (Android)”): the page to open, and where to ask. Its page and poll address both on base’s origin, over HTTPS, or it is refused.

forget

The app password kept for that login and server, forgotten here.

homes

Where the contacts and calendars are on the grant’s server, found there alone, with its app password (dav::discover_on).

keep

The grant’s app password kept in the keyring (keyring_name), replacing one kept there before for that login and server. Never in a file.

kept

The app password kept for that login and server, from the keyring.

keyring_name

The keyring’s name for a sign-in’s app password, kept for the sharing (remote::State::user): “Nextcloud app password: jane on murena.io”, under the service sioul as every secret of Sioul’s (secret).

on 🔒

Whether an address is on origin, over HTTPS (a test’s own stand-in apart: dav::allowed).

opens

Whether the app password opens the account under login there (one account’s login may differ from the sign-in’s own: its address rather than its name): a principal asked of its server, on its origin alone.

poll

Asks once whether the sign-in is done: none while it is not (the server answers 404 until you granted access); the grant when it is, its server on the origin chosen (another is refused: nothing is kept). The server answers it once only.

read 🔒

A request’s body, read up to ANSWER, zeroed once dropped (it may hold a secret).

refused 🔒

revoke

An app password given back: deleted on its server, which made it (Cancel pressed once it came, or a grant refused). Already gone there: done.

secret

A secret held in memory from text.

wait

Asks every every until the sign-in is done, stop is set (Cancel), or limit went by. The network down a moment is asked again; for half a minute in a row, it is said.

Type Aliases

Secret

A secret held in memory (a sign-in’s page, an app password): zeroed when dropped.