auth-phone

Add phone OTP and phone-password authentication.

auth-phone provides phone-number login while keeping users and sessions in auth. It depends on both auth and auth-password.

lenso module install auth
lenso module install auth-password
lenso module install auth-phone
cargo run --bin migrate
lenso serve

It contributes four routes:

• POST /v1/auth/phone/otp/start
• POST /v1/auth/phone/otp/verify
• POST /v1/auth/phone/password/set
• POST /v1/auth/phone/password/login

OTP length, expiry, resend cooldown, attempt limits, and per-IP start limits are editable under the auth-phone.otp runtime config group. Outside local development, provide the OTP secret through module-local Host config:

LENSO_MODULE_AUTH_PHONE__OTP_SECRET=<secret>

Without that secret, OTP start and verification fail closed outside local development. Delivering the generated code through SMS remains the installing application’s responsibility.