<commit_before>Cyclid
======

Test data
---------
The test user is configured with the following attributes:
<commit_msg>Document authentication<commit_after>Cyclid
======
# Authentication
There are three authentication schemes currently supported:

1. HTTP Basic
2. HMAC request signing
3. API token

## HTTP Basic

HTTP Basic is self explanitory and works with any standard HTTP client (E.g. curl).

## HMAC

The HMAC scheme uses a shared secret (The `User.secret` data) to generate an HMAC from the request, with an optional nonce. The header format is:

```
Authorization: HMAC [user]:[hmac]
X-HMAC-Nonce: [nonce]
```

An HMAC capable client is implemented in `test/hmac-test.rb`

## API Token

The API token based scheme is wildly insecure as it is but might be extended in the future for use by simple non-sensitive clients which can't support HMAC signing (E.g. scripts which call `curl` or `wget`). The header format is:

```
Authorization: Token [user]:[token]
```
Currently, the 'token' is just the `User.secret` data sent in plain text (hence why it is wildely insecure!)

# Test data

## Test User

The test user is configured with the following attributes:

{'fraction_non_alphanumeric': 0.09487179487179487, 'fraction_numerical': 0.002564102564102564, 'mean_word_length': 4.371559633027523, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3327614', 'n_tokens_mistral': 341, 'n_tokens_neox': 326, 'n_words': 163}