vibed/quotesdb/.nbd/tickets/03bb91.md

+++ title = "Implement 4-word passphrase auth_code generator (must work in WASM/workers-rs)" priority = 7 status = "todo" ticket_type = "task" dependencies = ["f3dc74", "1f5bb5", "6ed325"] +++

The `quotesdb` API is built with Axum + Tokio, targeting Cloudflare Workers via `workers-rs`. It serves JSON at `/api/*` endpoints and persists data to Cloudflare D1 (production) or a local SQLite file via Turso (development). Source lives in `src/bin/api/`.

Shared types and utilities are in src/lib.rs — code placed there must compile for both the host target and wasm32-unknown-unknown.

Auth codes are 4-word passphrases (e.g. ocean-table-purple-storm) assigned to quotes on creation. They are stored plaintext and used to authorise updates and deletes. The generator must compile and run in both the native host environment and the wasm32-unknown-unknown target (workers-rs).

Implement a `generate_auth_code() -> String` function in `src/lib.rs` that produces a random 4-word passphrase. Place it in shared lib code so both the API (generation) and UI (display) can reference the type. The chosen word list crate must support `no_std` or at minimum compile for `wasm32-unknown-unknown`. - Resolve TRIAGE ticket 6ed325 (passphrase crate selection) before choosing the dependency. - Must compile for both host (`cargo check`) and `wasm32` (`trunk build`). - Do not use `std::fs` or thread-based RNG in shared code — use a WASM-compatible RNG (e.g. `getrandom` with the `js` feature). Use `superpowers:test-driven-development` — write a unit test that generates 100 codes and verifies each matches `word-word-word-word` format. Use `superpowers:verification-before-completion` before closing. Run in order from the `quotesdb/` directory:

cargo fmt
cargo check
cargo clippy
cargo test

`feat(quotesdb): implement WASM-compatible 4-word passphrase auth_code generator`