Using Auth Core Directly

The only app that directly depends upon Auth Core is Group Control. All other apps, which use Group Control as a dependency technically still use Auth Core, because authentication and roles are important in every app, but they only use these authentication features through the Group Control API, which is layered on top of Auth Core. That being said, the developer for Group Control, will need to know some of how Auth Core itself works if he will be making changes to those parts of the code which use Auth Core.

Auth Core Itself

The code for Auth Core is extremely simple, and essentially makes the Aura Session system work as an FW Addon with very minimal changes. The documentation for Aura.Session can be found here, though unfortunately, Auth Core currently uses Aura.Session 2.1.0, and the documentation is only written for Aura.Session 4.x, so some things may be slightly different. The only thing that Auth Core itself adds to Aura.Session is the Class SessionSingleton, which is the only class actually used in Group Control (extended by the Utils of CurrentUser and Settings), and this class essentially is an instance of the Session class, so that most of the code needed to set up an instance Aura.Session can be done by Auth Core without needing to be done by the developer in the app itself.

Even most of Group Control, when it is interacting with Auth Core, only interacts with Auth Core through one of these two Utils, so most likely the only place you will be directly interacting with Auth Core directly is in these two Utils. And when this happens, hopefully between looking at comments and the documentation provided for Aura.Session, you will be able to figure it out. Because this functionality breaks very infrequently (in my seven years at Informatics, I never used Auth Core directly, even as the developer for GC for a few years), if it does break, these tools will help you to have an idea of how to figure it out, but it probably should not be documented extensively.