mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: missing brace in users.js, ws double-increment, b64url stack overflow, docs storage

Browse Source
This commit is contained in:
Mike Teehan
2026-07-28 13:17:12 +00:00
parent ca27ea5522
commit f77473c13c
5 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+3 -3
View File
@@ -62,12 +62,12 @@ The `lib/` modules auto-discover the project root at runtime via `Path(__file__)
## JWT Token Model
Vacuum Wall uses JWT-based authentication with access/refresh token rotation. Tokens are stored in browser `localStorage` and injected as `Authorization: Bearer <token>` headers. The API never reads cookies — authentication is header-only.
Vacuum Wall uses JWT-based authentication with access/refresh token rotation. Tokens are stored in browser `sessionStorage` and injected as `Authorization: Bearer <token>` headers. The API never reads cookies — authentication is header-only.
| Token | Lifetime | Storage | Purpose |
|---|---|---|---|
| Access | 15 min | localStorage | API auth, permission checks |
| Refresh | 7 days | localStorage | Token rotation, new access tokens |
| Access | 15 min | sessionStorage / memory | API auth, permission checks |
| Refresh | 7 days | sessionStorage | Token rotation, new access tokens |
JWT payload contains `sub` (username), `exp` (expiry), `iat` (issued at), `jti` (unique identifier), `type` (`"access"` or `"refresh"`), `permissions` (per-subsystem permissions), and `session_id` (session binding). Access tokens additionally contain `permissions` and `session_id`.