From 56a3dca1874fba17c3d174be451af9478b3bfb9d Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: dashboard: a token handed over to another member's dashboard Opening another member's dashboard passes a token reading only, for five minutes, in the URL's fragment; its login page begins a session with it. Tokens may be asked for with a shorter lifetime. Auth plan M3 (hand-off). --- docs/access.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 44c89f3..1ee9994 100644 --- a/docs/access.md +++ b/docs/access.md @@ -99,7 +99,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store a capability granted or revoked counts on a node as soon as the change reaches it. * **How long**: `--token-lifetime` (12 hours), refreshed (`POST /auth/refresh`, on any node, which signs the new one) until `--session-lifetime` (7 days) after the login; - then the user logs in again. A refreshed token may say less (`limit`), never more. + then the user logs in again. A refreshed token may say less (`limit`), never more, + and live less (`lifetime`, in seconds): a dashboard opening another member's hands it + one reading only, for five minutes ([`dashboard.md`](dashboard.md)). * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/`: tokens issued -- cgit v1.3.1