@palbase/backend 38.0.1 → 38.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/auth.md +8 -0
- package/docs/llms-full.txt +8 -0
- package/package.json +1 -1
package/docs/auth.md
CHANGED
|
@@ -56,6 +56,14 @@ mid-session keeps reporting `false` until their next token. `roles` is the
|
|
|
56
56
|
exception, and deliberately so — it is read from the table on every request, so
|
|
57
57
|
a grant or a revocation lands immediately.
|
|
58
58
|
|
|
59
|
+
**"Their next token" arrives on its own.** A refresh re-reads the row when it
|
|
60
|
+
mints, so the rotated token carries the verification that just happened — and
|
|
61
|
+
the client SDKs spend that refresh for you: they rotate when `refreshUser()`
|
|
62
|
+
sees the flag flip, and a `403 email_not_verified` earns one renew-and-replay
|
|
63
|
+
the way a 401 does. Nobody has to sign out and back in. If you are holding a
|
|
64
|
+
token yourself — a server-to-server caller, a script — call `POST /auth/refresh`
|
|
65
|
+
and use what comes back.
|
|
66
|
+
|
|
59
67
|
## Roles and permissions
|
|
60
68
|
|
|
61
69
|
Roles are **yours**. There is no built-in "admin": you declare the roles your
|
package/docs/llms-full.txt
CHANGED
|
@@ -832,6 +832,14 @@ mid-session keeps reporting `false` until their next token. `roles` is the
|
|
|
832
832
|
exception, and deliberately so — it is read from the table on every request, so
|
|
833
833
|
a grant or a revocation lands immediately.
|
|
834
834
|
|
|
835
|
+
**"Their next token" arrives on its own.** A refresh re-reads the row when it
|
|
836
|
+
mints, so the rotated token carries the verification that just happened — and
|
|
837
|
+
the client SDKs spend that refresh for you: they rotate when `refreshUser()`
|
|
838
|
+
sees the flag flip, and a `403 email_not_verified` earns one renew-and-replay
|
|
839
|
+
the way a 401 does. Nobody has to sign out and back in. If you are holding a
|
|
840
|
+
token yourself — a server-to-server caller, a script — call `POST /auth/refresh`
|
|
841
|
+
and use what comes back.
|
|
842
|
+
|
|
835
843
|
## Roles and permissions
|
|
836
844
|
|
|
837
845
|
Roles are **yours**. There is no built-in "admin": you declare the roles your
|
package/package.json
CHANGED