Auth
saved · changeset #42
Purpose
Establishes user and device identity for every downstream service.
Design
The web app uses @artifact:thermostat-api as its auth boundary. End users sign in with email + one-time code; devices authenticate with a per-device token minted at pairing time.
Sessions are short-lived JWTs backed by a rotating refresh token stored httpOnly. Firmware tokens are long-lived but revocable from the owner's dashboard.
Downstream services (device gateway, telemetry ingest) trust the JWT and consult a shared JWKS endpoint for verification.
Interfaces
POST /auth/request-code · POST /auth/verify · POST /auth/refresh · GET /.well-known/jwks.json
Requirements
Risks / open questions
Refresh reuse detection needs a clean revocation UX for shared households.
Build
Build: not started