Engineering
Auth & security boundaries
High-level auth model across docs, shopper API, and iOS — no secrets
Auth & security boundaries
High-level only. Never paste credentials, private keys, or production tokens into this handbook.
Three separate stories
| Surface | Auth model |
|---|---|
| Internal docs | Email/password cookie gate (DOCS_AUTH_*, cookie efacts_docs_session) |
| Shopper API | JWT access tokens; refresh rotation; optional Google id_token verify |
| iOS client | Stores tokens in Keychain; unauthenticated → AuthPortalView |
Docs auth is not shopper SSO and not enterprise IdP (unless added later).
Shopper auth (conceptual)
| Step | Behavior |
|---|---|
| Register / login | Backend issues access JWT |
| Client obtains Google credential → backend verifies → JWT | |
| Refresh | Dedicated refresh endpoint; rotate / revoke on logout |
| API calls | Authorization bearer access token |
Wallet bind (UCI / last4) is a sensitive server-validated flow — clients call APIs; they do not embed bind secrets.
Data handling rules
| Rule | Why |
|---|---|
| Least privilege | Clients get only what the screen needs |
| Zero-PAN mindset | Do not store or log full payment account numbers |
| Money as cents | Avoid float rounding / injection-by-confusion |
| No secrets in MDX / Design.md | Public-to-the-company ≠ public-to-the-internet forever |
Docs gate details
See Local setup and root README for cookie attributes and env vars. Strengthen production with Vercel Deployment Protection.