Identity
Auth & RBAC
Web sessions stay on Supabase/demo cookies. Driver devices get 15-minute access tokens and sliding refresh with reuse detection.
| Role | Maps from | Can |
|---|---|---|
| rider | customer | Request trips, pay holds, SOS, chat |
| driver | driver | Ping GPS, transition, inspect, unlock, cash-out |
| host | owner | Fleet, inspect, cash-out |
| staff | staff | Dispatch, trust review, SOS desk |
| admin | admin | Everything, including in_progress cancel |
POST/api/v1/auth/tokenExchange a web session for driver JWTs.
ACCESS_TTL_SECONDS = 15 * 60
REFRESH_TTL_SECONDS = 30 days, slides in the last 7
Reuse of a revoked refresh token revokes the whole family.Web signup now requires confirm-password, terms, NIST 800-63B passwords, and a hashed 48-hour verify token. Forgot/reset is a one-hour hashed token. Demo mail is /admin/mail. Production: RESEND_API_KEY. Full walkthrough: /docs/accounts.