Identity

Auth & RBAC

Web sessions stay on Supabase/demo cookies. Driver devices get 15-minute access tokens and sliding refresh with reuse detection.

RoleMaps fromCan
ridercustomerRequest trips, pay holds, SOS, chat
driverdriverPing GPS, transition, inspect, unlock, cash-out
hostownerFleet, inspect, cash-out
staffstaffDispatch, trust review, SOS desk
adminadminEverything, including in_progress cancel

POST/api/v1/auth/tokenExchange a web session for driver JWTs.

backend/shared/authz/tokens.ts
ACCESS_TTL_SECONDS = 15 * 60
REFRESH_TTL_SECONDS = 30 days, slides in the last 7
Reuse of a revoked refresh token revokes the whole family.

Web signup now requires confirm-password, terms, NIST 800-63B passwords, and a hashed 48-hour verify token. Forgot/reset is a one-hour hashed token. Demo mail is /admin/mail. Production: RESEND_API_KEY. Full walkthrough: /docs/accounts.