Auth Patterns — Sample SemText Document

Demonstrates the v0.4 class-based vocabulary: inline CSS + Tailwind refinement + vanilla fallback handler. Open this file directly in any browser.

Auth Guide

Answer questions about the sample auth facts in this document.

Cite sem-fact ids. Prefer conclusions verbatim.

JWTs must rotate per session, not per request.

Shuffle flashcards before each review session for better recall.

Facts — flashcards

JWTs rotate per session

Short-lived access tokens; the refresh grant issues a new pair.

OAuth device flow targets input-constrained devices

TVs, consoles, CLI tools — poll the token endpoint with the device code.

Long-lived tokens are an anti-pattern

Scope capabilities tightly instead of extending lifetime.

Store tokens in localStorage for durability.

Facts — list (default view)

Refresh tokens rotate per use

Each exchange retires the presented token.

Scope tightly instead of extending lifetime

Long-lived tokens are an anti-pattern.

Facts — quiz

The OIDC token travels in which header?

Authorization

X-Auth-Token

PKCE protects which flow?

Authorization code flow

Client credentials flow

Details — highlight occlusion

The OIDC token travels in the Authorization header, and refresh tokens should never reach the browser.

Details — plain reading

Plain view keeps highlights readable inline — no occlusion without data-view-as="quiz".

Procedure — status runbook

provision Infisical path

port-forward MinIO

run migrations

cut release — waiting on CI

Properties — config block

15m

per use

httpOnly cookie

15m

14m

Views — same deploy, two perspectives

Chart from the noizu-infra repo; values live in .infra-config.yaml.

ArgoCD auto-syncs from the product remote's main; CI bumps the image tag.

Reveal — Q→A disclosure

Tokens in localStorage are readable by any script on the page — one XSS away from session theft. Prefer httpOnly cookies or memory-scoped storage.

Refresh tokens rotate per use — each exchange retires the presented token.