diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -794,7 +794,7 @@ here are kept only where they are a rule about *editing* the code. | Sign-in lockout | `meshbay_hub/login_throttle.py`, settings in `hub_settings.py` (`login.*`) | §7.7. **Every path that checks a passphrase calls `_take_login_attempt` first** — login, passphrase change, account deletion | | What answers without an account | `tests/test_unauthenticated_surface.py` — `PUBLIC` | §7.4. A new open route fails the suite until it is listed there with its reason | | Asset versioning | `meshbay_hub/api/webapp.py` — `_asset_version()` | the whole module graph is served under `/a/<hash>/`, and the hash covers **every file under `static/`**, subdirectories included — nothing to register | -| Token lifetimes | `meshbay_hub/config.py` — `[jwt]` | 4 h access, 30 days refresh. **Production sets both in `~/.config/meshbay/hub.toml`** — changing the code default alone does nothing there | +| Token lifetimes | access: `meshbay_hub/config.py` — `[jwt]`; session: `hub_settings.py` — `session.*` | 4 h access token, from `hub.toml`. **The session is an admin setting in the database** (browser idle sign-out, refresh idle, maximum; `static/idle.js` measures the first). A `refresh_token_ttl` still in `hub.toml` is ignored with a warning | ### Browser / desktop UI (`meshbay_hub/static/`) |