diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 750484a..c7356c0 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -4085,7 +4085,12 @@ narrow bridge — and Android has all three: which Android stretches under Doze. The secret is the only credential the background holds and it reads notification lines and nothing else — not a session, so nothing renewing in the background can collide with the page's - rotating refresh token, and a sign-out, which deletes the row, ends it. **When + rotating refresh token. It is a credential of its own, so whatever ends the + account's sessions ends it too: turning it off, signing out everywhere (what + someone who lost a phone presses), a passphrase change or reset, a revocation + and an erasure all delete the row, and a revoked or deleted account's poll is + refused regardless. A suspended one still reads, the line saying so being one + of its notifications. **When a UnifiedPush distributor is already installed** (ntfy, or an application carrying one), the row also gets its endpoint and P-256 key and each notification is sent there at once as one RFC 8291 record, so the push server |