Remember Frame Flow login with expiry, opt-out and invalid-token cleanup

2026-10-02 02:23:24 +08:00
parent ac541260f0
commit 186b56c495
4 changed files with 20 additions and 9 deletions
@@ -90,6 +90,8 @@ until the owner explicitly authorizes it.** Test design: [REAL_DEVICE_TEST.md](d

 All protected /api/v1 capabilities use Frame Flow Bearer auth and scope checks.
 SQLite stores token hashes. Device keys live only in env/secret and runtime memory.
+The optional 30-day Remember login stores only the Frame Flow Token in this browser
+localStorage. Disconnect, expiry or HTTP 401 clears it; shared browsers should opt out.
 Cloud original-image endpoint embeds a key upstream; backend proxies it with no
 redirects and no access/transport logging. Key never enters browser URLs or DB.
 Request validation and exceptions use sanitized standard errors. Strong tokens,