test: verify account persistence and all template profiles

2026-10-02 08:47:33 +08:00
parent 141849d682
commit f7c890c551
2 changed files with 17 additions and 1 deletions
@@ -88,7 +88,8 @@ until the owner explicitly authorizes it.** Test design: [REAL_DEVICE_TEST.md](d

 ## Security

-All protected /api/v1 capabilities use Frame Flow Bearer auth and scope checks.
+Protected /api/v1 capabilities accept an administrator account session, or external
+Frame Flow Bearer auth with scope checks.
 SQLite stores token hashes. Device keys live only in env/secret and runtime memory.
 Browser login uses SQLite accounts with salted scrypt password hashes and revocable,
 HttpOnly/SameSite=Strict cookies (30 days when remembered, 12 hours otherwise).