From 85c5a8381c8a1fda936f20d1c467ba0afae81620 Mon Sep 17 00:00:00 2001 From: Jonas Miederer Date: Sat, 12 Sep 2026 08:39:23 +0200 Subject: [PATCH] docs: plan note for Mantine design pass --- PLAN_NEXT.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/PLAN_NEXT.md b/PLAN_NEXT.md index c80d058..86024d1 100644 --- a/PLAN_NEXT.md +++ b/PLAN_NEXT.md @@ -114,7 +114,9 @@ localStorage manager + toggle + inline `ColorSchemeScript` equivalent. RJSF swap was import-only; SSR smoke test proved all 10 intake labels + textarea/password/checkbox/slider widgets render. `npm run build` green. -## 1. Locked decisions (do not re-ask)* Auth: SMTP magic-link, 15-min single-use tokens (`secrets.token_urlsafe`, +## 1. Locked decisions (do not re-ask) + +* Auth: SMTP magic-link, 15-min single-use tokens (`secrets.token_urlsafe`, store `sha256`, `used_at` set before session creation), session = opaque id in **DB table**, cookie `HttpOnly; Secure; SameSite=Lax; Path=/`. SMTP creds already in `.env` (`SMTP_HOST/PORT/USERNAME/PASSWORD`,