docs: restructure server and web documentation into ADR files and a

routing table
2026-07-17 22:07:55 +08:00
parent f8494a44ca
commit 519aa35f1f
23 changed files with 710 additions and 654 deletions
@@ -0,0 +1,24 @@
+# ADR-0003: Define Authentication Contracts
+
+Status: Accepted  
+Date: 2026-04-29
+
+## Context
+
+Authentication requires distinct access and refresh behavior, stable duration parsing, and safe development defaults.
+
+## Decision
+
+- Use `AuthHandler` for public authentication routes and `AccountHandler` for authenticated account routes.
+- Add a JWT `type` claim that distinguishes access and refresh tokens.
+- Verify token type at the boundary that consumes the token.
+- Store configuration durations as `time.Duration` values.
+- Replace known development JWT placeholders with a random runtime secret during configuration loading.
+
+## Consequences
+
+- Access tokens authenticate protected requests.
+- Refresh tokens rotate token pairs through database sessions.
+- Invalid duration values fail during startup.
+- Tokens signed with the generated development secret expire when the process restarts.
+- Multi-instance deployments require a stable configured secret.