Autentikasi & Otorisasi
- Email + password (web, via proxy
/api/staff) - Phone + OTP code (mobile; kode =
process.env.KLOLA_OTP_CODE ?? "000000")
Session memakai Bearer token + refresh token dan bersifat device-bound:
header X-Device-Id + X-Platform + X-App-Version wajib untuk admin routes.
Role capability matrix
Section titled “Role capability matrix”Didefinisikan di packages/klola-authorization:
| Role | Capability |
|---|---|
owner |
Semua capability (termasuk accounting:write) |
manager |
Sebagian besar (tanpa cash_shift:write di beberapa area) |
kasir |
POS, inventory read, cash shift |
staff_daycare |
Pet care operations |
Module entitlement
Section titled “Module entitlement”infra/auth/module-authorization.ts meng-map capability ke modul bisnis
(core, catalog, orders, payments, inventory, vertical:bakery,
vertical:laundry). Request ditolak bila modul tidak aktif untuk bisnis
tersebut.
Rate limiting
Section titled “Rate limiting”- Login rate-limited (
isLoginRateLimited+recordLoginFailure) - OTP cooldown 30 detik
- Password recovery 3 attempt per jam per email