Authentication & Security

Login

JWT-based authentication delivered via an HTTP-only cookie — never exposed to client-side JavaScript.

Password recovery (OTP-verified)

A 3-step, OTP-verified reset flow, stronger than a simple “email me a link”:

1. The staff member submits their email and mobile number — both must match the same account before anything happens.
2. On a match, a one-time code is emailed and every owner account is alerted immediately (visible even if the reset is never completed).
3. The code is verified, and only then is a short-lived reset token issued — safe to hand back at that point, since the caller has proven inbox possession, not just knowledge of an email address.

The same generic response is returned at step 1 regardless of whether the email/mobile combination matched, so the endpoint can’t be used to enumerate valid staff accounts.

Self-service password change

The Security tab on a staff member’s own profile page supports changing your own password:

1. Enter your current password and click Verify — this checks the password on its own, without changing anything yet.
2. Only once verified do the New Password / Confirm New Password fields unlock.
3. Submitting independently re-verifies the current password server-side before committing the change — the earlier “verify” step is never trusted on its own to authorize the change.

Owners receive the same automated security-alert email pattern used for other account-security events (invite-accept, OTP-verify, password reset).

Role-based access control (RBAC)

Permissions are enforced at the backend (@PreAuthorize) and mirrored at the frontend (route guards) — see Security for the full permission model, ownership checks, and role-escalation guards.