Nommo

It is said that in the first age of Earth, the Nommo descended from the stars into the sea.

It is said that the Nommo came to impart unto man his first wisdom:

that in order to truly live, one must do more than survive; he must know.

Nommo

Identity

Auth & RBAC

Web sessions stay on Supabase/demo cookies. Driver devices get 15-minute access tokens and sliding refresh with reuse detection.

RoleMaps fromCan
ridercustomerRequest trips, pay holds, SOS, chat
driverdriverPing GPS, transition, inspect, unlock, cash-out
hostownerFleet, inspect, cash-out
staffstaffDispatch, trust review, SOS desk
adminadminEverything, including in_progress cancel

POST/api/v1/auth/tokenExchange a web session for driver JWTs.

backend/shared/authz/tokens.ts
ACCESS_TTL_SECONDS = 15 * 60
REFRESH_TTL_SECONDS = 30 days, slides in the last 7
Reuse of a revoked refresh token revokes the whole family.

Web signup now requires confirm-password, terms, NIST 800-63B passwords, and a hashed 48-hour verify token. Forgot/reset is a one-hour hashed token. Demo mail is /admin/mail. Production: RESEND_API_KEY. Full walkthrough: /docs/accounts.