Shared kiosk sessions: app kiosk registry, kiosk login, verify support, admin password

apps gain kiosk_path/kiosk_caps (hvac registered first). One shared kiosk
password mints a long-lived hnf_kiosk_session carrying only each registered
app's kiosk caps; /verify answers for kiosk sessions; changing the password
bumps an epoch that invalidates signed-in tablets.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
jtricerolph 2026-10-15 11:15:46 +00:00
parent 107eaa7e35
commit 3052113d31
7 changed files with 181 additions and 1 deletions

View file

@ -6,6 +6,7 @@ import { authRoutes } from './routes/auth.js'
import { adminRoutes } from './routes/admin.js'
import { internalRoutes } from './routes/internal.js'
import { registerRoutes } from './routes/register.js'
import { kioskRoutes } from './routes/kiosk.js'
import { startSyncJob } from './sync.js'
const app = Fastify({ logger: true, trustProxy: true })
@ -20,6 +21,7 @@ app.get('/health', async () => ({ status: 'healthy' }))
await app.register(authRoutes, { prefix: '/api/auth' })
await app.register(registerRoutes, { prefix: '/api/auth' })
await app.register(kioskRoutes, { prefix: '/api/auth/kiosk' })
await app.register(adminRoutes, { prefix: '/api/auth/admin' })
await app.register(internalRoutes, { prefix: '/api/auth/internal' })