# Security

## Authentication

### Device Tokens
- Format: `dev_` + 48 random bytes, base64url-encoded
- Stored as SHA-256 hash in database
- Raw token returned only once during registration
- Expire after 90 days
- Revocation immediately invalidates token

### Client Authentication
- Passwords hashed with bcrypt (10 rounds)
- JWT access tokens (24h expiration)
- Refresh tokens with rotation and revocation
- Tokens stored in HttpOnly cookies on dashboard

## Authorization

### Role-Based Access
- `admin`: Full access including device management and revocation
- `viewer`: Read-only access to tabs, devices, and commands

### Venue Isolation
- Every user and device is scoped to exactly one venue
- All service methods validate venue context from authentication
- Cross-venue access is blocked at the service layer

## API Security

### Headers
- Helmet for security headers
- Strict CORS (dashboard origin only)
- Body size limits enforced

### Rate Limiting
- Device sync: 1 request per 30 seconds per device
- Command creation: 10 requests per minute per user
- General: 100 requests per minute per client

### Error Handling
- Consistent error format never exposes internals
- No secrets in error messages
- No stack traces in production

## Audit Trail

All sensitive operations are logged:
- Command creation, acknowledgement, expiration
- Device registration and revocation
- Snapshot conflicts
- No sensitive data (passwords, tokens) in audit logs