Message Lifecycle and Security

Message Lifecycle and Security

Urgency

• passive: useful information without an attention request
• attention: needs timely awareness
• critical: highest urgency and explicit acknowledgement use cases

Retention

• ephemeral: toast only; not retained
• archive: retained as history
• untilViewed: attention clears after the inbox is displayed
• untilAcknowledged: attention remains until explicitly marked read

Messages are newest first. A stable source plus id updates the same event; different sources may safely use the same ID. expires is an absolute Unix timestamp in milliseconds. Expired messages are removed during the periodic sweep and attention turns off when no unread messages remain.

Security checklist

• Keep the webhook on 127.0.0.1 unless LAN access is required.
• Use a strong bearer token for LAN webhooks.
• Never expose the webhook directly to the internet.
• Keep MQTT credentials in private MagicMirror configuration.
• Keep the Unix socket at 0o600 unless another trusted account needs access.
• Leave private image hosts and HTTP disabled unless a trusted camera network requires them.
• Never commit tokens, credentials, LAN addresses, or private payloads.