Context
SessionStoragePort is synchronous because localStorage is, and it stores one non
sensitive flag (whether the user has signed in before). A native client needs something
different on both counts: every native keystore is async, and a native client holds real
secrets, since there is no cookie jar to keep them out of reach.
Scope
- Define an async token storage port with
get, set, and remove.
- Provide a keystore backed implementation (
expo-secure-store) and an in memory
fallback, since the browser and server rendering paths still need somewhere to go.
- Implementations must not throw. A locked or unavailable keystore is a degraded session,
not a failed auth flow.
Notes
Only what outlives the process should be persisted. The ephemeral continuation token is
for a login already in flight, so writing it to the keystore widens its exposure without
making any flow resumable.
Relates to #64.
Context
SessionStoragePortis synchronous becauselocalStorageis, and it stores one nonsensitive flag (whether the user has signed in before). A native client needs something
different on both counts: every native keystore is async, and a native client holds real
secrets, since there is no cookie jar to keep them out of reach.
Scope
get,set, andremove.expo-secure-store) and an in memoryfallback, since the browser and server rendering paths still need somewhere to go.
not a failed auth flow.
Notes
Only what outlives the process should be persisted. The ephemeral continuation token is
for a login already in flight, so writing it to the keystore widens its exposure without
making any flow resumable.
Relates to #64.