Architecture: How should Platform Elements handle authentication for stand...

Documentation for Sessions

🏗️ Architecture: How should Platform Elements handle authentication for stand...

Date: 2026-03-25
Time: 12:08:58 UTC
Session: gspace1-268.8
Agent: storage
Confidence: 93%
Status: ✅ Documented

📋 Decision Context

Question:

How should Platform Elements handle authentication for standalone deployed platforms?

Task: S268.2: Platform Elements Phase 1 — Auth system implementation

🎯 Decision Made

Chosen:

AuthManager class with localStorage persistence (pe:auth key), instant restore on page load, automatic token refresh scheduling, and onAuthChange callback system. Wired into platform-app via auth='jwt' attribute. DataClient gets automatic 401 → refresh → retry via onUnauthorized handler.

Options Considered:

  1. httpOnly cookies (requires backend changes, more secure but slower to implement)
  2. Session-based auth (stateful, doesn't match JWT API)
  3. OAuth2 flow (overcomplicated for generated CRUD platforms)
  4. No auth in Platform Elements, require Angular export for auth (rejected — platforms are standalone)

💭 Reasoning

Generated platforms deploy as standalone apps at subdomains (e.g., restaurant.gograb.space). There is no parent app providing auth context. The platform must manage its own JWT lifecycle. Auth endpoints are at /api/platform/:universeSlug/auth/login (verified against PlatformUsersController). localStorage was chosen over httpOnly cookies for MVP because: (1) no backend changes required, (2) instant restore on page load (<1ms, same pattern as theme system flash-persistence), (3) cross-tab visibility. Security tradeoff acknowledged: localStorage is XSS-vulnerable. Migration to httpOnly cookies planned for Phase 4 production hardening. The DataClient's fetchWithAuth method retries exactly once on 401 to prevent infinite loops. AuthManager publishes state changes via callback system (not EventBus) for simplicity — elements that need auth state subscribe directly.

📁 Files Involved

🔗 Related

Auto-generated by MCP Smart Consolidation