- Shipped
- July 15, 2026 at 7:06 PM UTC
- Author
- Kamo
- Commit
- 0c6a8c4
- DeviceAuthController: durable device credential per (user, device) with rotate-on-exchange + 60s grace; /device/exchange mints a per-org *** via PostAuth***Service (same waterfall/labels/timeouts as login) and returns registry per (device, org). - PostAuth***Service: optional mobile session-timeout floor **************** default 720). - StreamTokenController: mints path-bound HMAC ?st= tokens (10 min) so media players can Range-request recordings without per-request OTKs. - **************** now honors X-***-Token first, giving **************** header parity for cookie-less clients.