Signed tokens of a person, for the JSON API (Chime.API) where the
app's own session or token does not reach: an EventSource cannot send
an authorization header, and a page on another origin has no cookie
of the app's.
# in a controller of the app, for its signed-in user
json(conn, %{token: Chime.Token.sign("user:#{user.id}")})The frontend gives it to the API as Bearer <token>, or as ?token=
to /stream. POST /token of the API makes one for the person of the
request, too. A token is a Phoenix.Token, signed with the config's
:secret_key_base and a salt of Chime's own, valid for a day (:max_age
of verify/2). Make one on the server, for the person the page is for,
never from an id the browser sends.
The links to unsubscribe of the emails are tokens too, of another salt, that do not expire.
Summary
Functions
A token of a person, by their id.
The person of a token of sign/1: {:ok, id}, {:error, :expired}
past :max_age seconds (86400), or {:error, :invalid}.