Auth and Permissions

epress node combines SIWE authentication, JWT audience scoping, and operation-level permission checks via request.cani(permission).

When to Use Which Auth

Different operations require different authentication mechanisms:

Node Owner Operations

SIWE + JWT (aud: client)

Publishing content
Managing settings
Following/unfollowing
Deleting content

Cross-Node Operations

EIP-712 in Body

Follow handshakes
Replication requests
Profile updates
Content verification

Public Content

No Auth Required

Reading public posts
Fetching profiles
Avatar retrieval
RSS feeds

SIWE Sign-In Flow

Client requests SIWE message through GraphQL query getSiweMessage.
Node issues nonce JWT encoded in SIWE nonce field.
Client signs SIWE message and submits to signInWithEthereum.
Server verifies SIWE signature, nonce JWT, and owner address before issuing JWT token.

JWT Audience Model

aud	Intent	Verification
client	Owner session token	DB token verification + owner address check
integration	Scoped integration token	DB token verification + scope check
nonce	SIWE challenge nonce	Signature and expiration verification
comment	Email comment confirm token	Signature and expiration verification

Permission Checks

Route and GraphQL resolvers call request.cani(permission). For client audience it returns full access; for integration audience it validates requested permission against JWT scope.

Publication creation requires create permission and valid owner identity.
Search and fetch permissions gate visibility of non-public or non-owned data.
Sensitive settings fields are conditionally exposed by auth context.

EIP-712 Signature Verification

Cross-node operations use EIP-712 typed data signatures embedded in the request body:

Extract typedData and signature from request body
Verify domain matches Epress domain spec
Recover signer address from signature
Verify signer matches claimed address in message
Check timestamp is recent (typically within 5 minutes)

See EIP-712 Signing Spec for complete type definitions.