28 lines
1.1 KiB
Markdown
28 lines
1.1 KiB
Markdown
# VK Authentication Model & Token Security
|
|
|
|
This document outlines the authentication context lifecycle and security rules for VK tokens in **Randomayzer**.
|
|
|
|
---
|
|
|
|
## Token Types Supported
|
|
|
|
1. **Service Token (`SERVICE`)**:
|
|
- Used for public API read operations (`wall.getById`, `likes.getList`, `wall.getComments`, `groups.isMember`).
|
|
- Configured via environment variable `VK_SERVICE_TOKEN`.
|
|
- Never exposed to frontend clients.
|
|
|
|
2. **User Token (`USER`)**:
|
|
- Authorized via VK ID / OAuth with specific scopes (`wall`, `offline`, `groups`).
|
|
- Used when accessing non-public walls or private community groups with admin access.
|
|
|
|
3. **Community Token (`COMMUNITY`)**:
|
|
- Scoped to a specific community (`communityId`).
|
|
- Used for managing giveaways directly on behalf of a VK public page or group.
|
|
|
|
---
|
|
|
|
## Invariant Security Rules
|
|
|
|
- **Zero Logging**: Tokens are never passed to `console.log`, error messages, or telemetry.
|
|
- **Redaction Helper**: `redactToken(token)` masks tokens as `vk1.a...1234`.
|
|
- **Database & Audit Isolation**: Access tokens are **never** persisted to PostgreSQL or included in cryptographic AuditProof / DrawResult hashes.
|