jobtrackingapp/docs/security/authentication.md

Authentication

Local email/password accounts issue signed local JWTs and can use an HttpOnly jobtracker_auth session cookie. Google and Microsoft identity sign-in are optional and configured separately from Gmail/Graph mail access. Registration is disabled by default; email verification, Turnstile, and production auth requirements are configuration gates.

Password reset and verification use SMTP. TOTP two-factor authentication includes encrypted secrets, recovery codes, trusted devices, and pending-token flow. JWT issuer, audience, key, lifetime, and external client IDs are documented in environment variables.