---
type: entity
tags: [parking, stack, auth, offline-first]
sources: [parking-system-architecture]
updated: 2026-06-14
---

# Local JWT Auth

Authentication and authorization, kept **fully local** — a direct consequence of
[[offline-first]] (an air-gapped park cannot reach an external identity provider; see
[[logto-zitadel-oidc]] for the rejected alternative). (See [[parking-system-architecture]] §2.)

- `@fastify/jwt` signs tokens with a **local secret**.
- A `users` table in [[sqlite]] holds **bcrypt** password hashes plus a **role** column.
- Authorization = a simple `preHandler` role guard per route: **admin / operator / cashier /
  readonly**. No Casbin or full RBAC engine needed at this scale.

Part of the [[technology-stack]]. License: MIT.