Users and roles
Login, five roles, capabilities, user CRUD, sessions, and rate limits.
6 min read
Sign in at /login with email and password. Success sets an HMAC-SHA256 cookie jf_session (14-day TTL). POST /api/auth/login is rate-limited (20 / IP / 15 min and 10 / email / 15 min) and skips CSRF. POST /api/auth/logout ends the session. Actions: auth.login, auth.logout, auth.loginFailed.
Roles
| Role | Capabilities (summary) |
|---|---|
| administrator | All capabilities including plugins, themes, settings, updates, site:admin |
| editor | Full content + media + comments:moderate + users:read |
| author | content:read|create|update, media:read|upload |
| contributor | content:read, content:create |
| subscriber | content:read |
Stable capability names live in @justflows/sdk (USER_CAPABILITIES, ROLE_CAPABILITIES, roleHasCapability). Check capabilities in extension code; many Express routes still gate on role names (requireRole).
User admin
Admin → Users. GET /api/users (administrator or editor). POST / PATCH / DELETE are administrator-only. CLI: justflows user create (interactive).
Passwords are PBKDF2-SHA256, 310,000 iterations, stored as $pbkdf2$….