Dattavani Backend: Auth and Identity (parent sign-in, PIN, kid session) Diagram

Parent token: a Supabase Auth JWT pair. services/auth.py verifies it locally with the HS256 secret or JWKS.
Kid token: an HS256 JWT minted by core-service with [redacted], typ kid_profile, 12 hours by default (KID_JWT_TTL_HOURS).
The kid token has no refresh token. POST /api/kids/refresh-token mints a new one.
Production startup fails without [redacted] or [redacted] (config.py:186-201).

The kid token carries no Supabase token. Kid routes read the parent's newest active device_sessions row.
They use that token if it is a valid access JWT, or refresh it through Supabase Auth, then query under the parent's RLS.
Login stores the refresh token. select-profile overwrites it with the parent's access token (1 hour in the local Supabase config).
The next parent token refresh puts a refresh token back. If nothing works, kid routes return 401 and the app must log in and select the profile again.

4 digits, stored as PBKDF2-SHA512 with 390,000 iterations over an HMAC-SHA512 pre-hash with [redacted].
Old pbkdf2_sha256 hashes are rejected, so those parents must set the PIN again.
Forgot PIN: OTP, then a one-time HS256 reset token valid for 10 minutes, then reset.

/api/auth/pin/verify has no attempt limit in core-service, and a 4-digit PIN has 10,000 values.
The used-reset-token list lives in process memory. With several workers, a reset token could be reused within its 10 minutes.
PIN routes call the sync hash functions inside async handlers, which blocks the event loop; async wrappers exist but are unused.
refresh-token copies consent_revoked and kid_active from the old token, and the kid dependency trusts those claims. Revoking consent hard-deletes child profiles, which limits the impact.

With TEST_AUTH_ENABLED=true, emails in TEST_AUTH_EMAIL sign in with TEST_AUTH_CODE; the backend signs in with [redacted] and creates the user if needed.
The code and password have defaults in config.py, so the flag is the only guard. Keep it false in production.
Active devices per parent come from app_config max_parent_devices (default 3). One more device gets 409.
Sign-out deactivates the device session only when device_id is sent.