The shared SM_MOD_KEY used to travel in ?mod=<key> links and sat raw in a 30-day
cookie, so one leaked link made anyone a mod. Now:
- The owner creates a one-time invite per mod at /mod/admin. Opening it shows a
confirm page; only the button (POST) redeems it, so link previews can't burn it.
A used link is worthless, unused links expire (1 h / 24 h / 7 days).
- Each device gets a random session cookie (HttpOnly, SameSite=Lax, Secure on the
Space); only its SHA-256 is stored in /data/mod_access.json. Sessions unused for
30 days expire.
- /mod/admin lists every device (name, browser/OS, network, added, last seen), can
remove single devices or all others, cancel unused invites, and shows a security
log (new devices, a login used from a new network, used/invalid links, wrong
owner keys).
- Owner login via SM_OWNER_KEY in a POST form (/mod/admin?login only, rate-limited
per IP and globally, 404 for everyone else).
- No secret in URLs anymore: ?mod=<key> and ?mod_key= grant n…
