Architecture and security

Components

Modules add pages, routes, settings, and data to this structure. Attendance is built in; plugins are composed into the dashboard and Worker when the installation is built.

Security model

• Admin and Operator permissions are enforced by the Worker on every request, not only hidden in the dashboard.
• Sessions are signed, HTTP-only, Secure, SameSite=Strict cookies. Each protected request rechecks the account, role, and session.
• Local passwords use salted scrypt hashes. Five wrong passwords pause sign-in to that account for 15 minutes.
• Google sign-in validates the issuer, audience, verified email, and an active LancerLogin account.
• Integration secrets are encrypted with AES-256-GCM using an installation-specific key and are never returned to the browser.
• Pairing codes and kiosk credentials are stored only as hashes.
• Meeting attendance windows cannot overlap, so each scan matches at most one meeting.
• Kiosks accept six fixed, kiosk-specific commands from the dashboard and never a shell command or arbitrary argument.
• Kiosk maintenance is available only on the kiosk's own screen, behind a rate-limited local PIN.
• Dashboard updates install only complete official releases, pinned to an exact commit, after an entire-installation backup.
• CSV exports store values that look like spreadsheet formulas as text.

Plugins run with the same access as LancerLogin itself. Add only plugins whose source you trust.

Detailed reference

These documents in the repository describe behavior in more depth. Task instructions live on this site.

• Architecture and security model
• Privacy reference and the plain-language privacy notice
• Backup and restore, including D1 export and restore commands
• Kiosk reference
• Web update reference and update tracks
• Module plugins and writing a plugin
• Integrations and labels and attendance policies
• Release notes