jac-sv-auth

Use a plain def or def:priv declaration, which both require a JWT and run on the caller's own isolated root. Only def:pub skips authentication, and def:protect behaves identically to def:priv for auth purposes.

def:pub allows anonymous access on a shared guest graph, while def:priv and plain def require JWT and run per-user. def:protect requires JWT too; its pub/protect/priv gradient controls source visibility, not authentication strength.

POST to /user/register with an identities array and credential object, then POST to /user/login with a single identity and credential to receive a token. Registration returns 201 with no token, so always call login afterward.

The endpoint is declared as plain def, def:priv, or def:protect and the request lacks a valid Bearer token. Do not fix this by switching to def:pub, since that changes which graph the endpoint runs on, not just who may call it.

Yes, Jac has built-in admin, system, and user roles stored on the user and carried in JWT claims. Set roles via the admin API or /admin portal; for app-domain roles, store a role field on a node under the user's root.

The default signing secret is a publicly known testing value, so anyone can forge tokens for any user. Set a real secret via [scale.jwt] config or the JWT_SECRET environment variable before deploying.