#JWT

The Vue browser application of a civil-service personnel system: a self-service portal where employees keep their records and propose changes, and administration of a versioned organisation chart, reference data and accounts — built from a few shared definitions, not a page per record.

The Laravel core of a civil-service personnel system: employee records and career histories, self-service proposals with review, salary-step, promotion and retirement decisions, rules taken from regulations, a versioned organisation chart, and access scoped down to a single unit.

An interactive Python script that proves an identity provider is ready for a client: it rehearses a full PKCE sign-in and sign-out like an application, then checks the tokens it receives against the provider's keys the way an application must.

Opening a broker to browsers and devices on the internet is less about encryption than identity. Each entrance now accepts one kind of credential, every token is bound to its own name and addressed to this broker, and TLS ends in nginx.

A laptop and a borrowed Colab GPU talked through a public MQTT broker that anyone could read. Giving that channel an identity took an afternoon on the broker and eight obstacles in the clients — mostly safeguards that were right for the old setup and wrong for the new one.

A failed login in a half-built service is either a misconfigured identity provider or wrong code. I rule out the first by rehearsing a full login with my own tool before writing any app, and found compliant providers still disagree on tokens and claims.