SiteTime Sign In
Connecting securely to SiteTime service…
Test accounts
Worker: afzrahman
Manager: manager1
Worker: afzrahman
Manager: manager1
--:--
Demo Worker • 10027
Current state
Checking…
Checking…
Device AuthenticatorNot registered
LocationNot captured
GPS Accuracy—
Latest Approval—
Shared V0.3: Clock In/Out is written to Cloudflare D1 through the Worker API. Reporting Manager sees the same record on another device.
Pending0
Approved0
Rejected0
Returned0
Manager Approval Queue
| Worker | Event | Site | Time | GPS Evidence | Auth | Status | Action |
|---|
Shared Attendance Audit History
| Worker | Type | Timestamp | Site | GPS | Authentication | Status | Decision |
|---|
V0.3 Security Boundary
Shared database: attendance records are now sent to a Cloudflare Worker API and stored in D1.
Authentication: demo login is validated by the Worker and a signed short-lived session token is returned.
Biometric: Face ID/fingerprint/Windows Hello stays inside the operating system. This prototype invokes WebAuthn locally. The V0.3 backend records the client verification result, but does not yet perform production-grade WebAuthn assertion verification. That is the next security hardening step.
Location: Phase 1 captures GPS only at attendance events. No continuous tracking.
Production requirement: restrict API CORS to the production Pages domain, use corporate SSO, verify WebAuthn server-side, add device enrollment/revocation and formal data-retention controls.