Abstract

A multi-tenant activity-registration platform resolves a household (“family”) account's data by

verified email address alone — with no claim or migration step — and derives from that account a

single aggregated calendar-feed capability URL whose bearer token is stored server-side only as a

domain-prefixed cryptographic hash. Revocation of the feed URL is never a separate operation: it

occurs atomically as a side effect of either (a) re-copying the feed link, which always re-mints the

token, or (b) any change to the account's verified email identity, which nulls the stored hash. The

feed endpoint is served with Cache-Control: private so that no shared CDN or intermediary

cache can continue serving a rotated-out URL, and all failure modes collapse to a single byte-

identical 404 response. The feed content is structured to carry no child identity: events are

deduplicated across a household's registrations by (schedule, date, start-time) key, and event titles

name the activity and provider only. This disclosure describes the combination to place it in the

public domain as prior art.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS