So, this question has little to do with Clojure, but my application will be in Clojure and I guess I'll ask here. I'm currently rewriting an SPA that I also want to make into an app, and in the past I've used jwt in localstorage and cookies for authentication. I've since learned jwt in localstorage is a bad idea, and cookies are not ideal for mobile apps. What authentication scheme is best?

Is there some library you can run on a codebase that show which functions call which other functions? Would be very helpful when learning a new codebase

This thread had some interesting options I was unaware of (so can't comment on, beyond saying they look handy!): https://stackoverflow.com/questions/41946753/how-can-i-trace-code-execution-in-clojure

I have a compojure api context like this:

(context "/api/test" []
    :tags ["Some tags"]
    :middleware [wrap-session-auth]
    :auth-rules authenticated?

    (POST "/do_something_1" []
      :body [...]
      :return ...
      (ok ...))

    (POST "/do_something_2" []
      :body [...]
      :return ...
      (ok ...))

    (POST "/do_something_3" []
      :body [...]
      :return ...
      (ok ...))

    (POST "/do_something_4" []
      :body [...]
      :return ...
      (ok ...))
...