# Identity Platform

**One Identity. Every Product.**

Central identity, authentication, and authorization infrastructure for your product ecosystem. Built as an independent platform — not owned by any single product.

## Quick Start

### Prerequisites
- Docker 27+ and Docker Compose
- Python 3.12+ (for local backend dev)

No Node.js toolchain is required: the account UI (login, registration, consent,
password flows, dashboard) is rendered by Django templates.

### Run with Docker Compose (Recommended)

```bash
# Copy env and adjust if needed
cp .env.example .env

# Build and start all services
docker compose up --build -d

# Run migrations (first time only)
docker compose exec api python manage.py migrate

# Create superuser (optional)
docker compose exec api python manage.py createsuperuser
```

**Services:**
- Web (login, account, consent): http://localhost:8000/
- API (DRF): http://localhost:8000/api/v1/
- API Docs (OpenAPI/Swagger): http://localhost:8000/api/docs/
- Admin: http://localhost:8000/admin/
- PostgreSQL: localhost:5432
- Redis: localhost:6379

### Local Development (Without Docker)

**Backend:**
```bash
cd apps/api
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp ../../.env.example .env  # adjust DATABASE_URL to sqlite:///dev.db for quick start
python manage.py migrate
python manage.py runserver
```



## Architecture Overview

```
┌─────────────────────────────────────────────────────────────┐
│                      IDENTITY PLATFORM                       │
│  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐        │
│  │  Users  │  │   Auth  │  │  Org    │  │ Session │  ...   │
│  └────┬────┘  └────┬────┘  └────┬────┘  └────┬────┘        │
│       └────────────┴────────────┴────────────┘              │
│                    PRIVATE KEY (RS256)                       │
└────────────────────────────┬────────────────────────────────┘
                             │
              ┌──────────────┼──────────────┐
              ▼              ▼              ▼
         ┌─────────┐   ┌─────────┐   ┌─────────┐
         │Bermooda │   │ Hamsoo  │   │  Future │
         │  (ERP)  │   │ (Network)│  │  Apps   │
         └─────────┘   └─────────┘   └─────────┘
              ▲              ▲              ▲
              │   PUBLIC KEY (verify only)  │
              └──────────────┴──────────────┘
```

**Data Ownership Boundary:**
| Data | Owner |
|------|-------|
| User ID (UUID) | Identity |
| Email & Phone | Identity |
| Authentication & Sessions | Identity |
| Organizations & Memberships | Identity |
| Applications & Service Credentials | Identity |
| Employee & Payroll | Bermooda |
| Profile & Resume | Hamsoo |
| Projects & Listings | Product |

## Key Features

- **OAuth 2.0 & OpenID Connect** — Standard authorize/token/refresh with PKCE
- **Sessions & Devices** — Track, revoke remotely, device detection, token rotation
- **Organizations & Memberships** — Unified org model reusable as company, team, workspace
- **Applications & Service Credentials** — Per-product `client_id`/`client_secret` with explicit ownership
- **Security Events & Audit Log** — Every login, logout, revocation recorded
- **Rate Limiting & Brute-force Protection** — Auto-lockout after failed attempts
- **RS256 Signing** — Private key never leaves platform; products verify with public key
- **OIDC Discovery** — `.well-known/openid-configuration` and JWKS endpoints

## Project Structure

```
D:\Projects\UserManager\
├── docker/                    # Dockerfiles
│   └── Dockerfile.api        # Django + Gunicorn
├── docker-compose.yml         # All services
├── .env.example              # Environment template
├── docs/                     # Architecture, API, security, runbook
└── apps/
    └── api/                  # Django 5.2 backend + server-rendered UI
        ├── config/           # Settings, URLs, WSGI/ASGI
        └── apps/             # Modular apps (identity, oauth, sso, ...)
```

## API Endpoints (v1)

| Category | Endpoints |
|----------|-----------|
| **Auth** | `POST /auth/login`, `POST /auth/refresh`, `POST /auth/logout` |
| **Users** | `GET /users/me`, `GET /users/{id}` |
| **Organizations** | `GET /organizations`, `POST /organizations`, `GET /organizations/{id}` |
| **Memberships** | `GET /organizations/{id}/memberships`, `POST /organizations/{id}/memberships` |
| **Applications** | `GET /applications`, `POST /applications` |
| **Sessions** | `GET /sessions`, `DELETE /sessions/{id}` |
| **Security** | `GET /events` |
| **OIDC** | `GET /.well-known/openid-configuration`, `GET /.well-known/jwks.json` |

Full OpenAPI spec at `/api/docs/`.

## Environment Variables

Key variables (see `.env.example` for full list):

| Variable | Description |
|----------|-------------|
| `DJANGO_SECRET_KEY` | **Required in production** |
| `DATABASE_URL` | Postgres connection string |
| `REDIS_URL` | Redis connection string |
| `CORS_ALLOWED_ORIGINS` | Origins allowed to call the API cross-origin |
| `OIDC_ISSUER` | Public base URL; used in `iss`, discovery and reset links |
| `JWT_SIGNING_KEY` | HS256 fallback key (production requires the RS256 pair) |

## Testing

```bash
cd apps/api
python manage.py test
```

## Security Notes

- No "military-grade" claims — real security only
- Private RS256 key stays in Identity Platform
- Products hold only public JWKS
- Sessions and refresh tokens revocable instantly
- Rate limits per-user and per-IP
- Security events immutable audit log

## License

Proprietary — Independent business unit within the holding.

---

Built with Django 5.2 + DRF (server-rendered templates), PostgreSQL, Redis.