6.3 KiB
6.3 KiB
Roadmap
Vision
Identity Platform is the central identity infrastructure for the holding. Every product (Bermooda, Hamsoo, future) connects to it — no product owns identity, the platform does.
Current (v1.0 - MVP)
Completed
- Custom User model (UUID, email/phone, no username)
- JWT authentication (RS256, access + refresh + ID token)
- Login, refresh, logout endpoints
- Organization CRUD + slug auto-generation
- Membership model (roles: owner/admin/member, statuses)
- OAuth Application registry (client_id/secret, redirect URIs, scopes)
- Session tracking (device, IP, UA, type, revocation)
- SecurityEvent audit log (login, logout, refresh, revoke, MFA, brute-force)
- Rate limiting (per-user, per-IP, endpoint-specific)
- OIDC Discovery (
.well-known/openid-configuration, JWKS) - drf-spectacular OpenAPI schema + Swagger UI
- Django admin for all models
- 21 backend tests passing
- Next.js 14 landing page (10 sections, RTL, bilingual fa/en)
- Docker Compose (postgres, redis, api, web)
- Brand-configurable via env vars
- Dark enterprise theme (Adobe-inspired)
v1.1 — Hardening & DX (Q1 2025)
Backend
- Token blacklist — Redis-backed for instant revocation checking
- Key rotation — Automated RS256 key rotation with overlap window
- Device trust — Remember device, skip MFA on trusted
- Account lockout — Configurable threshold, admin unlock, email notify
- Password breach check — Integrate HaveIBeenPwned on set/change
- Email verification flow — Send code, verify, mark
email_verified - Phone verification flow — SMS OTP (provider-agnostic)
- Admin API tokens — Long-lived service tokens with scopes
Frontend
- Admin dashboard — React admin panel (users, orgs, apps, sessions, events)
- Login page — Branded, MFA-ready, remembers device
- Password reset flow — Request → email → set new
- Email/phone verification UI
- Session management UI — List, revoke, current indicator
- Developer portal — App registration, credentials, logs
DevOps
- CI/CD — GitHub Actions (test, lint, typecheck, build, deploy)
- Staging environment — Auto-deploy on merge to
main - Structured logging — JSON logs, correlation IDs
- Metrics — Prometheus
/metricsendpoint - Health checks —
/health/with DB/Redis connectivity
v1.2 — MFA & Compliance (Q2 2025)
MFA
- TOTP — Google Authenticator, Authy, 1Password
- Backup codes — 10 single-use codes on enrollment
- WebAuthn / Passkeys — Platform authenticator + cross-device
- MFA policies — Per-org: required/optional, allowed methods
- Step-up auth — Re-auth for sensitive actions (delete org, rotate secret)
Compliance
- GDPR export — User data download (JSON)
- GDPR deletion — Anonymize on request (retain audit log)
- SOC 2 readiness — Access reviews, evidence collection
- Data processing addendum — Template for customers
v1.3 — Federation & Enterprise (Q3 2025)
External Identity Providers
- SAML 2.0 — SP-initiated, IdP-initiated, metadata exchange
- OIDC Federation — Connect to Google, Microsoft, Okta, Auth0
- SCIM 2.0 — Provision/deprovision users from HR systems
- Just-in-Time (JIT) Provisioning — Auto-create on first SSO login
Enterprise Features
- Custom domains —
auth.customer.com→ platform - White-labeling — Logo, colors, favicon, email templates per org
- Audit log streaming — Webhook / Kafka / Splunk / Datadog
- IP allowlists — Per-application or per-org
- Session policies — Idle timeout, max duration, concurrent limit
v2.0 — Platform Maturity (Q4 2025)
Architecture
- Multi-region deployment — Active-active with session sync
- Event sourcing — Identity events as source of truth
- GraphQL API — Flexible queries for complex UIs
- Webhooks v2 — Retry, signing, dead-letter, replay
Developer Experience
- SDKs — Python, TypeScript, Go, Rust
- Terraform provider — Manage orgs, apps, users as code
- CLI —
idpcommand for admin tasks - Local dev container — One-command full stack
Product Integrations
- Bermooda — Full SSO, org sync, role mapping
- Hamsoo — Full SSO, profile linkage
- Template for new products — Cookiecutter + docs
Backlog / Ideas
| Area | Idea |
|---|---|
| Security | Risk-based auth (impossible travel, new device) |
| Security | Passwordless login (magic link, passkey-only) |
| Security | Hardware key enforcement (YubiKey) |
| Org | Nested organizations (parent/child) |
| Org | Custom roles & permissions (RBAC builder) |
| API | API keys (non-OAuth, for server-to-server) |
| API | GraphQL subscriptions (real-time events) |
| DX | Storybook for UI components |
| DX | Visual regression tests (Chromatic) |
| Ops | Chaos engineering (Litmus) |
| Ops | Disaster recovery drill (quarterly) |
| Compliance | HIPAA BAA template |
| Compliance | ISO 27001 controls mapping |
Release Cadence
| Cycle | Duration | Contents |
|---|---|---|
| Patch | 2 weeks | Bug fixes, security patches |
| Minor | 8 weeks | New features, non-breaking |
| Major | 6 months | Breaking changes, architecture shifts |
Versioning: SemVer. API version in URL (/api/v1/).
Decision Log
| Date | Decision | Rationale |
|---|---|---|
| 2024-01 | RS256 over HS256 | Products verify without private key |
| 2024-01 | UUID PK for User | Immutable, unguessable, distributed-friendly |
| 2024-01 | Modular monolith | Single deploy, clear boundaries, later extract |
| 2024-01 | SQLite for local dev | Zero-config, fast, mirrors Postgres behavior |
| 2024-01 | RTL-first, Persian default | Target market primary language |
| 2024-01 | Env-driven branding | No hardcoded "Identity Platform" |
| 2024-01 | No "military-grade" claims | Honest security marketing |
Contributing
- Fork → feature branch → PR.