Designs by Duhart All work
Rank
18 of 34
Tier
Tier B 70 of 120

9 — Auth & Identity Platform

Rank 18 of 34 · Tier B · app/AuthGateway, app/proto, app/DAO Stack: Go, gRPC / ConnectRPC, Protocol Buffers (buf), JWT RS256, Cloudflare adapter, systemd Scope: 100,771 lines in AuthGateway; 24 authored .proto contracts

Why this ranks here. Identity is where security meets distribution. Token issuance, verification, key rotation, ACL evaluation, and service-to-service identity are the security-critical distributed-systems surface, and this has all of them behind a schema-first protobuf contract.

Issue, verify, rotate, the security-critical surface
ClientAuthGatewayJWKSServicecredentialsaccess + refresh (RS256)request + bearerfetch signing key (cached)public keyverified, claims decide ACL

RS256 rather than a shared secret, so verification needs only the public JWKS and a leaked service credential cannot mint tokens. 24 authored protobuf contracts define the service-to-service surface; entitlement is a claim, never a request field.

What it is

The identity and authorization plane for a multi-mode platform: login, registration, token issuance and refresh, ACL, per-mode entitlement sync, billing servicers, and an identity store with a sink and adapters.

Structure

ComponentRole
auth_gateway.go, bootstrap.goService composition and lifecycle
auth_connect_server.go, connect_adapters.goConnectRPC surface (gRPC + HTTP/JSON from one definition)
auth_http_server.goREST edge
identity_servicer.go, identity_store_adapter.go, identity_sink.goIdentity CRUD and propagation
acl_servicer.goAuthorization decisions
auth_cache_servicer.go, auth_cache_support.goToken/claims caching
auth_event_bus.goAuth events to the rest of the platform
auth_mode_sync_controller.goEntitlement sync across product modes
billing_servicer.goBilling identity
config_manager.go + testRuntime configuration
cloudflare_adapter.goEdge integration
certs/RS256 signing material handling

Schema-first contracts

app/proto/ — 24 authored .proto files under buf with generation targets for Go, Swift, and TypeScript from one source of truth:

auth/  acl/  identity/  token/  login/  registration/
billing/  gateway/  domain/  common/  array/  mode_sync/

Generated Swift gateway templates and view-model templates are checked in, so the mobile clients are compiled against the same contract the server serves. One schema, three languages, generated — this is the answer to "how do you keep clients and servers in sync" and it is already built.

The RS256 story

Asymmetric signing (RS256) rather than shared-secret HMAC means verifiers never hold signing material. This pattern was later carried into the Billboard Workers — [F-2] split auth into four tiers and bound identity to the token — which shows the same security model applied consistently across two very different runtimes.