# 9 — Auth & Identity Platform

**Rank 12 of 28** · Tier B · `app/AuthGateway`, `app/proto`, `app/DAO`
**Stack:** Go, gRPC / ConnectRPC, Protocol Buffers (buf), JWT RS256, Cloudflare adapter, systemd
**Scope:** 100,771 lines in AuthGateway; 24 authored `.proto` contracts

> **Why this ranks here.** Every bank interview goes here. Token issuance,
> verification, key rotation, ACL evaluation, and service-to-service identity
> are the security-critical distributed-systems surface, and this has all of
> them behind a schema-first protobuf contract.

---

## What it is

The identity and authorization plane for a multi-mode platform: login,
registration, token issuance and refresh, ACL, per-mode entitlement sync,
billing servicers, and an identity store with a sink and adapters.

## Structure

| Component | Role |
|---|---|
| `auth_gateway.go`, `bootstrap.go` | Service composition and lifecycle |
| `auth_connect_server.go`, `connect_adapters.go` | ConnectRPC surface (gRPC + HTTP/JSON from one definition) |
| `auth_http_server.go` | REST edge |
| `identity_servicer.go`, `identity_store_adapter.go`, `identity_sink.go` | Identity CRUD and propagation |
| `acl_servicer.go` | Authorization decisions |
| `auth_cache_servicer.go`, `auth_cache_support.go` | Token/claims caching |
| `auth_event_bus.go` | Auth events to the rest of the platform |
| `auth_mode_sync_controller.go` | Entitlement sync across product modes |
| `billing_servicer.go` | Billing identity |
| `config_manager.go` + test | Runtime configuration |
| `cloudflare_adapter.go` | Edge integration |
| `certs/` | RS256 signing material handling |

## Schema-first contracts

`app/proto/` — 24 authored `.proto` files under `buf` with generation targets
for **Go, Swift, and TypeScript** from one source of truth:

```
auth/  acl/  identity/  token/  login/  registration/
billing/  gateway/  domain/  common/  array/  mode_sync/
```

Generated Swift gateway templates and view-model templates are checked in, so
the mobile clients are compiled against the same contract the server serves.
**One schema, three languages, generated** — this is the answer to "how do you
keep clients and servers in sync" and it is already built.

## The RS256 story

Asymmetric signing (RS256) rather than shared-secret HMAC means verifiers never
hold signing material. This pattern was later carried into the Billboard
Workers — [`[F-2]` split auth into four tiers and bound identity to the
token](05-billboard-production-hardening.md) — which shows the same security
model applied consistently across two very different runtimes.

## Interview surface this opens

- JWT: RS256 vs HS256, JWKS distribution, key rotation without downtime
- Token revocation in a stateless-token system, and cache invalidation
- ACL evaluation latency and where you cache authorization decisions
- gRPC vs ConnectRPC vs REST, and generating polyglot clients from one schema
- Service-to-service identity (mTLS vs signed tokens)