src/

Package cognitoidputil provides Cognito Identity Pool utilities

Package cognitoutil provides Cognito authentication utilities

Package kmsutil adapts an AWS KMS asymmetric key to crypto.Signer, so the private key never exists in this process.

Package ca_bootstrap mints and publishes the assisted-claiming CA and holds the operator certificate configuration it mints from.

Claim admin API: superadmin-only configuration and bootstrap of the claiming CA.

Claim handler lambda: POST /v1/claim/initiate and POST /v1/claim/verify.

Package auth - Admin authentication service for admin users

Package clients is the ESP User OAuth-client service over espuser-oauth-clients: create, list, patch, delete, enforcing the client write-invariants.

Table espuser-admin-config (PK config_name, SK subtype): admin-selected key-value config.

Table espuser-auth-flows (PK flow_id): the TTL'd browser authorization-code flow record, from /oauth2/authorize through OTP login to the issued code (resolved by the by-code GSI at token exchange).

Table espuser-identity-providers: the upstream providers the federation broker may delegate to.

Table espuser-oauth-clients (PK client_id, no SK): the registered OAuth/OIDC client registry.

Table espuser-refresh-tokens (PK user_id, SK client_id#family_id): one row per login family holding the current rotation counter.

GET /oauth2/authorize (validate -> LOGIN flow record -> 302 to the login page with a flow_id cookie) and the served login UI.

Command publish_discovery builds the static OIDC/OAuth discovery documents and uploads them to S3, once, at deploy.

Command user_auth serves the native /v1/user/auth/* password APIs.

Package idp runs the upstream leg of a brokered login, with ESP User as a confidential client of an upstream IdP. It is deliberately independent of the client's downstream leg — see the "why brokered, not pass-through" argument in espuser/docs/en/specs/federation.md.

Package legacyauth serves the native /v1/user/auth/* password APIs.

Package refreshtoken is the ESP User refresh-token service: it owns the token lifecycle — mint a family on login, rotate-on-use with reuse=theft detection, and revoke — over the espuser-refresh-tokens store.

Package scope is the single source of truth for ESP User's OAuth/OIDC scope values and space-delimited membership tests (RFC 6749 §3.3).

Package sender resolves which SES identity the IdP sends mail from.

Package db provides database operations for the RainMaker platform.

Command user_creds backs POST /v1/user/credentials: it verifies the presented bearer access token in-handler (no gateway authorizer) and exchanges it for Cognito Identity Pool credentials.

Package nodelifecycle hosts generic node-lifecycle hooks (node-left-group, node-offline).

Package bulk_job centralises the steps the registration and update Lambdas share when kicking off a bulk job: generate a request ID, write the node_reg_reqs row in `requested` state, and dispatch the shared Fargate task with the per-job env var set.

Package jobs_api centralises the read-side handlers shared by the registration and update Lambdas: status lookup and the paginated failed-nodes audit list.

Package integrationauth keeps the OAuth tokens we hold as a client of a user's linked third-party service fresh, so the notification senders can call out to Alexa, GVA, and webhooks.

Package timewindow provides time window management functionality for timeseries data processing.

Package mock provides mock implementations for AWS Cognito Provider

Package losterr reports errors that are constructed and then thrown away.

Package certissuer produces device certificates from a validated public key under a named profile.

Package httpclient owns the process-wide outbound HTTP client so every outbound call shares one timeout and one seam tests can replace.

Package jsonutils converts between a dotted key path ("0x1.c.s.0x6.a.0x0") and its nested map form ({"0x1":{"c":{"s":{"0x6":{"a":{"0x0":<value>}}}}}}).

Package jwtutils holds reusable RS256 JWT + JWK helpers: sign a claim set with a kid-stamped header, verify a token against a JWK set, parse an RSA signing key, and build the public JWK/JWKS.

Package metrics provides CloudWatch Embedded Metrics Format (EMF) support for Lambda functions to emit custom metrics without API call overhead.

Package otputils holds generic, table-agnostic OTP helpers: id/code generation and salted-hash create/verify.

Package pkceutil derives and verifies RFC 7636 PKCE code challenges.

Package rlog provides a global logger for rmng.

Package secretutil generates cryptographically-random secrets/identifiers.