modules/

Package apiaccess manages machine authorization: API definitions with scopes and client grants.

Package apikey issues machine credentials sent via the X-API-KEY header, with expiry and last-used tracking.

Package appconfig serves public and admin configuration endpoints.

Package auditlog captures domain events and exposes them via HTTP.

Package customclaim manages per-user and per-group key/value claims injected into OIDC tokens.

Package discovery serves RFC 8615 endpoints: /.well-known/openid-configuration and /.well-known/jwks.json.

Package jwks owns signing key material: generation, encrypted storage, rotation with overlap, and the JWKS key provider consumed by token issuance and the discovery endpoints.

Package oidc is the OpenID Connect / OAuth 2.0 provider surface: /authorize + PAR (root router), /api/oidc/token, userinfo, introspect, revoke, end_session.

Package scimsync provisions users and groups to a remote SCIM server.

Package account covers profile management, credential lifecycle, and account state.

Package devicelogin implements the QR / cross-device sign-in flow: an anonymous device parks a short-lived request keyed by a short user code; a signed-in user approves or denies it; the waiting device long-polls the exchange until approved.

Package emailverification verifies a user's email address via a single-use token (auth_tokens, purpose = email_verification).

Package onetimeaccess issues single-use sign-in tokens delivered by email: admins mint them per user; unauthenticated users may request one for their own address when the app policy allows.

Package password owns credential hashing and verification: one argon2id/scrypt hash per user (PHC format via pkg/crypto), plus the identity lookup used by the sign-in flow.

Package session manages sign-in sessions: issue (cookie-backed opaque tokens), validate (sliding expiry), list, and revoke.

Package signup implements application-based self-service sign-up flows (create + approve) with rate-limited endpoints.

Package token owns the shared one-shot token store (public.auth_tokens): rows keyed by (user_id, purpose), SHA-256 hash at rest, single-use consumption with an expiry check.

Package user is the mandatory accounts core: user entities, their CRUD surface, and persistence.

Package usergroup groups users so OIDC client access can be granted in bulk.

Package webauthn implements passkey sign-in: registration and assertion ceremonies via go-webauthn, credential storage, and the admin credential CRUD.