idinfra

A self-hosted, multi-tenant identity and access service. One Go binary, SQLite by default, PostgreSQL by configuration, no mandatory external dependency.

Identity is tenant-scoped. A person is a member of one tenant, identified by their work email or work ID, unique within that tenant only. There is no global identity, no cross-tenant link, and no query path from an identifier to a set of tenants — so the same human employed by two customers is two independent members, and neither customer can learn anything about the other.

Status

Stage 0 of 13. The skeleton builds, lints, tests and cross-compiles; every package boundary already exists so that no later stage has to move files. There is no behaviour yet — serve is Stage 7.

Build

make build      # static, cgo-free binary
./idinfra version
make check      # gofmt, vet, race tests
make lint       # golangci-lint

Go 1.26 or newer. Stage 1 assumes 1.27 for a standard-library uuid.NewV7; on 1.26 it either waits for 1.27 or takes one dependency for UUIDv7. Note it in docs/DEPENDENCIES.md if it takes one.

Layout

cmd/idinfra/      # one binary: serve, migrate, keygen, bootstrap, export, import
internal/
  core/           # domain types + authority predicates P1-P3. stdlib only, no I/O.
  store/          # Store -> Tenant(id) -> ScopedStore. Every table is tenant-scoped.
  platform/       # the ONLY unscoped access, and P4. Not importable from api/tenant*.
  auth/           # argon2 (semaphored), token mint/verify, key rotation
  revoke/         # bounded window, bus, SSE stream
  api/            # handlers, problem+json, paging, idempotency
  audit/ hook/ config/
migrations/
  sqlite/ postgres/

Three rules that outrank convenience, and that the tests enforce:

1. No global lookup. No code path resolves an identifier — an email, a work ID, anything — to a tenant. TestNoCorrelation fails the build if one appears. If a requirement seems to need it, it needs federation instead.
2. core imports nothing outside the standard library. If a predicate needs I/O, the signature is wrong.
3. Every privileged write and its audit row share one transaction. The store helper takes both or neither.

Licence

Apache-2.0. See LICENSE and SECURITY.md.