Token issuing

Token roles

Identity issue ba vai trò token:

refreshToken cũng được set làm HttpOnly cookie khi applicable.

Login single branch

POST /api/auth/login
→ accessToken
→ refreshToken
→ nextAction.type = load_current_context

Khi customer chỉ có một active branch, Identity apply branch scope vào auth_session và issue branch-scoped accessToken.

Login multi branch

POST /api/auth/login
→ accountAccessToken
→ refreshToken
→ branches[]
→ nextAction.type = select_branch

Frontend hiển thị branch selection và gọi POST /api/auth/select-branch.

Select branch

accountAccessToken
→ POST /api/auth/select-branch
→ accessToken
→ nextAction.type = load_current_context

Identity validate account token, kiểm tra branch selectable, update auth_session với:

• workspace_id
• member_id
• active_branch_id

Sau đó Identity issue branch-scoped accessToken.

Claims confirmed từ code

Common access claims:

• account_id
• account_type
• session_id
• typ
• token_type
• token_scope

Branch access claims:

• workspace_id
• tenant_id
• member_id
• active_branch_id
• branch_ids
• roles

Refresh token claims:

• account_id
• session_id
• token_type

Standard JWT fields used:

• sub
• iss
• iat
• exp
• jti

Confirmed token values:

JWKS

Identity publish public keys tại:

GET /.well-known/jwks.json

Gateway dùng:

http://centeros-identity-service:8081/.well-known/jwks.json

Identity signs token bằng RSA key config từ env vars. Không ghi private key hoặc public key value vào docs.

TODO

• Chưa đóng: system token compatibility matrix ngoài auth checkpoint.