chore: collect auth-server wiki and lib refresh

Picks up the rewritten auth-server wiki (platform anatomy theme) and the
regenerated lib artifacts, including the new pep-typed marker bounce.
This commit is contained in:
2026-09-16 19:51:24 +05:30
parent 7aadae1736
commit a115df113d
12 changed files with 233 additions and 154 deletions

View File

@@ -412,7 +412,7 @@
<li class="md-nav__item">
<a href="#the-identity-model" class="md-nav__link">
<span class="md-ellipsis">
The identity model
🧬 The identity model
</span>
</a>
@@ -421,7 +421,7 @@
<li class="md-nav__item">
<a href="#token-contract" class="md-nav__link">
<span class="md-ellipsis">
Token contract
🎟️ Token contract
</span>
</a>
@@ -430,7 +430,7 @@
<li class="md-nav__item">
<a href="#how-the-ecosystem-trusts-the-server" class="md-nav__link">
<span class="md-ellipsis">
How the ecosystem trusts the server
🤝 How the ecosystem trusts the server
</span>
</a>
@@ -439,7 +439,16 @@
<li class="md-nav__item">
<a href="#benefits" class="md-nav__link">
<span class="md-ellipsis">
Benefits
💡 Benefits
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#read-next" class="md-nav__link">
<span class="md-ellipsis">
📚 Read Next
</span>
</a>
@@ -557,11 +566,12 @@
<h1 id="centralized-authentication">Centralized Authentication</h1>
<h1 id="centralized-authentication">🔗 Centralized Authentication</h1>
<p>The Aetoskia Auth Server acts as the <strong>single identity provider</strong> for every
application in the Aetos Platform ecosystem. The model is deliberately small
and uniform.</p>
<h2 id="the-identity-model">The identity model</h2>
<hr />
<h2 id="the-identity-model">🧬 The identity model</h2>
<div class="language-text highlight"><table class="highlighttable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span><span class="normal"><a href="#__codelineno-0-1"> 1</a></span>
<span class="normal"><a href="#__codelineno-0-2"> 2</a></span>
<span class="normal"><a href="#__codelineno-0-3"> 3</a></span>
@@ -599,7 +609,8 @@ and uniform.</p>
client, and further use is prevented only by expiry or revocation through
introspection-driven policies.</li>
</ul>
<h2 id="token-contract">Token contract</h2>
<hr />
<h2 id="token-contract">🎟️ Token contract</h2>
<p>A valid access token is an HS256 JWT with exactly two claims:</p>
<div class="language-json highlight"><table class="highlighttable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span><span class="normal"><a href="#__codelineno-1-1">1</a></span>
<span class="normal"><a href="#__codelineno-1-2">2</a></span>
@@ -615,7 +626,8 @@ and uniform.</p>
</ul>
<p>There are no scopes or roles inside the token; authorization decisions belong
to the consuming service, while identity and authenticity belong here.</p>
<h2 id="how-the-ecosystem-trusts-the-server">How the ecosystem trusts the server</h2>
<hr />
<h2 id="how-the-ecosystem-trusts-the-server">🤝 How the ecosystem trusts the server</h2>
<ol>
<li><strong>Users authenticate once</strong> via <code>/login</code> and receive a token.</li>
<li><strong>Services accept that token</strong> as proof of identity after verifying it
@@ -626,13 +638,19 @@ to the consuming service, while identity and authenticity belong here.</p>
</ol>
<p>This keeps authentication centralized while leaving each service in control
of its own authorization rules.</p>
<h2 id="benefits">Benefits</h2>
<hr />
<h2 id="benefits">💡 Benefits</h2>
<ul>
<li>New services onboard with a client library call, not a new auth system.</li>
<li>Credential storage, hashing, and issuance policies evolve in one place.</li>
<li>A single <code>JWT_SECRET</code> rotation strategy protects the whole platform.</li>
</ul>
<hr />
<h2 id="read-next">📚 Read Next</h2>
<ul>
<li><a href="../02_how_to_use/">How to Use</a> — register, login, and call endpoints.</li>
<li><a href="../03_platform_integration/">Platform Integration</a> — wiring the token into services.</li>
</ul>