Identity

Overview

Identity provides OpenIddict OIDC, hosted login/register/password pages, platform user profiles, and per-project environment users/roles/permissions.

API

{pe} = /projects/{projectId}/environments/{environmentId}.

Auth UI and health

MethodPathNotes
GET/auth/healthAnonymous
GET/POST/auth/loginHosted page; POST rate-limited
GET/POST/auth/registerHosted page; POST rate-limited
GET/auth/confirm-emailRate-limited
GET/auth/confirm-email-changeRate-limited
GET/POST/auth/forgot-passwordHosted page; POST rate-limited
GET/POST/auth/reset-passwordHosted page; POST rate-limited
GET/POST/auth/logoutAnonymous
GET/auth/external/{provider}OAuth challenge
GET/auth/external/callbackOAuth callback

OIDC

MethodPathNotes
GET/POST/connect/authorizeOpenIddict
—/connect/tokenToken endpoint (middleware)
GET/connect/userinfoOpenIddict
GET/POST/connect/logoutOpenIddict
GET/.well-known/openid-configurationDiscovery

Platform profile

MethodPathNotes
GET/PATCH/identity/meBearer required
POST/identity/me/passwordBearer
POST/identity/me/emailBearer
POST/DELETE/identity/me/avatarBearer
GET/identity/avatars/{userId}Anonymous
GET/identity/permissionsBearer

Project auth

MethodPathNotes
GET/POST/identity{pe}/usersBearer
GET/PATCH/DELETE/identity{pe}/users/{userId}Bearer
POST/identity{pe}/users/{userId}/passwordBearer
PUT/identity{pe}/users/{userId}/rolesBearer
GET/POST/identity{pe}/rolesBearer
PATCH/DELETE/identity{pe}/roles/{roleId}Bearer
PUT/identity{pe}/roles/{roleId}/permissionsBearer

Clients

PackageRuntime
@vijihub/authbrowser
VijiHub.Authserver (.NET JWT helpers)
import { createAuthClient } from '@vijihub/auth'

const auth = createAuthClient({
  authority: 'http://localhost:5600',
  clientId: 'vijihub-console',
  redirectUri: 'http://localhost:5500/auth/callback',
})

await auth.login()
// on callback:
await auth.handleRedirectCallback()
const token = await auth.ensureAccessToken()

Implementation

  1. Register an OIDC client (or use seeded vijihub-console in Development).
  2. Implement Authorization Code + PKCE with @vijihub/auth or a standards-compliant library.
  3. For project RBAC, call /identity{pe}/… with the owner/admin JWT from the Console session or your trusted backend.
  4. Hosted auth pages live on the Gateway — do not reimplement login HTML in the Console.

Constraints

  • No resource-owner password grant.
  • Auth POSTs are rate-limited by IP.
  • Project user/role APIs require authorization; they are not public API-key admin surfaces for end-user apps unless you deliberately proxy them.
  • See Authentication and Constraints.