cx-platform-identity

Why reach for it

Who is asking, as a value. cx-platform-identity turns a verified token into a session bound to a principal and a tenant, maps claims to that principal deterministically, resolves did:web identifiers, keeps authorization rows in the store and answers whether a credential has been revoked.

A session is attached from a token checked against the issuer's keys, and every question about it is answered as a value: an unattached request, an unknown session id, an unknown client are all absence you can ask about with [?else], never an exception. The claim mapping is pure — the same claims map to the same principal every time — so a policy written against a principal can be tested without a token in hand.

The rest of the repository is the identity fabric around the session: did:web resolution refuses to reach the network until it is granted and refuses a self-describing document; the authorization store keeps grants as rows the engine can query and replay; credential revocation is an append to a journal and a fold over one — a fact that outlives the process and is visible to a second party. The single sign-on protocols themselves live one repository over, in the sso module.

What it gives you

Four modules of the platform group: the session layer, the authorization store, did:web resolution and credential revocation. Each links to its reference page, projected from the module's own documentation.

Try it

A claims document mapped to a principal with no session in hand — the tenant from tid, the identity from sub, and the same answer every time it is asked.

        [?lib 'cx-platform/session']
[$session:map-claims [claims tid="acme" sub="dana"] {}]
      

        $ cx prog.cx
[principal id=dana [tenant id=acme]]
      

Status

The identity repository builds on the store, the wire and the session layer, and the application host builds on it; the front door compiles its V module from the pin.

Links

• github.com/cx-home/cx-platform-identity — the repository
• README — what it is, how to install it, what it pins
• spec/03-approved — the specification, the only truth
• spec/03-approved/platform — the specification, the only truth
• conformance — the conformance corpus, the executable truth
• conformance/platform — the conformance corpus, the executable truth