9 — Auth & Identity Platform
Rank 12 of 28 · Tier B · app/AuthGateway, app/proto, app/DAO
Stack: Go, gRPC / ConnectRPC, Protocol Buffers (buf), JWT RS256, Cloudflare adapter, systemd
Scope: 100,771 lines in AuthGateway; 24 authored .proto contracts
Why this ranks here. Every bank interview goes here. Token issuance, verification, key rotation, ACL evaluation, and service-to-service identity are the security-critical distributed-systems surface, and this has all of them behind a schema-first protobuf contract.
What it is
The identity and authorization plane for a multi-mode platform: login, registration, token issuance and refresh, ACL, per-mode entitlement sync, billing servicers, and an identity store with a sink and adapters.
Structure
| Component | Role |
|---|---|
auth_gateway.go, bootstrap.go |
Service composition and lifecycle |
auth_connect_server.go, connect_adapters.go |
ConnectRPC surface (gRPC + HTTP/JSON from one definition) |
auth_http_server.go |
REST edge |
identity_servicer.go, identity_store_adapter.go, identity_sink.go |
Identity CRUD and propagation |
acl_servicer.go |
Authorization decisions |
auth_cache_servicer.go, auth_cache_support.go |
Token/claims caching |
auth_event_bus.go |
Auth events to the rest of the platform |
auth_mode_sync_controller.go |
Entitlement sync across product modes |
billing_servicer.go |
Billing identity |
config_manager.go + test |
Runtime configuration |
cloudflare_adapter.go |
Edge integration |
certs/ |
RS256 signing material handling |
Schema-first contracts
app/proto/ — 24 authored .proto files under buf with generation targets
for Go, Swift, and TypeScript from one source of truth:
auth/ acl/ identity/ token/ login/ registration/
billing/ gateway/ domain/ common/ array/ mode_sync/
Generated Swift gateway templates and view-model templates are checked in, so the mobile clients are compiled against the same contract the server serves. One schema, three languages, generated — this is the answer to "how do you keep clients and servers in sync" and it is already built.
The RS256 story
Asymmetric signing (RS256) rather than shared-secret HMAC means verifiers never
hold signing material. This pattern was later carried into the Billboard
Workers — [F-2] split auth into four tiers and bound identity to the
token — which shows the same security
model applied consistently across two very different runtimes.
Interview surface this opens
- JWT: RS256 vs HS256, JWKS distribution, key rotation without downtime
- Token revocation in a stateless-token system, and cache invalidation
- ACL evaluation latency and where you cache authorization decisions
- gRPC vs ConnectRPC vs REST, and generating polyglot clients from one schema
- Service-to-service identity (mTLS vs signed tokens)