apiplant-auth
Authentication primitives, independent of HTTP so they can be unit-tested in isolation:
- [
Authenticator] — password hashing (argon2), JWT session tokens, and API-key generation/hashing. - [
Principal] — the resolved caller identity, including the organisations they belong to and their role within each (roles are per-organisation).
Authorization itself (mapping a resource's Access
policy plus org context to a decision) lives in the server, where the active
organisation and resource schema are known.