Authentication & User Management for the Worktree Ecosystem

What it provides

• Issue, refresh, validate, and revoke JWT access/refresh tokens.
• Centralized user lifecycle: create, update, deactivate, and audit.
• Role/permission management with product scoping.
• Group management and external identity linking (Microsoft/Google).
• Consistent ApiResponse<T> contract for all endpoints.

Developer experience

• OpenAPI documentation available at /docs-ui/index.html.
• Stable versioned routes under /api/**.
• Structured error model with requestId correlation.
• Pagination, filtering, and idempotency where applicable.

• Stateless JWT validation; optional JWKs endpoint for key rotation.
• Tenant-aware throttling and per-tenant IP allow/deny evaluation.
• Minimal PII in logs; audit trails with redaction where needed.
• HSTS, TLS-only endpoints, and CSRF-safe patterns for browsers.

• Integration with Microsoft Entra ID and Google for SSO.
• JIT provisioning or scheduled group/user sync.
• Fine-grained role/feature mapping per product.
• Defensive defaults and safe error surfaces.

HRMS

Employee lifecycle, payroll, and attendance.

Workforce Productivity

Agent-based activity insights and coaching.

LMS

Courses, assignments, and analytics.

Projects

Tasks, sprints, and collaboration.