How biszdevelopers/basis-auth works
basis-auth is a Hono-based identity boundary: applications initiate OIDC authorization, users authenticate through Microsoft and may grant consent, and the service issues tokens for registered resource APIs. The React interface handles login and consent; PostgreSQL stores identity and protocol state. The graph includes the separate internal user API and key/session services. The README documents protocol capabilities not visible in the partial route excerpts; those are represented at the app-to-OAuth boundary rather than as unsupported individual calls.
Main entry points: app.ts HTTP application · service.ts OAuth service · identity.ts Identity service · index.ts Service assembly
Components 20
Service runtime
- Service assembly
src/index.ts - HTTP application
src/app.ts - Configuration
src/config.ts - Internal user API
src/internal/app.ts - Internal user service
src/internal/users.ts
OAuth and OIDC
- OAuth service
src/oauth/service.ts - Client cache
src/oauth/clientCache.ts - Signing keys
src/oauth/keys.ts - OAuth crypto
src/oauth/crypto.ts
Identity and sessions
- Identity service
src/identity.ts - Microsoft login
src/microsoft.ts - Session service
src/oauth/sessions.ts - Database schema
src/database/schema.ts
Login interface
- Login and consent UI
web/src/App.tsx - Login card
web/src/components/LoginCard.tsx
Other components
- Client application
- User browser
- Microsoft Entra
- Resource API
- PostgreSQL
Connections 30
- Client application → HTTP application: OIDC requests
- User browser → HTTP application: login and consent
- HTTP application → Login and consent UI: serves UI
- Login and consent UI → HTTP application: interaction requests
- Login and consent UI → Login card: renders
- Login card → HTTP application: login actions
- HTTP application → OAuth service: protocol operations
- HTTP application → Microsoft login: login and callback
- HTTP application → Session service: session lookups
- HTTP application → Identity service: identity lookups
- HTTP application → Signing keys: metadata and keys
- Microsoft login → Microsoft Entra: authenticates user
- Microsoft login → Identity service: updates identity
- OAuth service → Client cache: loads clients
- OAuth service → Identity service: identity and permissions
- OAuth service → Signing keys: issues tokens
- OAuth service → OAuth crypto: hashes and validates
- Signing keys → Resource API: publishes JWKS for validation
- Session service → OAuth crypto: hashes session tokens
- Service assembly → Configuration: loads settings
- Service assembly → HTTP application: assembles and serves
- Service assembly → Internal user API: serves separately
- Service assembly → PostgreSQL: migrates and seeds
- Internal user API → Internal user service: user operations
- Internal user service → Identity service: reads and patches users
- OAuth service → PostgreSQL: reads and writes protocol state
- Client cache → PostgreSQL: loads client records
- Identity service → PostgreSQL: reads and writes identities
- Microsoft login → PostgreSQL: stores identity data
- Session service → PostgreSQL: stores sessions