# onellan/tockrplatform architecture

> Architecture diagram of the GitHub repository onellan/tockrplatform, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/onellan/tockrplatform
- Repository: https://github.com/onellan/tockrplatform

## Overview

Tockr Platform is a shared authority for identity, tenancy, and product access. Its primary runtime flow is user sign-in and session-protected account and tenancy management, backed by SQLite; it also exposes signed read-authority snapshots and change feeds to consumers. A separate operator workflow turns normalized inventory into a report and signed manifest, then supports protected import operations. The README documents the authority boundaries; sampled source confirms server startup, session persistence, read-authority endpoints, and parts of the import path, but not every handler’s wiring.

Main entry points: [`internal/platform/http/server.go`](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/server.go) (HTTP handlers), [`internal/db/sqlite/store.go`](https://github.com/onellan/tockrplatform/blob/main/internal/db/sqlite/store.go) (SQLite persistence), [`internal/store/identity.go`](https://github.com/onellan/tockrplatform/blob/main/internal/store/identity.go) (Store interfaces), [`internal/platform/http/read_authority.go`](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/read_authority.go) (Read-authority API)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Platform runtime"]
  node_main["HTTP service<br/>[main.go]"]
  node_http["HTTP handlers<br/>[server.go]"]
  node_admin["Admin UI<br/>[admin_ui.go]"]
  node_platformui["Platform UI<br/>[platform_ui.go]"]
  node_templates["Web templates<br/>[auth_templ.go]"]
  node_store["Store interfaces<br/>[identity.go]"]
  node_sqlite[("SQLite persistence<br/>[store.go]")]
end

subgraph group_authority["Identity and access"]
  node_auth["Authentication and MFA<br/>[token.go]"]
  node_identity["Identity data<br/>[user.go]"]
  node_tenancy["Organisation and workspace<br/>[workspace.go]"]
  node_membership["Membership commands"]
  node_product["Product access<br/>[product_access.go]"]
  node_events["Audit and events<br/>[event.go]"]
  node_assertion["Access assertions<br/>[assertion.go]"]
end

subgraph group_read["Read authority"]
  node_rahttp["Read-authority API<br/>[read_authority.go]"]
  node_racontract["Read-authority contract<br/>[contract.go]"]
  node_snapshots["Snapshot persistence"]
  node_consumerapi["Consumer integration<br/>[consumer.go]"]
end

subgraph group_reconcile["Reconciliation"]
  node_reconcilecmd["Inventory proposal<br/>[main.go]"]
  node_reconcile["Reconciliation logic<br/>[reconciliation.go]"]
  node_manifestcmd["Manifest signing<br/>[main.go]"]
  node_importcmd["Protected import<br/>[main.go]"]
  node_production["Production reconciliation<br/>[production.go]"]
end

node_user(("Platform user"))
node_consumer(("Platform consumer"))
node_operator(("Operator"))

node_user -->|"submits requests"| node_http
node_main -->|"opens database"| node_sqlite
node_main -->|"starts server"| node_http
node_main -->|"configures issuer"| node_assertion
node_http -->|"validates credentials"| node_auth
node_http -->|"manages sessions"| node_store
node_http -->|"changes tenancy"| node_store
node_http -->|"checks access"| node_store
node_http -->|"renders pages"| node_templates
node_http -->|"dispatches admin routes"| node_admin
node_http -->|"dispatches platform routes"| node_platformui
node_membership -->|"submits commands"| node_store
node_store -->|"persists data"| node_sqlite
node_sqlite -->|"stores identities"| node_identity
node_sqlite -->|"stores tenancy"| node_tenancy
node_sqlite -->|"stores entitlements"| node_product
node_sqlite -->|"records events"| node_events
node_consumer -->|"requests snapshots"| node_rahttp
node_rahttp -->|"validates protocol"| node_racontract
node_rahttp -->|"reads snapshots"| node_store
node_rahttp -->|"reads changes"| node_store
node_store -->|"loads snapshot records"| node_snapshots
node_snapshots -->|"queries Platform data"| node_sqlite
node_consumerapi -.->|"verifies assertions"| node_assertion
node_operator -->|"provides inventory"| node_reconcilecmd
node_reconcilecmd -->|"builds report"| node_reconcile
node_operator -->|"approves manifest"| node_manifestcmd
node_manifestcmd -->|"builds and signs"| node_reconcile
node_operator -->|"requests operation"| node_importcmd
node_importcmd -->|"executes import"| node_production
node_production -->|"applies changes"| node_sqlite

click node_main "https://github.com/onellan/tockrplatform/blob/main/cmd/platform/main.go"
click node_http "https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/server.go"
click node_admin "https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/admin_ui.go"
click node_platformui "https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/platform_ui.go"
click node_templates "https://github.com/onellan/tockrplatform/blob/main/web/templates/auth_templ.go"
click node_auth "https://github.com/onellan/tockrplatform/blob/main/internal/auth/token.go"
click node_identity "https://github.com/onellan/tockrplatform/blob/main/internal/domain/user.go"
click node_tenancy "https://github.com/onellan/tockrplatform/blob/main/internal/domain/workspace.go"
click node_membership "https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/membership_command.go"
click node_product "https://github.com/onellan/tockrplatform/blob/main/internal/domain/product_access.go"
click node_events "https://github.com/onellan/tockrplatform/blob/main/internal/events/event.go"
click node_assertion "https://github.com/onellan/tockrplatform/blob/main/internal/platform/assertion/assertion.go"
click node_store "https://github.com/onellan/tockrplatform/blob/main/internal/store/identity.go"
click node_sqlite "https://github.com/onellan/tockrplatform/blob/main/internal/db/sqlite/store.go"
click node_rahttp "https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/read_authority.go"
click node_racontract "https://github.com/onellan/tockrplatform/blob/main/internal/platform/readauthority/contract.go"
click node_snapshots "https://github.com/onellan/tockrplatform/blob/main/internal/db/sqlite/platform_read_authority.go"
click node_consumerapi "https://github.com/onellan/tockrplatform/blob/main/internal/platform/assertion/consumer.go"
click node_reconcilecmd "https://github.com/onellan/tockrplatform/blob/main/cmd/platform-reconcile/main.go"
click node_reconcile "https://github.com/onellan/tockrplatform/blob/main/internal/platform/reconciliation/reconciliation.go"
click node_manifestcmd "https://github.com/onellan/tockrplatform/blob/main/cmd/platform-manifest/main.go"
click node_importcmd "https://github.com/onellan/tockrplatform/blob/main/cmd/platform-import/main.go"
click node_production "https://github.com/onellan/tockrplatform/blob/main/internal/platform/reconciliation/production.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_http,node_admin,node_platformui,node_templates,node_store,node_sqlite,node_user toneBlue
class node_auth,node_identity,node_tenancy,node_membership,node_product,node_events,node_assertion toneAmber
class node_rahttp,node_racontract,node_snapshots,node_consumerapi toneMint
class node_reconcilecmd,node_reconcile,node_manifestcmd,node_importcmd,node_production toneRose
class node_consumer,node_operator toneIndigo
```

## Components

### Platform runtime

- [HTTP service](https://github.com/onellan/tockrplatform/blob/main/cmd/platform/main.go): `cmd/platform/main.go`
- [HTTP handlers](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/server.go): `internal/platform/http/server.go`
- [Admin UI](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/admin_ui.go): `internal/platform/http/admin_ui.go`
- [Platform UI](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/platform_ui.go): `internal/platform/http/platform_ui.go`
- [Web templates](https://github.com/onellan/tockrplatform/blob/main/web/templates/auth_templ.go): `web/templates/auth_templ.go`
- [Store interfaces](https://github.com/onellan/tockrplatform/blob/main/internal/store/identity.go): `internal/store/identity.go`
- [SQLite persistence](https://github.com/onellan/tockrplatform/blob/main/internal/db/sqlite/store.go): `internal/db/sqlite/store.go`

### Identity and access

- [Authentication and MFA](https://github.com/onellan/tockrplatform/blob/main/internal/auth/token.go): `internal/auth/token.go`
- [Identity data](https://github.com/onellan/tockrplatform/blob/main/internal/domain/user.go): `internal/domain/user.go`
- [Organisation and workspace](https://github.com/onellan/tockrplatform/blob/main/internal/domain/workspace.go): `internal/domain/workspace.go`
- [Membership commands](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/membership_command.go): `internal/platform/http/membership_command.go`
- [Product access](https://github.com/onellan/tockrplatform/blob/main/internal/domain/product_access.go): `internal/domain/product_access.go`
- [Audit and events](https://github.com/onellan/tockrplatform/blob/main/internal/events/event.go): `internal/events/event.go`
- [Access assertions](https://github.com/onellan/tockrplatform/blob/main/internal/platform/assertion/assertion.go): `internal/platform/assertion/assertion.go`

### Read authority

- [Read-authority API](https://github.com/onellan/tockrplatform/blob/main/internal/platform/http/read_authority.go): `internal/platform/http/read_authority.go`
- [Read-authority contract](https://github.com/onellan/tockrplatform/blob/main/internal/platform/readauthority/contract.go): `internal/platform/readauthority/contract.go`
- [Snapshot persistence](https://github.com/onellan/tockrplatform/blob/main/internal/db/sqlite/platform_read_authority.go): `internal/db/sqlite/platform_read_authority.go`
- [Consumer integration](https://github.com/onellan/tockrplatform/blob/main/internal/platform/assertion/consumer.go): `internal/platform/assertion/consumer.go`

### Reconciliation

- [Inventory proposal](https://github.com/onellan/tockrplatform/blob/main/cmd/platform-reconcile/main.go): `cmd/platform-reconcile/main.go`
- [Reconciliation logic](https://github.com/onellan/tockrplatform/blob/main/internal/platform/reconciliation/reconciliation.go): `internal/platform/reconciliation/reconciliation.go`
- [Manifest signing](https://github.com/onellan/tockrplatform/blob/main/cmd/platform-manifest/main.go): `cmd/platform-manifest/main.go`
- [Protected import](https://github.com/onellan/tockrplatform/blob/main/cmd/platform-import/main.go): `cmd/platform-import/main.go`
- [Production reconciliation](https://github.com/onellan/tockrplatform/blob/main/internal/platform/reconciliation/production.go): `internal/platform/reconciliation/production.go`

### Other components

- **Platform user**
- **Platform consumer**
- **Operator**

## Connections

- Platform user → HTTP handlers: submits requests
- HTTP service → SQLite persistence: opens database
- HTTP service → HTTP handlers: starts server
- HTTP service → Access assertions: configures issuer
- HTTP handlers → Authentication and MFA: validates credentials
- HTTP handlers → Store interfaces: manages sessions
- HTTP handlers → Store interfaces: changes tenancy
- HTTP handlers → Store interfaces: checks access
- HTTP handlers → Web templates: renders pages
- HTTP handlers → Admin UI: dispatches admin routes
- HTTP handlers → Platform UI: dispatches platform routes
- Membership commands → Store interfaces: submits commands
- Store interfaces → SQLite persistence: persists data
- SQLite persistence → Identity data: stores identities
- SQLite persistence → Organisation and workspace: stores tenancy
- SQLite persistence → Product access: stores entitlements
- SQLite persistence → Audit and events: records events
- Platform consumer → Read-authority API: requests snapshots
- Read-authority API → Read-authority contract: validates protocol
- Read-authority API → Store interfaces: reads snapshots
- Read-authority API → Store interfaces: reads changes
- Store interfaces → Snapshot persistence: loads snapshot records
- Snapshot persistence → SQLite persistence: queries Platform data
- Consumer integration → Access assertions: verifies assertions
- Operator → Inventory proposal: provides inventory
- Inventory proposal → Reconciliation logic: builds report
- Operator → Manifest signing: approves manifest
- Manifest signing → Reconciliation logic: builds and signs
- Operator → Protected import: requests operation
- Protected import → Production reconciliation: executes import
- Production reconciliation → SQLite persistence: applies changes