# tg11-org/tg11accounts architecture

> Architecture diagram of the GitHub repository tg11-org/tg11accounts, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/tg11-org/tg11accounts
- Repository: https://github.com/tg11-org/tg11accounts

## Overview

TG11 Accounts is an identity provider for the TG11/VulpFin ecosystem. A person registers or signs in through the account web app; its account and MFA logic maintains identity and sessions, then the OIDC provider handles client authorization, consent, and token issuance. The account hub also manages profiles, linked applications, entitlements, payments, and encrypted credentials. A separate Django package acts as a relying party: it starts OIDC login, validates the callback, and links the TG11 identity to a local account. Edges reflect README statements and source-index references; unsampled subsystem details and some runtime wiring are not asserted.

Main entry points: [`tg11/web.py`](https://github.com/tg11-org/tg11accounts/blob/master/tg11/web.py) (Account web app), [`tg11/profile.py`](https://github.com/tg11-org/tg11accounts/blob/master/tg11/profile.py) (Profile and account APIs), [`tg11/accounts.py`](https://github.com/tg11-org/tg11accounts/blob/master/tg11/accounts.py) (Accounts and sessions), [`tg11/models.py`](https://github.com/tg11-org/tg11accounts/blob/master/tg11/models.py) (Identity database)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_identity["Identity and sessions"]
  node_web["Account web app<br/>[web.py]"]
  node_accounts["Accounts and sessions<br/>[accounts.py]"]
  node_mfa["Multi-factor auth<br/>[mfa.py]"]
  node_identity_db[("Identity database<br/>[models.py]")]
end

subgraph group_oidc["OIDC provider"]
  node_oidc["OIDC provider core<br/>[oidc.py]"]
end

subgraph group_account_hub["Account hub"]
  node_profile["Profile and account APIs<br/>[profile.py]"]
end

subgraph group_support["Account capabilities"]
  node_entitlements["Entitlements and credits<br/>[entitlements.py]"]
  node_payments["Payments<br/>[payments.py]"]
  node_vault["Credential vault<br/>[vault.py]"]
  node_crypto["Cryptography<br/>[crypto.py]"]
  node_sms["SMS verification<br/>[sms.py]"]
end

subgraph group_django_rp["Django relying party"]
  node_django_views["Django login views<br/>[views.py]"]
  node_django_client["OIDC relying-party client<br/>[client.py]"]
  node_django_linking["Local identity linking<br/>[services.py]"]
  node_django_db[("Django identity links<br/>[models.py]")]
end

node_person(("Person"))
node_client_apps(("OIDC client apps"))
node_smtp["SMTP mail service"]
node_twilio["Twilio SMS"]
node_payment_providers["Payment providers"]

node_person -->|"uses account pages"| node_web
node_web -->|"handles sign-in"| node_accounts
node_web -->|"uses MFA"| node_mfa
node_web -->|"serves OIDC"| node_oidc
node_web -->|"mounts account hub"| node_profile
node_accounts -->|"manages identity state"| node_identity_db
node_web -->|"loads user sessions"| node_identity_db
node_mfa -->|"stores factor state"| node_identity_db
node_mfa -->|"uses cryptography"| node_crypto
node_oidc -->|"issues and validates tokens"| node_identity_db
node_client_apps -->|"requests authorization"| node_web
node_profile -->|"uses account services"| node_accounts
node_profile -->|"uses entitlement rules"| node_entitlements
node_profile -->|"manages wallet"| node_payments
node_profile -->|"manages credentials"| node_vault
node_profile -->|"uses SMS verification"| node_sms
node_vault -->|"encrypts credentials"| node_crypto
node_payments -->|"integrates providers"| node_payment_providers
node_sms -.->|"sends messages"| node_twilio
node_person -->|"starts app login"| node_django_views
node_django_views -->|"starts and exchanges flow"| node_django_client
node_django_views -->|"maps validated claims"| node_django_linking
node_django_linking -->|"creates identity link"| node_django_db
node_django_client -->|"performs OIDC requests"| node_client_apps
node_accounts -.->|"sends account mail"| node_smtp

click node_web "https://github.com/tg11-org/tg11accounts/blob/master/tg11/web.py"
click node_accounts "https://github.com/tg11-org/tg11accounts/blob/master/tg11/accounts.py"
click node_mfa "https://github.com/tg11-org/tg11accounts/blob/master/tg11/mfa.py"
click node_identity_db "https://github.com/tg11-org/tg11accounts/blob/master/tg11/models.py"
click node_oidc "https://github.com/tg11-org/tg11accounts/blob/master/tg11/oidc.py"
click node_profile "https://github.com/tg11-org/tg11accounts/blob/master/tg11/profile.py"
click node_entitlements "https://github.com/tg11-org/tg11accounts/blob/master/tg11/entitlements.py"
click node_payments "https://github.com/tg11-org/tg11accounts/blob/master/tg11/payments.py"
click node_vault "https://github.com/tg11-org/tg11accounts/blob/master/tg11/vault.py"
click node_crypto "https://github.com/tg11-org/tg11accounts/blob/master/tg11/crypto.py"
click node_sms "https://github.com/tg11-org/tg11accounts/blob/master/tg11/sms.py"
click node_django_views "https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/views.py"
click node_django_client "https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/client.py"
click node_django_linking "https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/services.py"
click node_django_db "https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/models.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web,node_accounts,node_mfa,node_identity_db,node_client_apps toneBlue
class node_oidc toneAmber
class node_profile toneMint
class node_entitlements,node_payments,node_vault,node_crypto,node_sms toneRose
class node_django_views,node_django_client,node_django_linking,node_django_db,node_person,node_smtp,node_twilio,node_payment_providers toneIndigo
```

## Components

### Identity and sessions

- [Account web app](https://github.com/tg11-org/tg11accounts/blob/master/tg11/web.py): `tg11/web.py`
- [Accounts and sessions](https://github.com/tg11-org/tg11accounts/blob/master/tg11/accounts.py): `tg11/accounts.py`
- [Multi-factor auth](https://github.com/tg11-org/tg11accounts/blob/master/tg11/mfa.py): `tg11/mfa.py`
- [Identity database](https://github.com/tg11-org/tg11accounts/blob/master/tg11/models.py): `tg11/models.py`

### OIDC provider

- [OIDC provider core](https://github.com/tg11-org/tg11accounts/blob/master/tg11/oidc.py): `tg11/oidc.py`

### Account hub

- [Profile and account APIs](https://github.com/tg11-org/tg11accounts/blob/master/tg11/profile.py): `tg11/profile.py`

### Account capabilities

- [Entitlements and credits](https://github.com/tg11-org/tg11accounts/blob/master/tg11/entitlements.py): `tg11/entitlements.py`
- [Payments](https://github.com/tg11-org/tg11accounts/blob/master/tg11/payments.py): `tg11/payments.py`
- [Credential vault](https://github.com/tg11-org/tg11accounts/blob/master/tg11/vault.py): `tg11/vault.py`
- [Cryptography](https://github.com/tg11-org/tg11accounts/blob/master/tg11/crypto.py): `tg11/crypto.py`
- [SMS verification](https://github.com/tg11-org/tg11accounts/blob/master/tg11/sms.py): `tg11/sms.py`

### Django relying party

- [Django login views](https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/views.py): `clients/django/tg11_auth/views.py`
- [OIDC relying-party client](https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/client.py): `clients/django/tg11_auth/client.py`
- [Local identity linking](https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/services.py): `clients/django/tg11_auth/services.py`
- [Django identity links](https://github.com/tg11-org/tg11accounts/blob/master/clients/django/tg11_auth/models.py): `clients/django/tg11_auth/models.py`

### Other components

- **Person**
- **OIDC client apps**
- **SMTP mail service**
- **Twilio SMS**
- **Payment providers**

## Connections

- Person → Account web app: uses account pages (evidence: `README.md`)
- Account web app → Accounts and sessions: handles sign-in (evidence: `tg11/web.py`)
- Account web app → Multi-factor auth: uses MFA (evidence: `tg11/web.py`)
- Account web app → OIDC provider core: serves OIDC (evidence: `tg11/web.py`)
- Account web app → Profile and account APIs: mounts account hub (evidence: `tg11/web.py`)
- Accounts and sessions → Identity database: manages identity state (evidence: `tg11/accounts.py`)
- Account web app → Identity database: loads user sessions (evidence: `tg11/web.py`)
- Multi-factor auth → Identity database: stores factor state (evidence: `tg11/mfa.py`)
- Multi-factor auth → Cryptography: uses cryptography (evidence: `tg11/mfa.py`)
- OIDC provider core → Identity database: issues and validates tokens (evidence: `tg11/oidc.py`)
- OIDC client apps → Account web app: requests authorization (evidence: `README.md`)
- Profile and account APIs → Accounts and sessions: uses account services (evidence: `tg11/profile.py`)
- Profile and account APIs → Entitlements and credits: uses entitlement rules (evidence: `tg11/profile.py`)
- Profile and account APIs → Payments: manages wallet (evidence: `tg11/profile.py`)
- Profile and account APIs → Credential vault: manages credentials (evidence: `tg11/profile.py`)
- Profile and account APIs → SMS verification: uses SMS verification (evidence: `tg11/profile.py`)
- Credential vault → Cryptography: encrypts credentials (evidence: `tg11/vault.py`)
- Payments → Payment providers: integrates providers (evidence: `README.md`)
- SMS verification → Twilio SMS: sends messages
- Person → Django login views: starts app login (evidence: `README.md`)
- Django login views → OIDC relying-party client: starts and exchanges flow (evidence: `clients/django/tg11_auth/views.py`)
- Django login views → Local identity linking: maps validated claims (evidence: `clients/django/tg11_auth/views.py`)
- Local identity linking → Django identity links: creates identity link (evidence: `clients/django/tg11_auth/services.py`)
- OIDC relying-party client → OIDC client apps: performs OIDC requests (evidence: `README.md`)
- Accounts and sessions → SMTP mail service: sends account mail