Core Platform
•
Specification
Identity & Tenancy
Multi-tenant identity boundaries, user lifecycle, and authentication.
The Identity module acts as the core tenant boundary within the Alegor Platform. It manages organizations, nested workspaces, team memberships, and credentials without coupling business domains directly to authentication providers.
Capabilities
Core Functional Capabilities
✓
Multi-tenant and organization workspace isolation
✓
Passwordless, email magic link, and credential authentication
✓
OAuth2 / OIDC and enterprise SSO federation hooks
✓
Multi-Factor Authentication (TOTP / Hardware WebAuthn)
✓
API Token issuance with granular scope and IP restrictions
✓
Session revocation and cross-device session tracking
Contracts
Public Interface Contracts
Other modules and domain action classes interact exclusively via these typed PHP contracts.
interface
IdentityManagerInterface
interface
TenantResolverInterface
interface
TokenIssuerInterface
interface
OrganizationRepositoryInterface
Reactivity
Dispatched Domain Events
Dispatched upon state mutation for downstream audit recording, webhook firing, and asynchronous notifications.
⚡
TenantCreated
⚡
UserAuthenticated
⚡
UserPasswordResetRequested
⚡
SessionTerminated
⚡
OrganizationMemberInvited
Customization
Extension Points
- • Custom SSO / SAML provider adapters
- • Custom tenant resolution strategies (subdomain, header, path, JWT claim)
- • User profile attribute extensions and custom claim mappers
🛡 Security & Isolation
- • Bcrypt/Argon2id password hashing with automatic rehash
- • Strict tenant query scoping enforced at repository level
- • Zero tenant data cross-contamination with automated test assertions
Core Entities & Models
- Organization (Tenant root, slug, plan, status, settings)
- User (Email, credentials, active status, MFA config)
- Membership (User-Organization pivot, role binding)
- ApiToken (Hashed token, scopes, expiry, last_used_at)
Explore Other Platform Modules
Permissions & Authorization
Hierarchical RBAC, contextual ABAC, and explicit resource policies.
Documents & Storage
S3-compatible asset pipeline, metadata indexing, and access-controlled streaming.
Audit & Compliance Logging
Append-only immutable event streams for compliance and forensic analysis.
Workflows & State Machines
Deterministic state machine engine with visual transitions and guard conditions.
Notifications & Messaging
Omni-channel delivery engine across Email, SMS, Webhooks, Push, and In-App.
Integrations & Webhooks
Bi-directional webhook engine, REST API gateway, and external sync pipeline.
Reporting & Aggregation
High-performance analytical queries, export queues, and scheduled summaries.