devfactory-core-auth

Identity & RBAC microservice for Dev Factory. Auth is always Microsoft Entra.

C# · 9 arquivos MSBuild · 2 arquivos Markdown · 1 arquivos JSON · 1 arquivos 14 arquivos

Endpoints HTTP 32

Método	Rota	Arquivo
GET	`/`	Program.cs
GET	`/health`	Program.cs
GET	`/.metadata`	Program.cs
POST	`/environments/{envId}/apps`	IdentityEndpoints.cs
GET	`/apps/{appId}`	IdentityEndpoints.cs
GET	`/`	IdentityEndpoints.cs
GET	`/{id}`	IdentityEndpoints.cs
PATCH	`/{id}`	IdentityEndpoints.cs
GET	`/catalog`	RbacEndpoints.cs
GET	`/subject`	RbacEndpoints.cs
GET	`/platform-membership`	RbacEndpoints.cs
GET	`/platform-members`	RbacEndpoints.cs
GET	`/bindings`	RbacEndpoints.cs
GET	`/group-bindings`	RbacEndpoints.cs
PUT	`/group-bindings`	RbacEndpoints.cs
DELETE	`/group-bindings`	RbacEndpoints.cs
PUT	`/bindings`	RbacEndpoints.cs
DELETE	`/bindings`	RbacEndpoints.cs
GET	`/v1/authorize`	RbacEndpoints.cs
GET	`/`	RbacEndpoints.cs
GET	`/{groupId}`	RbacEndpoints.cs
POST	`/`	RbacEndpoints.cs
DELETE	`/{groupId}`	RbacEndpoints.cs
GET	`/{groupId}/members`	RbacEndpoints.cs
POST	`/{groupId}/members`	RbacEndpoints.cs
DELETE	`/{groupId}/members/{memberId}`	RbacEndpoints.cs
GET	`/v1/entra/users/{user}`	RbacEndpoints.cs
POST	`/v1/entra/users/batch`	RbacEndpoints.cs
GET	`/v1/entra/users/{user}/member-groups`	RbacEndpoints.cs
POST	`/v1/entra/apps/{appId}/assignment`	RbacEndpoints.cs
DELETE	`/v1/entra/apps/{appId}/assignment/{groupId}`	RbacEndpoints.cs
DELETE	`/v1/entra/apps/{appId}`	RbacEndpoints.cs

📁 src/8 arquivos

📁 DevFactory.ApisAuth/

📁 tests/4 arquivos

📁 DevFactory.ApisAuth.Tests/

· .gitignore

· README.md

Identity & RBAC microservice for Dev Factory. Auth is always Microsoft Entra.

Identity — automates one Entra App Registration per app per environment in Dev Factory's

tenant via Microsoft Graph (POST /applications, app-only token with Application.ReadWrite.All), storing the client secret in Secrets Manager.

RBAC — project-scoped roles → permissions and subject→role bindings, with an /authorize

check. Roles map to Entra App Roles / groups.

C# / ASP.NET Core (net10), container via dotnet publish -t:PublishContainer → ECR, listens on :8080.

Runs and is fully explorable today. Set these to go live (then wire the marked TODO(live)):

Env	Purpose
`GRAPH_TENANT_ID` / `GRAPH_CLIENT_ID` / `GRAPH_CLIENT_SECRET`	App-only Graph token to create App Registrations

POST /v1/projects/{projectId}/environments/{envId}/apps — register an app's Entra identity
GET /v1/projects/{projectId}/apps/{appId}
POST /v1/projects/{projectId}/rbac/roles · GET .../roles
POST /v1/projects/{projectId}/rbac/assignments
GET /v1/projects/{projectId}/rbac/authorize?subject=&permission=
GET /health

Part of the devfactory platform; see its docs/devfactory-arquitetura-baas-apis.md.