- Architecture Overview
- API Endpoints
- JWT and JWKS Implementation
- Database Design
- Email Integration
- RBAC Considerations
The authentication service is designed as a RESTful API using Go. It implements JWT-based authentication with JWKS for public key distribution. The service uses a hybrid database approach with PostgreSQL as the primary database and Redis for caching and high-performance operations.
- Use RS256 (RSA Signature with SHA-256)
- Includes standard claims:
iss
,sub
,exp
,iat
- custom claims can be added in future:
roles
,permissions
- Access tokens: 15-30 minutes
- Refresh tokens: Longer lived (e.g., 7 days)
- Rotate keys periodically (e.g., every 24 hours)
- Keep old keys valid for a grace period
- caching mechanism for JWKS
CREATE TABLE users (
id UUID PRIMARY KEY,
email VARCHAR(255) UNIQUE NOT NULL,
password_hash VARCHAR(255) NOT NULL,
created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
last_login TIMESTAMP WITH TIME ZONE,
is_active BOOLEAN DEFAULT true,
email_verified BOOLEAN DEFAULT false,
verification_token VARCHAR(255),
verification_token_expiry TIMESTAMP WITH TIME ZONE,
password_reset_token VARCHAR(255),
password_reset_token_expiry TIMESTAMP WITH TIME ZONE,
metadata JSONB
);
CREATE TABLE roles (
id SERIAL PRIMARY KEY,
name VARCHAR(50) UNIQUE NOT NULL,
description TEXT,
created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
);
CREATE TABLE permissions (
id SERIAL PRIMARY KEY,
name VARCHAR(50) UNIQUE NOT NULL,
description TEXT,
created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
);
- relationships between user, roles and permission is maintained through edges
- ent.io is used as an ORM for this
type EmailService interface {
SendVerificationEmail(to string, verificationLink string) error
SendPasswordResetEmail(to string, resetLink string) error
SendWelcomeEmail(to string, username string) error
}
type EmailProvider interface {
Send(email Email) error
}
type Email struct {
To string
From string
Subject string
Body string
}
type sendGridProvider struct {
client *sendgrid.Client
}
func (s *sendGridProvider) Send(email Email) error {
message := sendgrid.NewSingleEmail(
sendgrid.NewEmail(email.From, email.From),
email.Subject,
sendgrid.NewEmail(email.To, email.To),
email.Body,
email.Body,
)
_, err := s.client.Send(message)
return err
}
- Signup Verification
- Password Reset
Implement these flows in the respective API endpoints, generating tokens and sending emails as needed.
While not initially implemented, design the system to easily incorporate RBAC later:
- Use the roles and permissions tables defined in the database schema
- Implement middleware to check roles/permissions from JWT claims
- Design API endpoints for role and permission management (to be implemented later)