Identity, Access & Tenant Trust
oauth
Your own OIDC identity provider — "Sign in with Nebutra" for third-party apps. Authorization code + PKCE, refresh-token rotation, consent, clients stored in Postgres.
third-party app · ‘Acme CI’
Requested scopes:
read:projectswrite:deploymentsadmin:billing
Token JWT · 1h TTL
More in nebutra.com
- auditHash-chained, SHA-256 append-only audit log for actor/tenant actions. SOC 2-grade tamper detection, streaming export, and replay-safe queries.
- authBetter Auth on Postgres — organization membership, device-flow login, MFA-enforced, session HMAC-signed. One identity layer, no vendor in the loop.
- captchaBot challenge with Cloudflare Turnstile / hCaptcha / reCAPTCHA behind one verify() call. Server-side scoring, per-route enable, no third-party tracker on the client.
- identityShared actor primitive — usr_/svc_/api_ ID space, role/membership lookup, tenant attachment. The single identity object every iam package reads.
- permissionsRBAC + ABAC engine — CASL for in-process checks. defineAbility() server, <Can /> in React.
- tenantRequest-scoped tenant context via AsyncLocalStorage, with Prisma RLS bridge. One tenantId resolves through middleware and propagates the whole stack.