Identity
There is no standalone identity server. The control plane at my.hitsol.net holds the accounts and the roles, and every other service asks it rather than deciding for itself.
People
Section titled “People”Sign in at my.hitsol.net/admin. You arrive at
other services carrying the control plane’s session cookie; each one verifies
that session against /api/users/me on the control plane. No service
re-implements the decision, so the roles written once govern everywhere.
Machines
Section titled “Machines”An encoder, a bridge, or a cron job cannot hold a browser session. Those carry a token instead. Only the SHA-256 of a token is stored — never the plaintext — so a leaked store does not yield working credentials.
Three predicates, mirroring the control plane exactly:
| Predicate | Admits |
|---|---|
isAdmin |
admin |
isStaff |
admin, staff |
isBilling |
admin, staff, billing |
A service that invents its own definition drifts from the rules that actually govern the data, so it picks one of these rather than redefining a name.