flowstate-identity Package Skill

Package: @epicdm/flowstate-identity Repository: flowstate-platform Path: packages/id Version: 0.1.0

Use this published Dojo skill as the package-level entrypoint. For detailed workflows, use the package-local skills listed below.

Primary Package Workflow

FlowState Identity OIDC Auth Workflow

Status: Active Purpose: Preserve identity security invariants while changing auth flows, routes, or schema. Scope: packages/id Trigger: OIDC/OAuth, auth route, RBAC/ACL, wallet login, session, tenant auth, or identity DB schema changes. Input: Target route or schema, expected auth context, tenant/org behavior, and test scenario. Output: Validated identity behavior with matching route/query tests.

Workflow

1. Identify the surface: OIDC routes live in src/app/authorize/route.ts, src/app/api/oauth/token/route.ts, and src/app/.well-known/*; admin/RBAC APIs live in src/app/auth/*; account APIs live in src/app/api/account/*.
2. Validate all request input with existing Zod schemas in src/lib/validation/* or add schemas there before parsing request data.
3. Preserve OIDC invariants: registered redirect URI validation, PKCE S256, one-time authorization code consumption, nonce propagation, RS256 signing, active JWK lookup, and refresh-token family revocation.
4. For tenant-aware protected routes, use requireAuth or requireAdmin from src/lib/auth/auth-middleware.ts. requireAdmin resolves identity user ID to tenant user ID before role lookup.
5. For DB changes, update src/db/schema.ts, query helpers in src/db/queries/*, and tests. Generate migrations only when schema changes are intended.
6. Check exported-schema consumers with rg "@epicdm/flowstate-identity/db/schema" packages --glob '!**/node_modules/**'.

Verification

• yarn workspace @epicdm/flowstate-identity test
• yarn workspace @epicdm/flowstate-identity typecheck
• For schema changes: yarn workspace @epicdm/flowstate-identity db:generate
• For deployment-sensitive changes: yarn workspace @epicdm/flowstate-identity build

Red Flags

Composition

• Use auth-client-oidc-pkce-workflow when changing consumer-side OIDC behavior.
• Use package-local marketplace/admin skills when exported schema changes affect those consumers.

Package Skill Inventory

Skill Inventory: @epicdm/flowstate-identity

Created Skills

Candidate Future Skills

Source Evidence

• README.md describes architecture, database tables, and security design.
• src/app/authorize/route.ts and src/app/api/oauth/token/route.ts implement core OAuth flow.
• src/lib/auth/auth-middleware.ts implements tenant-aware route authorization.
• src/db/schema.ts is the exported schema surface.
• src/__tests__/auth-*.test.ts, oidc-flow.integration.test.ts, wallet-*.test.ts, and DB query tests cover behavior.

Review Gate

Review: @epicdm/flowstate-identity Skills

Result: Pass for source-backed package-local workflow guidance.

Checks

• The skill is security-invariant driven rather than a generated route list.
• It cites route, schema, middleware, crypto, and test paths.
• It names safe and heavier verification commands separately.
• It avoids modifying API code, build outputs, generated .flowstate/dojo, .next, or .open-next.

Residual Risk

This package is large. Wallet auth and RBAC admin APIs should be split into their own skills before major feature work in those areas.

Start with this skill to understand the package purpose, then use the package-local focused skills for specific workflows. Keep this Dojo version aligned with packages/id/package.json. Do not treat generated feature lists as lessons; use workflow evidence from CODE-REVIEW.md, SKILL-INVENTORY.md, and REVIEW.md.