# Module: Nexus Identity

**Placering:** `source/nexus-identity/`  
**Fase:** 3  
**Type:** Cloud service (hostet i Control Center)

---

## Funktioner

- Brugerregistrering, -styring og -sletning (GDPR-compliant)
- Roller og permissions (RBAC)
- OAuth2/OIDC authentication provider
- MFA: TOTP, backup codes, FIDO2 (fasevis)
- Session management og revoke
- Password policies og reset flows
- Federation med AD/Azure AD (Fase 8)

---

## Ansvar

| Ansvar | Ejer |
|--------|------|
| Autentificering af brugere | Identity |
| Autorisering (permissions) | Identity |
| MFA enrollment og verification | Identity |
| Token udstedelse (JWT) | Identity |
| Bruger-enhed binding | Identity + Device Mgmt |

---

## Datamodel

```
User
├── id: UUID (PK)
├── email: string (unique)
├── display_name: string
├── password_hash: string (Argon2id)
├── mfa_enabled: boolean
├── mfa_secret: string (encrypted)
├── status: active|disabled|locked
├── organization_id: UUID (FK)
├── created_at, updated_at: timestamp

Role
├── id: UUID (PK)
├── name: string (unique per tenant)
├── permissions: string[] (JSON array)
├── is_system: boolean

UserRole
├── user_id: UUID (FK)
├── role_id: UUID (FK)

Session
├── id: UUID (PK)
├── user_id: UUID (FK)
├── device_id: UUID (FK, nullable)
├── refresh_token_hash: string
├── ip_address: string
├── created_at, expires_at: timestamp
├── revoked: boolean

MfaBackupCode
├── user_id: UUID (FK)
├── code_hash: string
├── used: boolean
```

---

## Afhængigheder

| Afhænger af | Hvorfor |
|-------------|---------|
| Control Center | Hosting, API gateway |
| PostgreSQL | Persistent storage |

| Afhænges af af | Hvorfor |
|----------------|---------|
| Nexus Shell | Login, MFA UI |
| Control Center Admin | Brugerstyring |
| Remote Support | Session auth |
| Device Management | Bruger-enhed binding |

---

*Se: [security/MFA_STRATEGY.md](../security/MFA_STRATEGY.md) · [security/PERMISSION_SYSTEM.md](../security/PERMISSION_SYSTEM.md)*
