internal/

Package auth handles credentials and tokens: hashing passwords, issuing and verifying JWTs, and the middleware that turns a token into an authenticated principal.

Package casp serves the CAS protocol.

Package config loads runtime configuration from environment variables.

Package demo fills one already-created tenant with data that looks like a company of that kind has been using it.

Package directory reads accounts out of an LDAP directory.

Package docs serves the manual from inside the binary, so the pages an operator reads are necessarily the pages for the version they are running.

Package handler contains the HTTP handlers.

Package httpx implements the wire format described in docs/api-conventions.md: a {code, message, data} envelope, with the HTTP status and the envelope code always agreeing on success vs failure.

Package i18n holds the text Portico sends rather than displays.

Package mailfmt describes a transactional email once and renders it twice: as plain text, and as the HTML that most people will actually see.

Package metrics exposes what an operator needs to answer "is this instance healthy, and is anybody failing to sign in".

Package model holds the domain types shared by the service and HTTP layers.

Package notify delivers messages to a person, over whichever channels the deployment has configured.

Package oidcp adapts Portico to the OpenID Provider interface that zitadel/oidc drives.

Package oidcrp signs people in through somebody else's OpenID Provider.

Package provision performs the operations available from the command line.

Package samlp adapts Portico to the SAML 2.0 Identity Provider role.

Package scim implements SCIM 2.0 provisioning (RFC 7643, RFC 7644) for user accounts.

Package secrets encrypts the few credentials this server has to store and later use, as opposed to the many it only has to verify.

Package seed fills a development database with data that looks like a deployment somebody has been using for three months.

Package server wires configuration, storage, and HTTP routing together.

Package service holds the business logic that sits between the HTTP handlers and the store.

Package socialrp signs people in through providers that are not OpenID Connect.

Package store owns database access: opening the pool, running migrations, and the query layer generated by sqlc.

Package testdb gives tests a real PostgreSQL database.

Package web serves the built single-page application from inside the binary, so deploying Portico means copying one file.

Package webhook delivers events to endpoints a tenant administrator registers.