rastrillo / idear Public

Download this file

1	# idear
2
3	Roles and membership for a [Rastrillo](https://rastrillo.org) app: who is in
4	this instance, at what rank, and who may change that.
5
6	Owner / Admin / Member, exactly one Owner at all times. Invitations that are
7	single-use, expiring, and stored only as a digest. A membership gate that
8	answers a non-member and a removed member identically. Removal that is a
9	deactivation and never a delete, so nothing in your tables dangles.
10
11	```sh
12	go get amadan.net/rastrillo/idear
13	```
14
15	No `replace` directive: idear is fetched by path like any other module.
16
17	## What it is not
18
19	It does not mint sessions, hash passwords, or render a sign-in form — it
20	sits on top of `rastrillo/sessions` and whichever identity plugin the app
21	already chose, `password` or `auth` (keymail). Pick one, not both.
22
23	It does not do tenancy. A CARLOS app serves one team per instance;
24	separating teams is the platform's process-and-file boundary, not a `WHERE`
25	clause. idear decides who may do what *inside* one instance.
26
27	It does not own your pages. Rendering goes through callbacks you supply, the
28	way `password.Config.RenderSignin` does.
29
30	## Where to start
31
32	**[`SKILL.md`](SKILL.md)** is the authoring doc — read it instead of the
33	source. It carries the wiring, the route table, the two identity adapters,
34	the security discipline, and the traps that are silent when you get them
35	wrong. Once `go get` has fetched the module, it's already on disk: an
36	agent can read it straight out of the module cache, pinned to the exact
37	version the app resolved (no URL to drift from the code it documents):
38
39	```sh
40	cat "$(go list -m -f '{{.Dir}}' amadan.net/rastrillo/idear)/SKILL.md"
41	```
42
43	**[`example/`](example/)** is a complete working app on rastrillo + idear,
44	and `example/app_test.go` drives the whole flow — sign up, claim, invite,
45	accept, members page, role change — through real HTTP.
46