feat(w2): auth core entities + Google OAuth + JWT + NextAuth bridge

Extracted from InspectFlow Sprint 14.1-14.2, repackaged to de.platesoft.auth.*:
- Entities: User, UserIdentity, Membership, Invitation, AccessRequest, LoginEvent, RefreshToken
- Enums: Role, OrgType, MembershipRole, MembershipStatus, InvitationStatus, AccessRequestStatus, LoginProvider
- Services: JwtService, ExchangeService, MembershipService, LoginEventService
- Filter: JwtAuthenticationFilter
- Controller: OAuthController (POST /api/auth/exchange)
- Config: PlateAuthAutoConfiguration, PlateAuthProperties (plate.auth.* namespace)
- Repositories: all auth-related JPA repositories
- SPI: OrgValidator, OrgDisplayNameResolver, InvitationMailer, AccessRequestMailer, OnboardingHook
- SPI defaults: PermissiveOrgValidator (WARN per call), LoggingInvitationMailer,
  LoggingAccessRequestMailer, DefaultOrgDisplayNameResolver, NoOpOnboardingHook
- DTOs: ExchangePayload, TokenResponse
- Security: BCrypt encoder, stateless session, CORS from PlateAuthProperties
- META-INF/spring AutoConfiguration.imports registered

All @Value refs replaced with PlateAuthProperties injection.
No references to de.platesoft.inspectflow.* remain.

plate-auth-starter/pom.xml

@@ -41,6 +41,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-mail</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+        </dependency>
 
         <!-- Hibernate Envers (Audit) -->
         <dependency>

plate-auth-starter/src/main/java/de/platesoft/auth/PlateAuthAutoConfiguration.java

@@ -0,0 +1,117 @@
+package de.platesoft.auth;
+
+import de.platesoft.auth.filter.JwtAuthenticationFilter;
+import de.platesoft.auth.service.JwtService;
+import de.platesoft.auth.spi.*;
+import de.platesoft.auth.spi.defaults.*;
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import org.springframework.scheduling.annotation.EnableAsync;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.List;
+
+@AutoConfiguration
+@EnableConfigurationProperties(PlateAuthProperties.class)
+@ComponentScan(basePackages = "de.platesoft.auth")
+@EnableJpaRepositories(basePackages = "de.platesoft.auth.repository")
+@EnableAsync
+@ConditionalOnProperty(prefix = "plate.auth", name = "enabled", havingValue = "true", matchIfMissing = true)
+public class PlateAuthAutoConfiguration {
+
+    // ── SPI defaults ─────────────────────────────────────────────────────────
+
+    @Bean
+    @ConditionalOnMissingBean(OrgValidator.class)
+    public OrgValidator orgValidator() {
+        return new PermissiveOrgValidator();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean(OrgDisplayNameResolver.class)
+    public OrgDisplayNameResolver orgDisplayNameResolver() {
+        return new DefaultOrgDisplayNameResolver();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean(InvitationMailer.class)
+    public InvitationMailer invitationMailer() {
+        return new LoggingInvitationMailer();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean(AccessRequestMailer.class)
+    public AccessRequestMailer accessRequestMailer() {
+        return new LoggingAccessRequestMailer();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean(OnboardingHook.class)
+    public OnboardingHook onboardingHook() {
+        return new NoOpOnboardingHook();
+    }
+
+    // ── Security ─────────────────────────────────────────────────────────────
+
+    @Bean
+    @ConditionalOnMissingBean(PasswordEncoder.class)
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    @Bean
+    public JwtAuthenticationFilter jwtAuthenticationFilter(JwtService jwtService) {
+        return new JwtAuthenticationFilter(jwtService);
+    }
+
+    @Bean
+    public SecurityFilterChain plateAuthSecurityFilterChain(
+            HttpSecurity http,
+            JwtAuthenticationFilter jwtFilter,
+            PlateAuthProperties props) throws Exception {
+        http
+            .csrf(AbstractHttpConfigurer::disable)
+            .cors(cors -> cors.configurationSource(corsConfigurationSource(props)))
+            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+            .authorizeHttpRequests(auth -> auth
+                .requestMatchers(
+                    "/api/auth/exchange",
+                    "/api/auth/login",
+                    "/api/auth/register",
+                    "/api/auth/refresh",
+                    "/api/auth/config",
+                    "/actuator/health"
+                ).permitAll()
+                .requestMatchers("/api/admin/**").hasAuthority("ROLE_ADMIN")
+                .anyRequest().authenticated()
+            )
+            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
+        return http.build();
+    }
+
+    private CorsConfigurationSource corsConfigurationSource(PlateAuthProperties props) {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowedOrigins(props.getCors().getAllowedOrigins());
+        config.setAllowedMethods(List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
+        config.setAllowedHeaders(List.of("*"));
+        config.setAllowCredentials(true);
+        config.setMaxAge(3600L);
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return source;
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/PlateAuthProperties.java

@@ -0,0 +1,73 @@
+package de.platesoft.auth;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.validation.annotation.Validated;
+
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.List;
+
+@ConfigurationProperties(prefix = "plate.auth")
+@Validated
+@Data
+public class PlateAuthProperties {
+
+    private Jwt jwt = new Jwt();
+    private Exchange exchange = new Exchange();
+    private Registration registration = new Registration();
+    private Cors cors = new Cors();
+    private Providers providers = new Providers();
+
+    @Data
+    public static class Jwt {
+        @NotBlank
+        @Size(min = 32, message = "JWT secret must be at least 32 characters")
+        private String secret;
+        private Duration accessExpiration = Duration.ofMinutes(15);
+        private Duration refreshExpiration = Duration.ofDays(30);
+        private String issuer = "plate-auth";
+    }
+
+    @Data
+    public static class Exchange {
+        @NotBlank
+        @Size(min = 32, message = "Exchange secret must be at least 32 characters")
+        private String secret;
+        private Duration maxAge = Duration.ofSeconds(60);
+        private Duration nonceTtl = Duration.ofMinutes(5);
+    }
+
+    @Data
+    public static class Registration {
+        private boolean enabled = false;
+    }
+
+    @Data
+    public static class Cors {
+        private List<String> allowedOrigins = new ArrayList<>();
+        private List<String> additionalPermitPaths = new ArrayList<>();
+    }
+
+    @Data
+    public static class Providers {
+        private ProviderToggle google = new ProviderToggle(true);
+        private ProviderToggle microsoft = new ProviderToggle(false);
+        private ProviderToggle emailMagicLink = new ProviderToggle(false);
+    }
+
+    @Data
+    public static class ProviderToggle {
+        private boolean enabled;
+
+        public ProviderToggle() {
+            this.enabled = false;
+        }
+
+        public ProviderToggle(boolean enabled) {
+            this.enabled = enabled;
+        }
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/controller/OAuthController.java

@@ -0,0 +1,27 @@
+package de.platesoft.auth.controller;
+
+import de.platesoft.auth.dto.TokenResponse;
+import de.platesoft.auth.service.ExchangeService;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequestMapping("/api/auth/exchange")
+@RequiredArgsConstructor
+public class OAuthController {
+
+    private final ExchangeService exchangeService;
+
+    @PostMapping
+    public ResponseEntity<TokenResponse> exchange(
+            @RequestBody String body,
+            @RequestHeader(value = "X-Exchange-Signature", required = false) String signature,
+            HttpServletRequest request) {
+        String ip = request.getRemoteAddr();
+        String ua = request.getHeader("User-Agent");
+        TokenResponse tokens = exchangeService.verifyAndExchange(body, signature, ip, ua);
+        return ResponseEntity.ok(tokens);
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/dto/ExchangePayload.java

@@ -0,0 +1,17 @@
+package de.platesoft.auth.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+/**
+ * Payload of the HMAC-signed exchange envelope from NextAuth signIn callback.
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record ExchangePayload(
+    String provider,
+    String providerSubject,
+    String email,
+    String name,
+    String inviteToken,
+    String nonce,
+    long iat
+) {}

plate-auth-starter/src/main/java/de/platesoft/auth/dto/TokenResponse.java

@@ -0,0 +1,7 @@
+package de.platesoft.auth.dto;
+
+public record TokenResponse(
+    String accessToken,
+    String refreshToken,
+    long expiresIn
+) {}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/AccessRequest.java

@@ -0,0 +1,64 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+import org.hibernate.envers.Audited;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "access_requests")
+@Audited
+@Getter @Setter @NoArgsConstructor @AllArgsConstructor @Builder
+public class AccessRequest {
+
+    @Id
+    @Column(columnDefinition = "uuid")
+    private UUID id;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "requester_id", nullable = false)
+    private User requester;
+
+    @Enumerated(EnumType.STRING)
+    @Column(name = "org_type", nullable = false, length = 16)
+    private OrgType orgType;
+
+    @Column(name = "org_id", nullable = false, columnDefinition = "uuid")
+    private UUID orgId;
+
+    @Enumerated(EnumType.STRING)
+    @Column(name = "requested_role", nullable = false, length = 16)
+    private MembershipRole requestedRole;
+
+    @Column(length = 500)
+    private String justification;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 16)
+    private AccessRequestStatus status;
+
+    @Column(name = "reviewer_id", columnDefinition = "uuid")
+    private UUID reviewerId;
+
+    @Column(name = "decision_reason", length = 500)
+    private String decisionReason;
+
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private Instant createdAt;
+
+    @Column(name = "decided_at")
+    private Instant decidedAt;
+
+    @Version
+    private Long version;
+
+    @PrePersist
+    void prePersist() {
+        if (id == null) id = UUID.randomUUID();
+        if (createdAt == null) createdAt = Instant.now();
+        if (status == null) status = AccessRequestStatus.PENDING;
+        if (requestedRole == null) requestedRole = MembershipRole.VIEWER;
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/AccessRequestStatus.java

@@ -0,0 +1,3 @@
+package de.platesoft.auth.entity;
+
+public enum AccessRequestStatus { PENDING, APPROVED, DENIED, EXPIRED }

plate-auth-starter/src/main/java/de/platesoft/auth/entity/Invitation.java

@@ -0,0 +1,74 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+import org.hibernate.envers.Audited;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "invitations")
+@Audited
+@Getter @Setter @NoArgsConstructor @AllArgsConstructor @Builder
+public class Invitation {
+
+    @Id
+    @Column(columnDefinition = "uuid")
+    private UUID id;
+
+    @Column(nullable = false, unique = true, length = 64)
+    private String token;
+
+    @Column(nullable = false, length = 255)
+    private String email;
+
+    @Enumerated(EnumType.STRING)
+    @Column(name = "org_type", nullable = false, length = 16)
+    private OrgType orgType;
+
+    @Column(name = "org_id", nullable = false, columnDefinition = "uuid")
+    private UUID orgId;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 16)
+    private MembershipRole role;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 16)
+    private InvitationStatus status;
+
+    @Column(name = "created_by", nullable = false, columnDefinition = "uuid")
+    private UUID createdBy;
+
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private Instant createdAt;
+
+    @Column(name = "expires_at", nullable = false)
+    private Instant expiresAt;
+
+    @Column(name = "accepted_at")
+    private Instant acceptedAt;
+
+    @Column(name = "accepted_by", columnDefinition = "uuid")
+    private UUID acceptedBy;
+
+    @Column(name = "revoked_at")
+    private Instant revokedAt;
+
+    @Column(name = "revoked_by", columnDefinition = "uuid")
+    private UUID revokedBy;
+
+    @Column(length = 500)
+    private String note;
+
+    @Version
+    private Long version;
+
+    @PrePersist
+    void prePersist() {
+        if (id == null) id = UUID.randomUUID();
+        if (createdAt == null) createdAt = Instant.now();
+        if (status == null) status = InvitationStatus.PENDING;
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/InvitationStatus.java

@@ -0,0 +1,3 @@
+package de.platesoft.auth.entity;
+
+public enum InvitationStatus { PENDING, ACCEPTED, REVOKED, EXPIRED }

plate-auth-starter/src/main/java/de/platesoft/auth/entity/LoginEvent.java

@@ -0,0 +1,46 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "login_events")
+@Getter @Setter @NoArgsConstructor @AllArgsConstructor @Builder
+public class LoginEvent {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "user_id", columnDefinition = "uuid")
+    private UUID userId;
+
+    @Column(nullable = false, length = 255)
+    private String email;
+
+    @Column(nullable = false, length = 32)
+    private String provider;
+
+    @Column(nullable = false, length = 32)
+    private String outcome;
+
+    @Column(name = "ip_address", length = 45)
+    private String ipAddress;
+
+    @Column(name = "user_agent", length = 512)
+    private String userAgent;
+
+    @Column(name = "correlation_id", length = 64)
+    private String correlationId;
+
+    @Column(name = "occurred_at", nullable = false)
+    private Instant occurredAt;
+
+    @PrePersist
+    void prePersist() {
+        if (occurredAt == null) occurredAt = Instant.now();
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/LoginProvider.java

@@ -0,0 +1,3 @@
+package de.platesoft.auth.entity;
+
+public enum LoginProvider { GOOGLE, MICROSOFT, EMAIL, PASSWORD }

plate-auth-starter/src/main/java/de/platesoft/auth/entity/Membership.java

@@ -0,0 +1,64 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+import org.hibernate.envers.Audited;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "memberships", uniqueConstraints = {
+    @UniqueConstraint(name = "uq_memberships_user_org", columnNames = {"user_id", "org_type", "org_id"})
+})
+@Audited
+@Getter @Setter @NoArgsConstructor @AllArgsConstructor @Builder
+public class Membership {
+
+    @Id @Column(columnDefinition = "uuid")
+    private UUID id;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "user_id", nullable = false)
+    private User user;
+
+    @Enumerated(EnumType.STRING)
+    @Column(name = "org_type", nullable = false, length = 16)
+    private OrgType orgType;
+
+    @Column(name = "org_id", nullable = false, columnDefinition = "uuid")
+    private UUID orgId;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 16)
+    private MembershipRole role;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 16)
+    private MembershipStatus status;
+
+    @Column(name = "granted_by", columnDefinition = "uuid")
+    private UUID grantedBy;
+
+    @Column(name = "grant_reason", length = 64)
+    private String grantReason;
+
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private Instant createdAt;
+
+    @Column(name = "revoked_at")
+    private Instant revokedAt;
+
+    @Column(name = "revoked_by", columnDefinition = "uuid")
+    private UUID revokedBy;
+
+    @Version
+    private Long version;
+
+    @PrePersist
+    void prePersist() {
+        if (id == null) id = UUID.randomUUID();
+        if (createdAt == null) createdAt = Instant.now();
+        if (status == null) status = MembershipStatus.ACTIVE;
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/MembershipRole.java

@@ -0,0 +1,9 @@
+package de.platesoft.auth.entity;
+
+public enum MembershipRole {
+    OWNER,
+    ADMIN,
+    INSPECTOR,
+    VIEWER,
+    MEMBER
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/MembershipStatus.java

@@ -0,0 +1,3 @@
+package de.platesoft.auth.entity;
+
+public enum MembershipStatus { ACTIVE, REVOKED, PENDING }

plate-auth-starter/src/main/java/de/platesoft/auth/entity/OrgType.java

@@ -0,0 +1,3 @@
+package de.platesoft.auth.entity;
+
+public enum OrgType { COMPANY, CLUB, WORKSPACE }

plate-auth-starter/src/main/java/de/platesoft/auth/entity/RefreshToken.java

@@ -0,0 +1,42 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+import org.hibernate.envers.Audited;
+
+import java.time.Instant;
+import java.util.UUID;
+
+/**
+ * Refresh token entity for rotation tracking.
+ */
+@Entity
+@Table(name = "refresh_tokens")
+@Getter @Setter @NoArgsConstructor @AllArgsConstructor @Builder
+public class RefreshToken {
+
+    @Id
+    @Column(columnDefinition = "uuid")
+    private UUID id;
+
+    @Column(name = "user_id", nullable = false, columnDefinition = "uuid")
+    private UUID userId;
+
+    @Column(nullable = false, unique = true, length = 255)
+    private String token;
+
+    @Column(name = "expires_at", nullable = false)
+    private Instant expiresAt;
+
+    @Column(nullable = false)
+    private boolean revoked;
+
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private Instant createdAt;
+
+    @PrePersist
+    void prePersist() {
+        if (id == null) id = UUID.randomUUID();
+        if (createdAt == null) createdAt = Instant.now();
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/Role.java

@@ -0,0 +1,9 @@
+package de.platesoft.auth.entity;
+
+/**
+ * Global user roles. Consumers may extend via MembershipRole for per-org roles.
+ */
+public enum Role {
+    ROLE_USER,
+    ROLE_ADMIN
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/User.java

@@ -0,0 +1,78 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+import org.hibernate.envers.Audited;
+import org.hibernate.envers.NotAudited;
+
+import java.time.OffsetDateTime;
+import java.util.UUID;
+
+@Entity
+@Table(name = "users")
+@Audited
+@Getter
+@Setter
+@NoArgsConstructor
+@AllArgsConstructor
+@Builder
+public class User {
+
+    @Id
+    @Column(nullable = false, updatable = false)
+    private UUID id;
+
+    @Column(nullable = false, unique = true)
+    private String email;
+
+    @NotAudited
+    @Column(name = "password_hash")
+    private String passwordHash;
+
+    @Column(name = "first_name", nullable = false, length = 100)
+    private String firstName;
+
+    @Column(name = "last_name", nullable = false, length = 100)
+    private String lastName;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 50)
+    private Role role;
+
+    @Column(nullable = false)
+    private boolean active;
+
+    @Column(name = "default_org_id")
+    private UUID defaultOrgId;
+
+    @Column(name = "last_provider", length = 32)
+    private String lastProvider;
+
+    @Version
+    @NotAudited
+    private Long version;
+
+    @Column(name = "last_login")
+    private OffsetDateTime lastLogin;
+
+    @NotAudited
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private OffsetDateTime createdAt;
+
+    @NotAudited
+    @Column(name = "updated_at", nullable = false)
+    private OffsetDateTime updatedAt;
+
+    @PrePersist
+    protected void onCreate() {
+        if (id == null) id = UUID.randomUUID();
+        createdAt = OffsetDateTime.now();
+        updatedAt = OffsetDateTime.now();
+        if (!active) active = true;
+    }
+
+    @PreUpdate
+    protected void onUpdate() {
+        updatedAt = OffsetDateTime.now();
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/entity/UserIdentity.java

@@ -0,0 +1,55 @@
+package de.platesoft.auth.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+import org.hibernate.envers.Audited;
+
+import java.time.Instant;
+import java.util.UUID;
+
+/**
+ * Provider-agnostic identity link: one row per (provider, subject) pair, many per user.
+ */
+@Entity
+@Table(name = "user_identities", uniqueConstraints = {
+    @UniqueConstraint(name = "uq_user_identities_provider_subject", columnNames = {"provider", "subject"})
+})
+@Audited
+@Getter @Setter @NoArgsConstructor @AllArgsConstructor @Builder
+public class UserIdentity {
+
+    @Id
+    @Column(columnDefinition = "uuid")
+    private UUID id;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "user_id", nullable = false)
+    private User user;
+
+    @Column(nullable = false, length = 32)
+    private String provider;
+
+    @Column(nullable = false, length = 255)
+    private String subject;
+
+    @Column(nullable = false, length = 255)
+    private String email;
+
+    @Column(name = "tenant_id", length = 64)
+    private String tenantId;
+
+    @Column(name = "linked_at", nullable = false)
+    private Instant linkedAt;
+
+    @Column(name = "last_login_at")
+    private Instant lastLoginAt;
+
+    @Version
+    private Long version;
+
+    @PrePersist
+    void prePersist() {
+        if (id == null) id = UUID.randomUUID();
+        if (linkedAt == null) linkedAt = Instant.now();
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/filter/JwtAuthenticationFilter.java

@@ -0,0 +1,47 @@
+package de.platesoft.auth.filter;
+
+import de.platesoft.auth.service.JwtService;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.UUID;
+
+@Slf4j
+@RequiredArgsConstructor
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    private final JwtService jwtService;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
+                                    FilterChain filterChain) throws ServletException, IOException {
+        String authHeader = request.getHeader("Authorization");
+        if (authHeader != null && authHeader.startsWith("Bearer ")) {
+            String token = authHeader.substring(7);
+            if (jwtService.isTokenValid(token)) {
+                UUID userId = jwtService.extractUserId(token);
+                String email = jwtService.extractEmail(token);
+                String role = jwtService.extractRole(token);
+
+                var auth = new UsernamePasswordAuthenticationToken(
+                        userId.toString(),
+                        null,
+                        List.of(new SimpleGrantedAuthority(role))
+                );
+                auth.setDetails(email);
+                SecurityContextHolder.getContext().setAuthentication(auth);
+            }
+        }
+        filterChain.doFilter(request, response);
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/AccessRequestRepository.java

@@ -0,0 +1,15 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.AccessRequest;
+import de.platesoft.auth.entity.AccessRequestStatus;
+import de.platesoft.auth.entity.OrgType;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.List;
+import java.util.UUID;
+
+public interface AccessRequestRepository extends JpaRepository<AccessRequest, UUID> {
+    List<AccessRequest> findByOrgTypeAndOrgIdAndStatus(OrgType orgType, UUID orgId, AccessRequestStatus status);
+    List<AccessRequest> findByRequesterIdAndStatus(UUID requesterId, AccessRequestStatus status);
+    long countByRequesterIdAndStatus(UUID requesterId, AccessRequestStatus status);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/InvitationRepository.java

@@ -0,0 +1,16 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.Invitation;
+import de.platesoft.auth.entity.InvitationStatus;
+import de.platesoft.auth.entity.OrgType;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+public interface InvitationRepository extends JpaRepository<Invitation, UUID> {
+    Optional<Invitation> findByToken(String token);
+    List<Invitation> findByOrgTypeAndOrgIdAndStatus(OrgType orgType, UUID orgId, InvitationStatus status);
+    List<Invitation> findByEmailAndStatus(String email, InvitationStatus status);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/LoginEventRepository.java

@@ -0,0 +1,7 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.LoginEvent;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface LoginEventRepository extends JpaRepository<LoginEvent, Long> {
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/MembershipRepository.java

@@ -0,0 +1,16 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.Membership;
+import de.platesoft.auth.entity.MembershipStatus;
+import de.platesoft.auth.entity.OrgType;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+public interface MembershipRepository extends JpaRepository<Membership, UUID> {
+    Optional<Membership> findByUserIdAndOrgTypeAndOrgId(UUID userId, OrgType orgType, UUID orgId);
+    List<Membership> findByUserIdAndStatus(UUID userId, MembershipStatus status);
+    List<Membership> findByOrgTypeAndOrgIdAndStatus(OrgType orgType, UUID orgId, MembershipStatus status);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/RefreshTokenRepository.java

@@ -0,0 +1,12 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.RefreshToken;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.Optional;
+import java.util.UUID;
+
+public interface RefreshTokenRepository extends JpaRepository<RefreshToken, UUID> {
+    Optional<RefreshToken> findByToken(String token);
+    void deleteByUserId(UUID userId);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/UserIdentityRepository.java

@@ -0,0 +1,11 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.UserIdentity;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.Optional;
+import java.util.UUID;
+
+public interface UserIdentityRepository extends JpaRepository<UserIdentity, UUID> {
+    Optional<UserIdentity> findByProviderAndSubject(String provider, String subject);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/repository/UserRepository.java

@@ -0,0 +1,12 @@
+package de.platesoft.auth.repository;
+
+import de.platesoft.auth.entity.User;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.Optional;
+import java.util.UUID;
+
+public interface UserRepository extends JpaRepository<User, UUID> {
+    Optional<User> findByEmail(String email);
+    boolean existsByEmail(String email);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/service/ExchangeService.java

@@ -0,0 +1,162 @@
+package de.platesoft.auth.service;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import de.platesoft.auth.PlateAuthProperties;
+import de.platesoft.auth.dto.ExchangePayload;
+import de.platesoft.auth.dto.TokenResponse;
+import de.platesoft.auth.entity.*;
+import de.platesoft.auth.repository.UserIdentityRepository;
+import de.platesoft.auth.repository.UserRepository;
+import de.platesoft.auth.spi.OnboardingHook;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.Instant;
+import java.util.HexFormat;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+
+/**
+ * Verifies the HMAC-SHA256 exchange envelope from NextAuth and provides replay protection.
+ * The nonce store is in-memory and single-instance only (see Architecture.md § 5 note).
+ */
+@Slf4j
+@Service
+public class ExchangeService {
+
+    private final String secret;
+    private final long maxAgeSeconds;
+    private final long nonceTtlSeconds;
+    private final ObjectMapper mapper;
+    private final JwtService jwtService;
+    private final UserRepository userRepository;
+    private final UserIdentityRepository identityRepository;
+    private final OnboardingHook onboardingHook;
+    private final LoginEventService loginEventService;
+
+    private final ConcurrentMap<String, Long> seenNonces = new ConcurrentHashMap<>();
+
+    public ExchangeService(
+            PlateAuthProperties props,
+            ObjectMapper mapper,
+            JwtService jwtService,
+            UserRepository userRepository,
+            UserIdentityRepository identityRepository,
+            OnboardingHook onboardingHook,
+            LoginEventService loginEventService) {
+        this.secret = props.getExchange().getSecret();
+        this.maxAgeSeconds = props.getExchange().getMaxAge().getSeconds();
+        this.nonceTtlSeconds = props.getExchange().getNonceTtl().getSeconds();
+        this.mapper = mapper;
+        this.jwtService = jwtService;
+        this.userRepository = userRepository;
+        this.identityRepository = identityRepository;
+        this.onboardingHook = onboardingHook;
+        this.loginEventService = loginEventService;
+    }
+
+    /**
+     * Verify HMAC signature, check envelope age and nonce uniqueness,
+     * then find-or-create user and issue tokens.
+     */
+    @Transactional
+    public TokenResponse verifyAndExchange(String body, String signatureHex, String ipAddress, String userAgent) {
+        if (signatureHex == null || signatureHex.isBlank()) {
+            throw new SecurityException("Missing X-Exchange-Signature");
+        }
+        String expected = hmacSha256Hex(body);
+        if (!constantTimeEquals(expected, signatureHex)) {
+            log.warn("Exchange HMAC mismatch — possible tampering or key mismatch");
+            throw new SecurityException("Invalid exchange signature");
+        }
+
+        ExchangePayload payload;
+        try {
+            payload = mapper.readValue(body, ExchangePayload.class);
+        } catch (Exception e) {
+            throw new SecurityException("Malformed exchange payload");
+        }
+
+        long now = Instant.now().getEpochSecond();
+        if (Math.abs(now - payload.iat()) > maxAgeSeconds) {
+            throw new SecurityException("Exchange envelope expired");
+        }
+
+        Long prev = seenNonces.putIfAbsent(payload.nonce(), now);
+        if (prev != null) {
+            throw new SecurityException("Replayed nonce");
+        }
+        gcNonces(now);
+
+        // Find or create user + identity
+        User user = findOrCreateUser(payload);
+
+        // Record login event
+        loginEventService.recordSuccess(user, payload.provider(), ipAddress, userAgent);
+
+        return jwtService.issueTokensFor(user);
+    }
+
+    private User findOrCreateUser(ExchangePayload payload) {
+        var existingIdentity = identityRepository.findByProviderAndSubject(
+                payload.provider(), payload.providerSubject());
+
+        if (existingIdentity.isPresent()) {
+            UserIdentity identity = existingIdentity.get();
+            identity.setLastLoginAt(Instant.now());
+            User user = identity.getUser();
+            user.setLastProvider(payload.provider());
+            onboardingHook.onSubsequentSignIn(user, LoginProvider.valueOf(payload.provider().toUpperCase()));
+            return user;
+        }
+
+        // New user
+        User user = userRepository.findByEmail(payload.email())
+                .orElseGet(() -> userRepository.save(User.builder()
+                        .email(payload.email())
+                        .firstName(payload.name() != null ? payload.name().split(" ")[0] : "")
+                        .lastName(payload.name() != null && payload.name().contains(" ")
+                                ? payload.name().substring(payload.name().indexOf(' ') + 1) : "")
+                        .role(Role.ROLE_USER)
+                        .active(true)
+                        .lastProvider(payload.provider())
+                        .build()));
+
+        identityRepository.save(UserIdentity.builder()
+                .user(user)
+                .provider(payload.provider())
+                .subject(payload.providerSubject())
+                .email(payload.email())
+                .build());
+
+        onboardingHook.onFirstSignIn(user, LoginProvider.valueOf(payload.provider().toUpperCase()));
+        return user;
+    }
+
+    private String hmacSha256Hex(String body) {
+        try {
+            Mac mac = Mac.getInstance("HmacSHA256");
+            mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
+            return HexFormat.of().formatHex(mac.doFinal(body.getBytes(StandardCharsets.UTF_8)));
+        } catch (Exception e) {
+            throw new IllegalStateException("HMAC computation failed", e);
+        }
+    }
+
+    /** Constant-time comparison using MessageDigest.isEqual */
+    private boolean constantTimeEquals(String a, String b) {
+        byte[] aBytes = a.getBytes(StandardCharsets.UTF_8);
+        byte[] bBytes = b.getBytes(StandardCharsets.UTF_8);
+        return MessageDigest.isEqual(aBytes, bBytes);
+    }
+
+    private void gcNonces(long now) {
+        seenNonces.entrySet().removeIf(e -> now - e.getValue() > nonceTtlSeconds);
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/service/JwtService.java

@@ -0,0 +1,96 @@
+package de.platesoft.auth.service;
+
+import de.platesoft.auth.PlateAuthProperties;
+import de.platesoft.auth.dto.TokenResponse;
+import de.platesoft.auth.entity.User;
+import io.jsonwebtoken.*;
+import io.jsonwebtoken.security.Keys;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import javax.crypto.SecretKey;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+import java.util.Map;
+import java.util.UUID;
+
+@Slf4j
+@Service
+public class JwtService {
+
+    private final SecretKey key;
+    private final long accessExpirationMs;
+    private final long refreshExpirationMs;
+    private final String issuer;
+
+    public JwtService(PlateAuthProperties props) {
+        this.key = Keys.hmacShaKeyFor(props.getJwt().getSecret().getBytes(StandardCharsets.UTF_8));
+        this.accessExpirationMs = props.getJwt().getAccessExpiration().toMillis();
+        this.refreshExpirationMs = props.getJwt().getRefreshExpiration().toMillis();
+        this.issuer = props.getJwt().getIssuer();
+    }
+
+    public String generateAccessToken(UUID userId, String email, String role) {
+        return Jwts.builder()
+                .issuer(issuer)
+                .subject(userId.toString())
+                .claims(Map.of("email", email, "role", role))
+                .issuedAt(new Date())
+                .expiration(new Date(System.currentTimeMillis() + accessExpirationMs))
+                .signWith(key)
+                .compact();
+    }
+
+    public String generateRefreshToken(UUID userId) {
+        return Jwts.builder()
+                .issuer(issuer)
+                .subject(userId.toString())
+                .claim("type", "refresh")
+                .id(UUID.randomUUID().toString())
+                .issuedAt(new Date())
+                .expiration(new Date(System.currentTimeMillis() + refreshExpirationMs))
+                .signWith(key)
+                .compact();
+    }
+
+    public TokenResponse issueTokensFor(User user) {
+        String access = generateAccessToken(user.getId(), user.getEmail(), user.getRole().name());
+        String refresh = generateRefreshToken(user.getId());
+        return new TokenResponse(access, refresh, accessExpirationMs / 1000);
+    }
+
+    public long getRefreshExpirationMs() {
+        return refreshExpirationMs;
+    }
+
+    public Claims extractClaims(String token) {
+        return Jwts.parser()
+                .verifyWith(key)
+                .requireIssuer(issuer)
+                .build()
+                .parseSignedClaims(token)
+                .getPayload();
+    }
+
+    public UUID extractUserId(String token) {
+        return UUID.fromString(extractClaims(token).getSubject());
+    }
+
+    public String extractEmail(String token) {
+        return extractClaims(token).get("email", String.class);
+    }
+
+    public String extractRole(String token) {
+        return extractClaims(token).get("role", String.class);
+    }
+
+    public boolean isTokenValid(String token) {
+        try {
+            extractClaims(token);
+            return true;
+        } catch (JwtException | IllegalArgumentException e) {
+            log.debug("Token validation failed: {}", e.getMessage());
+            return false;
+        }
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/service/LoginEventService.java

@@ -0,0 +1,42 @@
+package de.platesoft.auth.service;
+
+import de.platesoft.auth.entity.LoginEvent;
+import de.platesoft.auth.entity.User;
+import de.platesoft.auth.repository.LoginEventRepository;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.scheduling.annotation.Async;
+import org.springframework.stereotype.Service;
+
+import java.util.UUID;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class LoginEventService {
+
+    private final LoginEventRepository repo;
+
+    @Async
+    public void recordSuccess(User user, String provider, String ipAddress, String userAgent) {
+        repo.save(LoginEvent.builder()
+                .userId(user.getId())
+                .email(user.getEmail())
+                .provider(provider)
+                .outcome("SUCCESS")
+                .ipAddress(ipAddress)
+                .userAgent(userAgent)
+                .build());
+    }
+
+    @Async
+    public void recordFailure(String email, String provider, String outcome, String ipAddress, String userAgent) {
+        repo.save(LoginEvent.builder()
+                .email(email)
+                .provider(provider)
+                .outcome(outcome)
+                .ipAddress(ipAddress)
+                .userAgent(userAgent)
+                .build());
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/service/MembershipService.java

@@ -0,0 +1,116 @@
+package de.platesoft.auth.service;
+
+import de.platesoft.auth.entity.*;
+import de.platesoft.auth.repository.MembershipRepository;
+import de.platesoft.auth.spi.OrgValidator;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class MembershipService {
+
+    private final MembershipRepository repo;
+    private final OrgValidator orgValidator;
+
+    @Transactional
+    public Membership grant(User user, OrgType orgType, UUID orgId, MembershipRole role,
+                            UUID grantedBy, String reason) {
+        // Validate org exists via SPI
+        if (!orgValidator.exists(orgType, orgId)) {
+            throw new IllegalArgumentException(
+                    "OrgValidator rejected org: " + orgType + "/" + orgId);
+        }
+
+        Optional<Membership> existing = repo.findByUserIdAndOrgTypeAndOrgId(user.getId(), orgType, orgId);
+        if (existing.isPresent()) {
+            Membership m = existing.get();
+            if (m.getStatus() == MembershipStatus.ACTIVE) {
+                if (rank(role) > rank(m.getRole())) {
+                    log.info("Upgrading membership user={} org={} {}→{}", user.getId(), orgId, m.getRole(), role);
+                    m.setRole(role);
+                }
+                return m;
+            }
+            m.setStatus(MembershipStatus.ACTIVE);
+            m.setRole(role);
+            m.setRevokedAt(null);
+            m.setRevokedBy(null);
+            m.setGrantedBy(grantedBy);
+            m.setGrantReason(reason);
+            return m;
+        }
+        return repo.save(Membership.builder()
+                .user(user)
+                .orgType(orgType)
+                .orgId(orgId)
+                .role(role)
+                .status(MembershipStatus.ACTIVE)
+                .grantedBy(grantedBy)
+                .grantReason(reason)
+                .build());
+    }
+
+    @Transactional
+    public void revoke(UUID membershipId, UUID revokedBy) {
+        Membership m = repo.findById(membershipId)
+                .orElseThrow(() -> new IllegalArgumentException("Membership not found: " + membershipId));
+        if (m.getStatus() == MembershipStatus.REVOKED) return;
+        m.setStatus(MembershipStatus.REVOKED);
+        m.setRevokedAt(Instant.now());
+        m.setRevokedBy(revokedBy);
+    }
+
+    @Transactional(readOnly = true)
+    public List<Membership> activeForUser(UUID userId) {
+        return repo.findByUserIdAndStatus(userId, MembershipStatus.ACTIVE);
+    }
+
+    @Transactional(readOnly = true)
+    public Optional<Membership> resolve(UUID userId, OrgType orgType, UUID orgId) {
+        return repo.findByUserIdAndOrgTypeAndOrgId(userId, orgType, orgId)
+                .filter(m -> m.getStatus() == MembershipStatus.ACTIVE);
+    }
+
+    @Transactional(readOnly = true)
+    public boolean isOrgAdmin(UUID userId, OrgType orgType, UUID orgId) {
+        return repo.findByUserIdAndOrgTypeAndOrgId(userId, orgType, orgId)
+                .filter(m -> m.getStatus() == MembershipStatus.ACTIVE)
+                .map(m -> rank(m.getRole()) >= rank(MembershipRole.ADMIN))
+                .orElse(false);
+    }
+
+    public void assertAdminOf(UUID userId, OrgType orgType, UUID orgId) {
+        if (!isOrgAdmin(userId, orgType, orgId)) {
+            throw new AccessDeniedException(
+                    "User " + userId + " is not admin of " + orgType + "/" + orgId);
+        }
+    }
+
+    @Transactional(readOnly = true)
+    public List<Membership> adminsByOrg(OrgType orgType, UUID orgId) {
+        return repo.findByOrgTypeAndOrgIdAndStatus(orgType, orgId, MembershipStatus.ACTIVE)
+                .stream()
+                .filter(m -> rank(m.getRole()) >= rank(MembershipRole.ADMIN))
+                .toList();
+    }
+
+    private int rank(MembershipRole r) {
+        return switch (r) {
+            case OWNER -> 5;
+            case ADMIN -> 4;
+            case INSPECTOR -> 3;
+            case VIEWER -> 2;
+            case MEMBER -> 1;
+        };
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/AccessRequestMailer.java

@@ -0,0 +1,12 @@
+package de.platesoft.auth.spi;
+
+import de.platesoft.auth.entity.AccessRequest;
+
+/**
+ * Notifies admins of new access requests and requesters of decisions.
+ * The default implementation logs notifications at INFO level.
+ */
+public interface AccessRequestMailer {
+    void notifyAdmins(AccessRequest request);
+    void notifyRequester(AccessRequest request);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/InvitationMailer.java

@@ -0,0 +1,10 @@
+package de.platesoft.auth.spi;
+
+import de.platesoft.auth.entity.Invitation;
+
+/**
+ * Sends invitation emails. The default implementation logs the accept URL at INFO level.
+ */
+public interface InvitationMailer {
+    void sendInvitation(Invitation invitation, String acceptUrl);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/OnboardingHook.java

@@ -0,0 +1,16 @@
+package de.platesoft.auth.spi;
+
+import de.platesoft.auth.entity.LoginProvider;
+import de.platesoft.auth.entity.User;
+
+/**
+ * Called on first and subsequent sign-ins. Consumers wire their T3 onboarding logic here.
+ * The default implementation is a no-op.
+ */
+public interface OnboardingHook {
+    void onFirstSignIn(User user, LoginProvider provider);
+
+    default void onSubsequentSignIn(User user, LoginProvider provider) {
+        // no-op by default
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/OrgDisplayNameResolver.java

@@ -0,0 +1,13 @@
+package de.platesoft.auth.spi;
+
+import de.platesoft.auth.entity.OrgType;
+
+import java.util.UUID;
+
+/**
+ * Resolves a human-readable display name for an organization.
+ * Used in invitation emails, access request notifications, etc.
+ */
+public interface OrgDisplayNameResolver {
+    String displayName(OrgType type, UUID orgId);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/OrgValidator.java

@@ -0,0 +1,19 @@
+package de.platesoft.auth.spi;
+
+import de.platesoft.auth.entity.OrgType;
+
+import java.util.UUID;
+
+/**
+ * Validates that a given (org_type, org_id) pair represents a real organization
+ * in the consuming application's domain.
+ *
+ * <p>plate-auth calls this SPI whenever a membership is being granted or an invitation
+ * is being created. If this returns {@code false}, the operation is rejected.</p>
+ *
+ * <p>The default implementation ({@code PermissiveOrgValidator}) always returns {@code true}
+ * and logs a WARN on every call. Override this bean in production.</p>
+ */
+public interface OrgValidator {
+    boolean exists(OrgType type, UUID orgId);
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/defaults/DefaultOrgDisplayNameResolver.java

@@ -0,0 +1,17 @@
+package de.platesoft.auth.spi.defaults;
+
+import de.platesoft.auth.entity.OrgType;
+import de.platesoft.auth.spi.OrgDisplayNameResolver;
+
+import java.util.UUID;
+
+/**
+ * Default display name resolver — returns type:orgId.
+ */
+public class DefaultOrgDisplayNameResolver implements OrgDisplayNameResolver {
+
+    @Override
+    public String displayName(OrgType type, UUID orgId) {
+        return type + ":" + orgId.toString();
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/defaults/LoggingAccessRequestMailer.java

@@ -0,0 +1,25 @@
+package de.platesoft.auth.spi.defaults;
+
+import de.platesoft.auth.entity.AccessRequest;
+import de.platesoft.auth.spi.AccessRequestMailer;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Default AccessRequestMailer — logs notifications at INFO level.
+ */
+@Slf4j
+public class LoggingAccessRequestMailer implements AccessRequestMailer {
+
+    @Override
+    public void notifyAdmins(AccessRequest request) {
+        log.info("[plate-auth] Access request from user {} for {}/{} with role {}",
+                request.getRequester().getEmail(), request.getOrgType(),
+                request.getOrgId(), request.getRequestedRole());
+    }
+
+    @Override
+    public void notifyRequester(AccessRequest request) {
+        log.info("[plate-auth] Access request {} decided: {}",
+                request.getId(), request.getStatus());
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/defaults/LoggingInvitationMailer.java

@@ -0,0 +1,19 @@
+package de.platesoft.auth.spi.defaults;
+
+import de.platesoft.auth.entity.Invitation;
+import de.platesoft.auth.spi.InvitationMailer;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Default InvitationMailer — logs the accept URL at INFO level.
+ */
+@Slf4j
+public class LoggingInvitationMailer implements InvitationMailer {
+
+    @Override
+    public void sendInvitation(Invitation invitation, String acceptUrl) {
+        log.info("[plate-auth] Invitation for {} to join {}/{} with role {}. Accept URL: {}",
+                invitation.getEmail(), invitation.getOrgType(), invitation.getOrgId(),
+                invitation.getRole(), acceptUrl);
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/defaults/NoOpOnboardingHook.java

@@ -0,0 +1,16 @@
+package de.platesoft.auth.spi.defaults;
+
+import de.platesoft.auth.entity.LoginProvider;
+import de.platesoft.auth.entity.User;
+import de.platesoft.auth.spi.OnboardingHook;
+
+/**
+ * Default OnboardingHook — no-op.
+ */
+public class NoOpOnboardingHook implements OnboardingHook {
+
+    @Override
+    public void onFirstSignIn(User user, LoginProvider provider) {
+        // no-op — consumers override to wire their onboarding logic
+    }
+}

plate-auth-starter/src/main/java/de/platesoft/auth/spi/defaults/PermissiveOrgValidator.java

@@ -0,0 +1,22 @@
+package de.platesoft.auth.spi.defaults;
+
+import de.platesoft.auth.entity.OrgType;
+import de.platesoft.auth.spi.OrgValidator;
+import lombok.extern.slf4j.Slf4j;
+
+import java.util.UUID;
+
+/**
+ * Default OrgValidator that accepts all (org_type, org_id) pairs.
+ * Logs a WARN on every call to make it impossible to miss in production.
+ * Override this bean to implement real validation.
+ */
+@Slf4j
+public class PermissiveOrgValidator implements OrgValidator {
+
+    @Override
+    public boolean exists(OrgType type, UUID orgId) {
+        log.warn("OrgValidator default permissive — override de.platesoft.auth.spi.OrgValidator bean before production. Called with ({}, {})", type, orgId);
+        return true;
+    }
+}

plate-auth-starter/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports

@@ -0,0 +1 @@
+de.platesoft.auth.PlateAuthAutoConfiguration