EbikesAfrica254/iam

Identity and access management service for the eBikes Africa platform. Handles user provisioning, membership management, verification flows, and Keycloak integration. # eBikes Africa — IAM Service > Manages identity, access, and user lifecycle for the eBikes Africa platform — from user provisioning and membership > management through to verification, token handling, and outbox event reliability. --- ## Overview The IAM service is the authoritative identity and access layer for the eBikes Africa platform. It governs the full lifecycle of a user — from signup and provisioning through email and phone verification, password management, membership assignment, and soft deletion. Upstream services trigger provisioning flows directly via REST; this service owns what happens next. Access control is organization and branch-aware by design: the same pipeline handles system administrators, organization administrators, and branch-level users through a role-scoped membership model, each enforced via RBAC utilities at the point of user creation and context switching. Keycloak is the identity provider; this service maintains a local `UserExtension` record as the authoritative application-layer user state. An outbox pattern ensures audit events are reliably published downstream even under partial failure. **Owns:** - User provisioning and signup (Keycloak + local extension record) - Email and phone verification, account activation, and password reset - Organization and branch membership management - Role-based access control and user creation authorization - Context switching (active organization and branch per user session) - Token generation, validation, and consumption - Contact ingestion, resolution, and expiry - Outbox event log and retry management - Audit event publishing for all state transitions **Does not own:** - Organization creation and structure — belongs to Organization service - Notification template management and dispatch — belongs to Notifications service - Assignment and routing logic — belongs to Assignment service - Payment processing — belongs to Payment & Billing - Keycloak realm and client configuration — mana …