Security & SSO

Authentication

Codegraphs uses JWT (RS256) for all API authentication. The DVN-Auth service signs tokens with an RSA-2048 private key. All other services verify tokens using the corresponding public key.

# Generate JWT key pair (run once)
cd DVN-Auth
python tools/generate_jwt_keys.py

# Distribute public key to all services
for svc in DVN-Gateway DVN-SearchEngine DVN-Conductor DVN-Admin DVN-Manager; do
  mkdir -p ../$svc/key
  cp key/jwt_public.pem ../$svc/key/jwt_public.pem
done

Single Sign-On

Protocol	Status	Configuration
OIDC (Azure Entra ID)	Supported	Client ID, tenant ID, client secret
OIDC (Google)	Supported	Client ID, client secret
SAML 2.0	Supported	IdP entity ID, SSO URL, and certificate — or a metadata URL to fetch them automatically
SCIM	Planned	Automated user provisioning

OIDC (Azure Entra ID / Google) is configured once for the whole deployment from Settings → Authentication in the Manager UI. SAML is configured per organization — each tenant can bring its own IdP — currently via the /api/owner/saml-settings API rather than a UI; a Manager UI for SAML is planned. Multiple providers can be active simultaneously.

Roles & Permissions

Role	Permissions
Owner	Full organization management: users, orgs, billing, SSO/SAML settings, API keys, schema creation
Admin	Tenant user management, schema/source configuration, audit log access
User	Search, browse, view graph, use AI features

Roles form a strict hierarchy (Owner > Admin > User) — there is currently no separate read-only "Viewer" or "Auditor" role; any Admin can view audit logs.

Encryption

• In transit: TLS 1.2/1.3 via Nginx. All internal service communication over the dvn-internal Docker network.
• At rest: Sensitive fields (e.g., AI provider keys, org secrets) are encrypted with AES-256-GCM before being stored. Disk/volume-level encryption depends on your underlying infrastructure.
• Secrets: All secrets use pydantic.SecretStr — never logged or serialized as plain text. .env files are git-ignored.

Audit Logging

Codegraphs records all security-relevant events:

Event	Recorded Data
Login / Logout	User, timestamp, IP, success/failure
Permission changes	Who changed what, old value, new value
API key usage	Key ID, endpoint, timestamp, response code
Data export / download	User, file, size, timestamp
Schema deletion	User, schema name, timestamp

Audit logs are queryable via the Admin API and exportable as CSV/JSON for SIEM integration.

Network Security

Codegraphs uses a defense-in-depth network architecture:

• DVN-Gateway (:8088) is the only service exposed externally. All requests pass through JWT validation before reaching backend services.
• Internal services (SearchEngine :8080, Admin :8097, ReServices :8090) are on the dvn-internal Docker network with no host port mapping.
• Multi-tenant isolation: All data access is scoped by tenant. Schema indexes are isolated per tenant at the application layer.