Go Identity Service.
A Go backend for authentication and user management, with REST and gRPC interfaces, Redis caching and a transactional event pipeline. A portfolio project that demonstrates how authentication, persistence and asynchronous processing fit together.
- REST + gRPC
- HTTP flows and typed user queries
- Transactional outbox
- User changes and events in one transaction
- Docker + CI
- Repeatable builds and automated checks
On this page
The engineering problem
Registration changes several things at once: a user is created, tokens are issued and an event needs to reach other parts of the system. A database write followed by a separate message publish can leave those steps out of sync.
Authentication with clear boundaries
The REST API covers registration, login, refresh, logout and the current user. Passwords are hashed with bcrypt; refresh tokens are stored as hashes and rotated transactionally. Role checks protect user operations. The gRPC UserService exposes GetUser and ListUsers.
- PostgreSQL stores users, refresh tokens, outbox records and audit data.
- Redis supports user caching and request rate limiting.
- OpenAPI and Protobuf describe the public contracts.
An event path that survives retries
Registration writes the user, refresh token and UserRegistered outbox event in one PostgreSQL transaction. The background worker claims a batch, publishes Protobuf events to Kafka and tracks delivery attempts. The consumer checks event IDs, writes the audit entry and processed marker transactionally, then commits the Kafka offset.
View implementationVisibility into the running service
Prometheus metrics cover HTTP, gRPC, cache, outbox and consumer activity. OpenTelemetry instruments HTTP and gRPC requests. The readiness endpoint checks PostgreSQL, Redis, Kafka and shutdown state; shutdown code coordinates the HTTP server, gRPC server and background workers.
View implementationOne registration, through the system
The registration and event-delivery path implemented in the repository. Publishing happens after the database transaction.
- 01
REST registration
Validate the request, normalize the email and hash the password.
- 02
PostgreSQL transaction
Write the user, refresh token and UserRegistered outbox event together.
- 03
Outbox worker
Claim a batch with SKIP LOCKED. Retry failed publishes up to the configured limit.
- 04
Kafka event
Publish a Protobuf payload with event ID, type and version metadata.
- 05
Consumer transaction
Check the event ID and write the audit entry with the processed marker.
- 06
Commit the offset
Acknowledge the record after the database transaction succeeds.
Concrete API contracts
Selected operations from the committed OpenAPI specification and Protobuf service definition.
HTTP / REST
- POST
/auth/register - Create a user and issue the token pair.
- POST
/auth/refresh - Rotate the refresh token and issue a new pair.
- GET
/auth/me - Read the currently authenticated user.
- GET
/ready - Check dependencies and shutdown state.
gRPC / UserService
- RPC
GetUser - Read a user by ID.
- RPC
ListUsers - List users with pagination, email filtering and sorting.
Why it works this way.
Commit the change and event together
The registration transaction includes token persistence and the outbox write. Tests cover rollback when token or event persistence fails.
View implementationExpect repeated event delivery
The worker can retry after a publish failure. The consumer uses event IDs and a PostgreSQL transaction to keep the audit operation and processed marker together.
View implementationMake worker state explicit
Outbox records move through NEW, PROCESSING, PROCESSED and FAILED. Batch claiming uses row locks; expired processing locks can be reclaimed.
View implementationChecks alongside the implementation
The repository includes tests for token rotation, failed registration rollback, middleware, user operations, outbox processing and more. CI runs short Go tests, formatting, security checks, Protobuf checks, OpenAPI linting and a Docker build.
Inspect the CI workflow- Authentication success, invalid credentials and revoked tokens
- Rollback on refresh-token or outbox persistence failure
- Unit tests and separate PostgreSQL / Redis integration tests
- Docker packaging and GitHub Container Registry publishing workflows
An independent portfolio service focused on backend engineering practices. Scope and setup are documented in the repository.
Go Identity Service