Account / Identity

Intent

Keep authentication and identity state correct, observable, and isolated from other bounded contexts.

Boundaries

• Treat identity as a separate context: other modules depend on identity signals/tokens, not on Firebase Auth types.
• Do not leak platform objects (Firebase User, JWT claims) into Domain models.

Signal-First Auth State

• Represent the current session as signals (user, isAuthenticated, userId, claims).
• Convert Observable streams to signals at the store/facade boundary.
• Ensure cleanup is automatic (use Angular signal interop helpers and lifecycle-aware patterns).

Authorization

• Prefer explicit permissions signals (e.g., canReadWorkspace, canManageMembers) derived from claims/membership.
• Keep permission rules centralized (one store/service), not duplicated across components.