Architecture & Shared Authentication

SraHub uses a modern Single Sign-On (SSO) model based on shared root-domain cookies (.srazone.et). This allows users to register or sign in once and seamlessly navigate between the main job seeker web portal (srazone.et) and the employer portal (employeer.srazone.et).

Shared Cookie SSO Flow

+--------------------------+         +-------------------------------+
|    https://srazone.et    |         | https://employeer.srazone.et  |
|      (Web Portal)        |         |      (Employer Portal)        |
+------------+-------------+         +---------------+---------------+
             |                                       |
             +-------------------+-------------------+
                                 |
                    Cookies: sra_access_token
                    Domain: .srazone.et
                                 |
                                 v
                     +------------------------+
                     | https://api.srazone.et |
                     |      (NestJS API)      |
                     +------------------------+

Key Subdomains

• Root Domain: https://srazone.et
• Employer Subdomain: https://employeer.srazone.et
• API Subdomain: https://api.srazone.et
• Admin Subdomain: https://admin.srazone.et

Implementation Details

1. Cookie Domain Scope: Both apps/web and apps/employer set auth cookies with domain=.srazone.et in production environments.
2. Bearer Token Transmission: Client-side API clients automatically read sra_access_token from cookies and send it via the standard Authorization: Bearer <token> HTTP header to the backend API.
3. Role-Based Access Control (RBAC):
   • job_seeker: Default role assigned during signup on https://srazone.et.
   • employer: Role assigned during company registration on https://employeer.srazone.et.
   • admin / super_admin: Internal administrative access at https://admin.srazone.et.

// Role assignment example in registration payload
{
  "email": "hr@company.com",
  "password": "...",
  "displayName": "Acme Ethiopia",
  "role": "employer"
}