#UniCAS domain topology
Status: accepted target architecture
#Origins
UniCAS separates product communication, machine protocols, administrator workflows, and documentation by origin:
| Origin | Audience | Owned surface |
|---|---|---|
https://unicas.work |
Developers and evaluators | Product overview, quick start, and links to source, console, and docs |
https://api.unicas.work |
Services, SDKs, CLIs, and agents | App/Space data API, managed issuers, OAuth/MCP, discovery, and health |
https://console.unicas.work |
App administrators | Administrator WebUI, BFF, invitations, and CLI login |
https://docs.unicas.work |
Developers and operators | Product, protocol, deployment, and operations documentation |
UniCAS has no end-user application surface. Integrating Apps own end-user identity, Space mapping, and business workflows. The console is for people who administer a UniCAS App.
Use console.unicas.work, not admin.unicas.work, for the human product. The
word console describes an App-operator surface without implying a separate
platform-superuser authority.
#Origin ownership
Each security boundary has one canonical public origin:
CAS_PUBLIC_ORIGIN=https://api.unicas.work
MCP_PUBLIC_ORIGIN=https://api.unicas.work
ADMIN_PUBLIC_ORIGIN=https://console.unicas.work
- App audiences, Space routes, protected-resource metadata, and managed
issuers use
CAS_PUBLIC_ORIGIN. - MCP resource metadata, OAuth endpoints, consent forms, and token audiences
use
MCP_PUBLIC_ORIGIN. - Administrator callbacks, invitations, sessions, CSRF checks, and CLI login
use
ADMIN_PUBLIC_ORIGIN.
The CLI defaults to https://console.unicas.work. The website and docs are
separate static deployments and never receive service credentials.
#Host routing
The API Worker may serve the API and console custom domains, but must enforce this host/path matrix:
| Host | Allowed paths |
|---|---|
api.unicas.work |
/health, /.well-known/*, /v2/apps/*, /managed-issuers/*, /mcp, /oauth/* |
console.unicas.work |
/, /admin/* |
Wrong-host requests fail closed. Do not rely on redirects for capability-bearing writes. The console and Admin BFF remain same-origin. Administrator cookies are host-only and are not authentication on the API origin.
docs.unicas.work is never routed to the API Worker. Exact custom domains do
not imply wildcard ownership of subdomains.
#OAuth callbacks
The production Google OAuth client registers both callbacks:
https://console.unicas.work/admin/auth/callback
https://api.unicas.work/oauth/google/callback
The first belongs to administrator WebUI and CLI login. The second belongs to remote MCP OAuth.
#Compatibility boundary
The previous unidocs-cas Worker and unicas.shazhou.work route form a
separate legacy environment. Its routes, Stack/Tenant vocabulary, issuers,
audiences, data, credentials, and Cloudflare resources remain unchanged.
The target App/Space resource model is defined in UniCAS terminology.