# TASK METADATA

- **Target Files:** `server/routes/admin.ts`, `server/routes/auth.ts`,
  `server/routes/admin/*.ts`, `server/routes/auth/*.ts`, `server/main.ts`
- **Core Objective:** Phase 3.1 (Domain Route Modularization): Decompose the
  monolithic 865-line `server/routes/admin.ts` and 928-line
  `server/routes/auth.ts` into clean, domain-isolated sub-routers under
  `server/routes/admin/` and `server/routes/auth/`.
- **Dependencies:**
  `tasks/complete/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph3.md`
- **Additional Important Notes:** Must preserve 100% route path compatibility,
  zero-trust scope guards (`requireAdmin`, `requirePrimarySession`), rate
  limiting middlewares, and pass all 59 tests.

---

### 2. Architectural Considerations & Risks

- **Risks:**
  - Route mounting path mismatches (e.g. prefix collisions when mounting
    sub-routers in Hono).
  - Scope guard bypass if `requireAdmin` or `requirePrimarySession` is not
    applied at the top of domain routers.
- **Alternatives:**
  - Keeping 900-line monolithic route files; rejected because it mashes
    unrelated business domains and violates SRP.

### 3. Proposed Implementation

1. **Decompose `server/routes/admin.ts` into `server/routes/admin/`:**
   - `server/routes/admin/users.ts`: `/users`, `/users/:id/status`,
     `/users/:id/profile`, `/users/:id/grants`, `/users/:id/recovery`.
   - `server/routes/admin/apps.ts`: `/apps`, `/apps/:id` CRUD.
   - `server/routes/admin/roles.ts`: `/roles`, `/roles/:id` RBAC CRUD.
   - `server/routes/admin/invites.ts`: `/invites`, `/invites/create`,
     `/invites/:id/redemptions`, `/invites/:id`.
   - `server/routes/admin/hardware_keys.ts`: `/aaguid`, `/hwk`.
   - `server/routes/admin/audit.ts`: `/audit-logs`, `/check`, `/sessions/:id`.
   - `server/routes/admin/index.ts` (or `admin.ts` entry router): Mounts the
     sub-routers and enforces `requireAdmin` + `adminRateLimiter`.

2. **Decompose `server/routes/auth.ts` into `server/routes/auth/`:**
   - `server/routes/auth/register.ts`: `/.well-known/webauthn`,
     `/api/register/challenge`, `/api/register/verify`.
   - `server/routes/auth/login.ts`: `/api/login/challenge`, `/api/login/verify`.
   - `server/routes/auth/passkeys.ts`: `/api/passkeys/register/challenge`,
     `/api/passkeys/register/verify`, `GET /api/passkeys`,
     `DELETE /api/passkeys/:id` guarded by `requirePrimarySession`.
   - `server/routes/auth/guest.ts`: `/api/guests/sandbox`, `/api/revoke`.
   - `server/routes/auth/index.ts` (or `auth.ts` entry router): Assembles the
     auth sub-routers.

3. **Quality Gates & Validation:**
   - Run `deno fmt`, `deno task lint`, `deno task check`.
   - Run `deno test --allow-all` (all 59 tests must pass).