auth-yes/tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph3.md

TASK METADATA

• Target Files: server/main.ts, server/routes/admin.ts, server/routes/auth.ts, server/middleware.ts, server/rpc.ts, server/main.test.ts
• Core Objective: Phase 3 (Server Route Modularization): Decompose the 2,100-line server/main.ts entrypoint into modular feature routers (routes/admin.ts, routes/auth.ts), dedicated middleware (server/middleware.ts), and RPC configuration (server/rpc.ts).
• Dependencies: tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.md
• Additional Important Notes: Must preserve exact HTTP routes, status codes, zero-trust scope guards, and passing tests in server/main.test.ts.

---

2. Architectural Considerations & Risks

• Risks:
  • Route mounting order changes in Hono could alter middleware execution (e.g. rate limiting or auth resolution).
  • Circular dependencies between route modules and auth-session.ts.
• Alternatives:
  • Keeping all routes in main.ts; rejected because 2,100+ lines violate Single Responsibility Principle.

3. Proposed Implementation

1. Extract Feature Routers (server/routes/):
   • server/routes/admin.ts: Extract all /api/admin/* CRUD endpoints (users, apps, roles, grants, invites, recovery, audit logs).
   • server/routes/auth.ts: Extract WebAuthn passkey registration challenge/verify, login challenge/verify, PRF evaluation, and /api/passkeys/* endpoints.
2. Extract Infrastructure & Middleware Modules:
   • server/middleware.ts: Extract rate limiting, CORS, security headers, and request logging.
   • server/rpc.ts: Extract ConnectRPC daemon service registration and SPIFFE mTLS listener setup.
3. Slim Down server/main.ts:
   • Retain main.ts purely as the application entrypoint assembling the sub-routers and serving the HTTP listener.
4. Quality Gates & Validation:
   • Run deno fmt, deno task lint, deno task check.
   • Run deno test --allow-all to ensure all API routes resolve with 100% fidelity.