Structural Audit Report

Migration Objective

Enforce a hard boundary between Central Identity (auth-yes) and the ED-Droid subsidiary application (core), creating a decoupled zero-trust architecture.

Audit Checklist

1. Database Schema Extraction

Extracted: users, apps, grants, invites, audit_records, passkeys, sessions schemas moved from core/db.ts to auth-yes/server/db.ts.
Decoupled: Removed REFERENCES users(id) foreign key constraint from edge_nodes.user_id in core/db.ts, replacing it with an unconstrained UUID linking back to the central Auth identity.
Localized Mapping: Created user_profiles table in core/db.ts to hold subsidiary-specific game metadata (frontier_token) mapped exclusively by the unconstrained user_id.

2. API Routing Migration

Extracted: Central Identity endpoints (/api/register/*, /api/login/*) and their corresponding SimpleWebAuthn logic moved to auth-yes/server/main.ts.
Refactored: Modified /frontier/callback inside core/api-server.ts to perform an UPSERT into the localized user_profiles table rather than the central users table.
Zero-Trust Implementation: sessionMiddleware in core/api-server.ts has been refactored to utilize the AuthSdk (auth-yes/sdk/mod.ts), ceasing local queries to the sessions table and enforcing network-based validation.

3. Workspace Validation

Packages: auth-yes is strictly designated as a workspace member inside deno.json.
Decoupling: auth-yes/sdk/mod.ts acts as a pure logic client without directly importing auth-yes/server/main.ts or database connections.

Conclusion

The root core/ directory is now completely purged of central identity logic and schemas. The structural migration was a complete success.

1.9 KiB Raw Blame History