tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
auth-yes/tasks/complete/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph3.1.md

2.7 KiB
Raw Blame History

TASK METADATA

  • Target Files: server/routes/admin.ts, server/routes/auth.ts, server/routes/admin/*.ts, server/routes/auth/*.ts, server/main.ts
  • Core Objective: Phase 3.1 (Domain Route Modularization): Decompose the monolithic 865-line server/routes/admin.ts and 928-line server/routes/auth.ts into clean, domain-isolated sub-routers under server/routes/admin/ and server/routes/auth/.
  • Dependencies: tasks/complete/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph3.md
  • Additional Important Notes: Must preserve 100% route path compatibility, zero-trust scope guards (requireAdmin, requirePrimarySession), rate limiting middlewares, and pass all 59 tests.

2. Architectural Considerations & Risks

  • Risks:
    • Route mounting path mismatches (e.g. prefix collisions when mounting sub-routers in Hono).
    • Scope guard bypass if requireAdmin or requirePrimarySession is not applied at the top of domain routers.
  • Alternatives:
    • Keeping 900-line monolithic route files; rejected because it mashes unrelated business domains and violates SRP.

3. Proposed Implementation

  1. Decompose server/routes/admin.ts into server/routes/admin/:

    • server/routes/admin/users.ts: /users, /users/:id/status, /users/:id/profile, /users/:id/grants, /users/:id/recovery.
    • server/routes/admin/apps.ts: /apps, /apps/:id CRUD.
    • server/routes/admin/roles.ts: /roles, /roles/:id RBAC CRUD.
    • server/routes/admin/invites.ts: /invites, /invites/create, /invites/:id/redemptions, /invites/:id.
    • server/routes/admin/hardware_keys.ts: /aaguid, /hwk.
    • server/routes/admin/audit.ts: /audit-logs, /check, /sessions/:id.
    • server/routes/admin/index.ts (or admin.ts entry router): Mounts the sub-routers and enforces requireAdmin + adminRateLimiter.

  2. Decompose server/routes/auth.ts into server/routes/auth/:

    • server/routes/auth/register.ts: /.well-known/webauthn, /api/register/challenge, /api/register/verify.
    • server/routes/auth/login.ts: /api/login/challenge, /api/login/verify.
    • server/routes/auth/passkeys.ts: /api/passkeys/register/challenge, /api/passkeys/register/verify, GET /api/passkeys, DELETE /api/passkeys/:id guarded by requirePrimarySession.
    • server/routes/auth/guest.ts: /api/guests/sandbox, /api/revoke.
    • server/routes/auth/index.ts (or auth.ts entry router): Assembles the auth sub-routers.

  3. Quality Gates & Validation:

    • Run deno fmt, deno task lint, deno task check.
    • Run deno test --allow-all (all 59 tests must pass).