56 lines
2.7 KiB
Markdown
56 lines
2.7 KiB
Markdown
# TASK METADATA
|
|
|
|
- **Target Files:** `server/routes/admin.ts`, `server/routes/auth.ts`,
|
|
`server/routes/admin/*.ts`, `server/routes/auth/*.ts`, `server/main.ts`
|
|
- **Core Objective:** Phase 3.1 (Domain Route Modularization): Decompose the
|
|
monolithic 865-line `server/routes/admin.ts` and 928-line
|
|
`server/routes/auth.ts` into clean, domain-isolated sub-routers under
|
|
`server/routes/admin/` and `server/routes/auth/`.
|
|
- **Dependencies:**
|
|
`tasks/complete/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph3.md`
|
|
- **Additional Important Notes:** Must preserve 100% route path compatibility,
|
|
zero-trust scope guards (`requireAdmin`, `requirePrimarySession`), rate
|
|
limiting middlewares, and pass all 59 tests.
|
|
|
|
---
|
|
|
|
### 2. Architectural Considerations & Risks
|
|
|
|
- **Risks:**
|
|
- Route mounting path mismatches (e.g. prefix collisions when mounting
|
|
sub-routers in Hono).
|
|
- Scope guard bypass if `requireAdmin` or `requirePrimarySession` is not
|
|
applied at the top of domain routers.
|
|
- **Alternatives:**
|
|
- Keeping 900-line monolithic route files; rejected because it mashes
|
|
unrelated business domains and violates SRP.
|
|
|
|
### 3. Proposed Implementation
|
|
|
|
1. **Decompose `server/routes/admin.ts` into `server/routes/admin/`:**
|
|
- `server/routes/admin/users.ts`: `/users`, `/users/:id/status`,
|
|
`/users/:id/profile`, `/users/:id/grants`, `/users/:id/recovery`.
|
|
- `server/routes/admin/apps.ts`: `/apps`, `/apps/:id` CRUD.
|
|
- `server/routes/admin/roles.ts`: `/roles`, `/roles/:id` RBAC CRUD.
|
|
- `server/routes/admin/invites.ts`: `/invites`, `/invites/create`,
|
|
`/invites/:id/redemptions`, `/invites/:id`.
|
|
- `server/routes/admin/hardware_keys.ts`: `/aaguid`, `/hwk`.
|
|
- `server/routes/admin/audit.ts`: `/audit-logs`, `/check`, `/sessions/:id`.
|
|
- `server/routes/admin/index.ts` (or `admin.ts` entry router): Mounts the
|
|
sub-routers and enforces `requireAdmin` + `adminRateLimiter`.
|
|
|
|
2. **Decompose `server/routes/auth.ts` into `server/routes/auth/`:**
|
|
- `server/routes/auth/register.ts`: `/.well-known/webauthn`,
|
|
`/api/register/challenge`, `/api/register/verify`.
|
|
- `server/routes/auth/login.ts`: `/api/login/challenge`, `/api/login/verify`.
|
|
- `server/routes/auth/passkeys.ts`: `/api/passkeys/register/challenge`,
|
|
`/api/passkeys/register/verify`, `GET /api/passkeys`,
|
|
`DELETE /api/passkeys/:id` guarded by `requirePrimarySession`.
|
|
- `server/routes/auth/guest.ts`: `/api/guests/sandbox`, `/api/revoke`.
|
|
- `server/routes/auth/index.ts` (or `auth.ts` entry router): Assembles the
|
|
auth sub-routers.
|
|
|
|
3. **Quality Gates & Validation:**
|
|
- Run `deno fmt`, `deno task lint`, `deno task check`.
|
|
- Run `deno test --allow-all` (all 59 tests must pass).
|