46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# TASK METADATA
|
|
|
|
- **Target Files:** `server/auth-session.ts`, `server/forward_auth.ts`,
|
|
`server/session_resolver.ts`, `ui/mod.ts`, `ui/db_queries.ts`,
|
|
`ui/auth_checks.ts`, `server/main.test.ts`
|
|
- **Core Objective:** Phase 6 (Core Logic Refactoring): Separate database
|
|
queries and admin authorization checks from pure SSR page routing in
|
|
`ui/mod.ts`, and decouple ForwardAuth ingress handling from session
|
|
caching/resolution in `server/auth-session.ts`.
|
|
- **Dependencies:**
|
|
`tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.md`
|
|
- **Additional Important Notes:** Must maintain fast-path microsecond Valkey
|
|
caching, zero-dependency SDK compatibility, and pass all quality gates.
|
|
|
|
---
|
|
|
|
### 2. Architectural Considerations & Risks
|
|
|
|
- **Risks:**
|
|
- Introducing latency in ForwardAuth validation if session resolution
|
|
dependencies are decoupled improperly.
|
|
- Circular import dependencies between Hono routing and session resolver
|
|
modules.
|
|
- **Alternatives:**
|
|
- Leaving logic combined; rejected to ensure clear layer separation between
|
|
edge ingress and data store resolution.
|
|
|
|
### 3. Proposed Implementation
|
|
|
|
1. **Decompose `server/auth-session.ts`:**
|
|
- `server/forward_auth.ts`: Extract Traefik ForwardAuth header parsing,
|
|
dynamic bypass evaluation (`is_public`, `bypass_paths`), and upstream
|
|
identity injection.
|
|
- `server/session_resolver.ts`: Extract multi-cookie iteration, Valkey L1/L2
|
|
cache resolution, and PostgreSQL fallback queries.
|
|
2. **Decompose `ui/mod.ts`:**
|
|
- `ui/db_queries.ts`: Extract raw SQL queries for loading apps, roles,
|
|
grants, invites, and audit logs.
|
|
- `ui/auth_checks.ts`: Extract admin authorization and session verification
|
|
middleware.
|
|
- `ui/mod.ts`: Retain purely as clean SSR route mounting.
|
|
3. **Quality Gates & Validation:**
|
|
- Run `deno fmt`, `deno task lint`, `deno task check`.
|
|
- Run `deno test --allow-all` to ensure all routes and test suites pass
|
|
cleanly.
|