Auth And Identity Boundary

Status: ACTIVE
Audit Date: 2026-03-16
Cleanup Sprint: 01

Boundary Verdict

• VERIFIED: services/svc-auth is the current canonical owner of auth/session/account runtime for the public platform path.
• VERIFIED: packages/identity-infra is the current canonical owner of stakeholder onboarding persistence and reviewer workflow implementation.
• VERIFIED: services/api is the public façade for both, but it exposes these capabilities unevenly.
• VERIFIED: gateway reviewer actions for stakeholder applications are currently stubbed even though backend implementations exist.
• UNVERIFIED: long-term canonical consolidation target between svc-auth and identity-infra.

Canonical Ownership

Auth / session / account logic

Owner: services/svc-auth
State: REAL

Evidence:

• services/svc-auth/src/server.ts
• services/api/src/auth/middleware.ts
• services/api/src/routes/auth.ts

Owned concerns:

• signup/register/login/logout/refresh
• session listing and revocation
• 2FA
• OIDC
• auth /me
• admin user/profile routes

Stakeholder onboarding

Owner: packages/identity-infra
State: REAL

Evidence:

• packages/identity-infra/src/server.ts
• packages/identity-infra/src/repositories/stakeholderApplicationRepository.ts
• packages/identity-infra/src/repositories/landOwnerOnboardingRepository.ts

Owned concerns:

• stakeholder application draft/submit
• profile/plots/documents mutation
• event and projection reads
• reviewer actions
• verification actions
• stakeholder-context reads

Gateway exposure

Owner: services/api façade
State: MIXED

Evidence:

• services/api/src/routes/auth.ts
• services/api/src/routes/stakeholder-applications.ts
• services/api/src/routes/land-owner-onboarding.ts
• services/api/src/routes/stakeholder-context.ts

Verified Mismatch

Reviewer workflow mismatch

• VERIFIED:
  • gateway endpoints /stakeholder-applications/:id/review-start, request-info, approve, reject, verify
  • currently return 501 not_implemented in services/api/src/routes/stakeholder-applications.ts
• VERIFIED:
  • real implementations exist in packages/identity-infra/src/server.ts

Impact:

• public platform topology hides a real backend capability
• future AI sessions may wrongly conclude reviewer workflow does not exist at all

Current Safe Boundary Shape

Public path

• apps/web -> services/api -> services/svc-auth for auth/session/account -> stakeholder service URL target for onboarding/context

Practical rule for now

• Treat svc-auth as canonical for auth/session/account.
• Treat identity-infra as canonical for stakeholder application data and reviewer workflow implementation.
• Treat services/api as façade only, not canonical owner of either domain.

Cleanup Sprint 01 Decisions

Changed now

• Added explicit gateway comment in services/api/src/routes/stakeholder-applications.ts marking reviewer routes as intentionally stubbed at gateway level pending boundary decision.

Not changed now

• Did not expose reviewer actions through the gateway yet.

Reason:

• That would be a product-behavior change, not only a structural cleanup.
• Authz expectations and route rollout should be reviewed explicitly.

Recommended Next Decision

Founder / architecture decision needed:

1. Option A: Keep identity-infra as canonical stakeholder workflow runtime and proxy the missing reviewer actions from services/api.

2. Option B: Migrate stakeholder onboarding/runtime into a dedicated canonical service and retire backend overlap.

Current recommendation:

• INFERRED: Option A is the safest near-term path because it aligns code reality with minimal behavior change.