@hilbras/keystone 1.1.0

package/src/routes/webauthn.ts

@@ -0,0 +1,147 @@
+import { z } from "zod";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import {
+  type RegistrationResponseJSON,
+  type AuthenticationResponseJSON,
+} from "@simplewebauthn/server";
+import {
+  buildRegistrationOptions,
+  verifyAndStoreRegistration,
+  buildAuthenticationOptions,
+  verifyAuthentication,
+  consumeChallenge,
+} from "../services/webauthn.js";
+import { createTokenSet } from "../services/tokens.js";
+import { setSessionCookies } from "../plugins/auth.js";
+import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
+import { toPublicUser } from "../types.js";
+
+const ChallengeCookieName = "keystone_webauthn_challenge";
+
+function setChallengeCookie(reply: FastifyReply, challenge: string): void {
+  reply.setCookie(ChallengeCookieName, challenge, {
+    path: "/",
+    httpOnly: true,
+    secure: process.env.COOKIE_SECURE === "true",
+    sameSite: "lax",
+    maxAge: 300,
+  });
+}
+
+function getChallengeCookie(request: FastifyRequest): string | undefined {
+  return request.cookies[ChallengeCookieName];
+}
+
+function clearChallengeCookie(reply: FastifyReply): void {
+  reply.clearCookie(ChallengeCookieName, { path: "/" });
+}
+
+const RegisterVerifySchema = z.object({
+  response: z.record(z.unknown()),
+  deviceName: z.string().max(100).optional(),
+});
+
+const AuthenticateOptionsSchema = z.object({
+  email: z.string().email().optional(),
+});
+
+const AuthenticateVerifySchema = z.object({
+  response: z.record(z.unknown()),
+});
+
+export default async function webauthnRoutes(app: FastifyInstance) {
+  app.get(
+    "/webauthn/register/options",
+    { preHandler: [app.authenticate] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      const options = await buildRegistrationOptions(user);
+      setChallengeCookie(reply, options.challenge);
+      return options;
+    }
+  );
+
+  app.post(
+    "/webauthn/register/verify",
+    { preHandler: [app.authenticate] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      const body = RegisterVerifySchema.parse(request.body);
+      const challenge = getChallengeCookie(request);
+      if (!challenge) {
+        return reply.status(400).send({ error: "Challenge expired or missing" });
+      }
+
+      const stored = consumeChallenge(challenge);
+      if (!stored || stored.userId !== user.id) {
+        clearChallengeCookie(reply);
+        return reply.status(400).send({ error: "Invalid challenge" });
+      }
+
+      try {
+        await verifyAndStoreRegistration(
+          user,
+          body.response as unknown as RegistrationResponseJSON,
+          challenge,
+          body.deviceName
+        );
+        clearChallengeCookie(reply);
+        await request.audit("webauthn_registered", { userId: user.id });
+        return { success: true };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Registration failed";
+        return reply.status(400).send({ error: message });
+      }
+    }
+  );
+
+  app.post("/webauthn/authenticate/options", async (request: FastifyRequest, reply: FastifyReply) => {
+    const body = AuthenticateOptionsSchema.parse(request.body);
+    const options = await buildAuthenticationOptions(body.email);
+    setChallengeCookie(reply, options.challenge);
+    return options;
+  });
+
+  app.post("/webauthn/authenticate/verify", async (request: FastifyRequest, reply: FastifyReply) => {
+    const body = AuthenticateVerifySchema.parse(request.body);
+    const challenge = getChallengeCookie(request);
+    if (!challenge) {
+      return reply.status(400).send({ error: "Challenge expired or missing" });
+    }
+
+    const stored = consumeChallenge(challenge);
+    if (!stored) {
+      clearChallengeCookie(reply);
+      return reply.status(400).send({ error: "Invalid challenge" });
+    }
+
+    try {
+      const { user } = await verifyAuthentication(
+        body.response as unknown as AuthenticationResponseJSON,
+        challenge
+      );
+      clearChallengeCookie(reply);
+
+      const fingerprint = fingerprintFromRequest(request);
+      await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
+      const tokens = await createTokenSet(
+        user,
+        request.ip,
+        request.headers["user-agent"],
+        {},
+        fingerprint
+      );
+      setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
+
+      await request.audit("webauthn_authenticated", { userId: user.id });
+      return {
+        user: toPublicUser(user),
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Authentication failed";
+      return reply.status(400).send({ error: message });
+    }
+  });
+}

package/src/routes/workflows.ts

@@ -0,0 +1,157 @@
+import { z } from "zod";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { workflows, orgMemberships } from "../db/schema.js";
+import { registerWorkflow, listWorkflowRuns } from "../services/workflows/engine.js";
+
+const WorkflowStepSchema = z.object({
+  type: z.string(),
+  name: z.string().optional(),
+});
+
+const CreateWorkflowSchema = z.object({
+  orgId: z.string().uuid(),
+  name: z.string().min(1).max(255),
+  trigger: z.enum(["user_registered", "user_login", "organization_created"]),
+  definition: z.object({
+    steps: z.array(WorkflowStepSchema.and(z.record(z.unknown()))),
+  }),
+  isActive: z.boolean().optional(),
+});
+
+async function requireOrgMembership(request: FastifyRequest, reply: FastifyReply, orgId: string) {
+  await request.server.authenticate(request, reply);
+  if (reply.sent) return false;
+
+  const userId = request.user!.id;
+  const [membership] = await db
+    .select()
+    .from(orgMemberships)
+    .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+    .limit(1);
+
+  if (!membership) {
+    reply.status(403).send({ error: "Forbidden: not a member of this organization" });
+    return false;
+  }
+  return true;
+}
+
+export default async function workflowRoutes(app: FastifyInstance) {
+  app.get("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
+    const query = request.query as { orgId?: string };
+    const orgId = query?.orgId;
+
+    if (!orgId) {
+      return reply.status(400).send({ error: "orgId query parameter is required" });
+    }
+
+    // Verify org membership
+    const userId = request.user!.id;
+    const [membership] = await db
+      .select()
+      .from(orgMemberships)
+      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+      .limit(1);
+    if (!membership) {
+      return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
+    }
+
+    const all = await db.select().from(workflows).where(eq(workflows.orgId, orgId));
+    return { workflows: all };
+  });
+
+  app.post("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
+    const body = CreateWorkflowSchema.parse(request.body);
+
+    // Verify org membership
+    const userId = request.user!.id;
+    const [membership] = await db
+      .select()
+      .from(orgMemberships)
+      .where(and(eq(orgMemberships.orgId, body.orgId), eq(orgMemberships.userId, userId)))
+      .limit(1);
+    if (!membership) {
+      return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
+    }
+
+    const workflow = await registerWorkflow({
+      orgId: body.orgId,
+      name: body.name,
+      trigger: body.trigger,
+      definition: body.definition,
+    });
+    await request.audit("workflow_created", { workflowId: workflow.id, trigger: body.trigger, orgId: body.orgId });
+    return reply.status(201).send(workflow);
+  });
+
+  app.get("/workflows/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+    if (!workflow) return reply.status(404).send({ error: "Workflow not found" });
+
+    // Verify org membership
+    if (workflow.orgId) {
+      const userId = request.user!.id;
+      const [membership] = await db
+        .select()
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
+        .limit(1);
+      if (!membership) {
+        return reply.status(403).send({ error: "Forbidden" });
+      }
+    }
+
+    return { workflow };
+  });
+
+  app.delete("/workflows/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const userId = request.user!.id;
+
+    // Find the workflow and verify org membership
+    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+    if (!workflow) return reply.status(404).send({ error: "Workflow not found" });
+
+    // Verify org membership
+    if (workflow.orgId) {
+      const [membership] = await db
+        .select()
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
+        .limit(1);
+      if (!membership) {
+        return reply.status(403).send({ error: "Forbidden" });
+      }
+    }
+
+    const [record] = await db.delete(workflows).where(eq(workflows.id, id)).returning();
+    if (!record) return reply.status(404).send({ error: "Workflow not found" });
+    await request.audit("workflow_deleted", { workflowId: record.id });
+    return { success: true };
+  });
+
+  app.get("/workflows/:id/runs", { preHandler: [app.authenticate] }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+    if (!workflow) return reply.status(404).send({ error: "Workflow not found" });
+
+    // Verify org membership
+    if (workflow.orgId) {
+      const userId = request.user!.id;
+      const [membership] = await db
+        .select()
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
+        .limit(1);
+      if (!membership) {
+        return reply.status(403).send({ error: "Forbidden" });
+      }
+    }
+
+    const runs = await listWorkflowRuns(id);
+    return { runs };
+  });
+}

package/src/sdk/index.ts

@@ -0,0 +1,152 @@
+import type { KeystoneSdk, AuthenticationSdk, IdentitySdk, OrganizationSdk, AuthorizationSdk } from "./types.js";
+import type {
+  AuthenticationApplicationService,
+  IdentityApplicationService,
+  OrganizationApplicationService,
+} from "../services/application/index.js";
+import type { AuthorizationDomainService } from "../services/domain/authorization.js";
+import { getContainer } from "../container.js";
+import { buildApplicationServices } from "../di.js";
+
+class SdkAuthenticationClient implements AuthenticationSdk {
+  constructor(private readonly app: AuthenticationApplicationService) {}
+
+  register(input: { username: string; email: string; password: string; name?: string; clientId?: string; metadata?: Record<string, unknown> }) {
+    return this.app.register(input);
+  }
+
+  login(input: { email: string; password: string; clientId?: string }) {
+    return this.app.login(input);
+  }
+
+  async refresh(refreshToken: string, clientId?: string) {
+    const result = await this.app.refresh(refreshToken, clientId);
+    if (!result.success) return result;
+    return { success: true as const, data: { accessToken: result.data.accessToken, refreshToken: result.data.refreshToken, expiresAt: result.data.expiresAt } };
+  }
+
+  logout(refreshToken?: string) {
+    return this.app.logout(refreshToken);
+  }
+
+  createPasswordResetToken(email: string) {
+    return this.app.createPasswordResetToken(email);
+  }
+
+  resetPasswordWithToken(token: string, newPassword: string) {
+    return this.app.resetPasswordWithToken(token, newPassword);
+  }
+}
+
+class SdkIdentityClient implements IdentitySdk {
+  constructor(private readonly app: IdentityApplicationService) {}
+
+  findUser(id: string) {
+    return this.app.findUser(id);
+  }
+
+  findUserByEmail(email: string) {
+    return this.app.findUserByEmail(email);
+  }
+
+  upsertInvitedUser(input: { email: string; name?: string; username?: string }) {
+    return this.app.upsertInvitedUser(input);
+  }
+
+  updateUserProfile(userId: string, updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>) {
+    return this.app.updateUserProfile(userId, updates);
+  }
+
+  deactivate(userId: string) {
+    return this.app.deactivate(userId);
+  }
+
+  listOrganizationUsers(orgId: string) {
+    return this.app.listOrganizationUsers(orgId);
+  }
+
+  linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string) {
+    return this.app.linkUserIdentity(userId, providerId, providerType, externalSub, email);
+  }
+
+  getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string) {
+    return this.app.getFederationAuthorizeUrl(provider, state, redirectUri);
+  }
+
+  completeFederationLogin(provider: string, code: string, redirectUri: string) {
+    return this.app.completeFederationLogin(provider, code, redirectUri);
+  }
+}
+
+class SdkOrganizationClient implements OrganizationSdk {
+  constructor(private readonly app: OrganizationApplicationService) {}
+
+  createOrganization(userId: string, input: { name: string; slug?: string; plan?: string }) {
+    return this.app.createOrganization(userId, input);
+  }
+
+  getOrganization(userId: string, orgId: string) {
+    return this.app.getOrganization(userId, orgId);
+  }
+
+  listUserOrganizations(userId: string) {
+    return this.app.listUserOrganizations(userId);
+  }
+
+  inviteMember(actorId: string, orgId: string, input: { email: string; role: "owner" | "admin" | "member" }) {
+    return this.app.inviteMember(actorId, orgId, input);
+  }
+
+  createApplication(actorId: string, orgId: string, input: { name: string; redirectUris?: string[]; allowedOrigins?: string[] }) {
+    return this.app.createApplication(actorId, orgId, input);
+  }
+
+  listOrganizationApplications(actorId: string, orgId: string) {
+    return this.app.listOrganizationApplications(actorId, orgId);
+  }
+
+  updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean; branding: Record<string, unknown> }>) {
+    return this.app.updateApplication(actorId, orgId, appId, updates);
+  }
+}
+
+class SdkAuthorizationClient implements AuthorizationSdk {
+  constructor(private readonly domain: AuthorizationDomainService) {}
+
+  hasPermission(role: string, resource: string, action: string) {
+    return this.domain.hasPermission(role, resource, action);
+  }
+
+  requirePermission(role: string, resource: string, action: string) {
+    return this.domain.requirePermission(role, resource, action);
+  }
+
+  requireOrgRole(userId: string, orgId: string, allowedRoles: Array<"owner" | "admin" | "member">) {
+    return this.domain.requireOrgRole(userId, orgId, allowedRoles);
+  }
+
+  isOrgMember(userId: string, orgId: string) {
+    return this.domain.isOrgMember(userId, orgId);
+  }
+}
+
+let cachedSdk: KeystoneSdk | null = null;
+
+export function getSdk(): KeystoneSdk {
+  if (cachedSdk) return cachedSdk;
+  const container = getContainer();
+  const apps = buildApplicationServices(container);
+  cachedSdk = {
+    authentication: new SdkAuthenticationClient(apps.auth),
+    identity: new SdkIdentityClient(apps.identity),
+    organization: new SdkOrganizationClient(apps.organization),
+    authorization: new SdkAuthorizationClient(apps.authorization),
+  };
+  return cachedSdk;
+}
+
+export function setSdk(sdk: KeystoneSdk): void {
+  cachedSdk = sdk;
+}
+
+export type { KeystoneSdk, AuthenticationSdk, IdentitySdk, OrganizationSdk, AuthorizationSdk } from "./types.js";

package/src/sdk/types.ts

@@ -0,0 +1,54 @@
+import type { User, Organization, Application, OrgMembership } from "../db/schema.js";
+import type { Result } from "../lib/result.js";
+
+export interface AuthResponse {
+  user: User;
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: Date;
+}
+
+export interface AuthenticationSdk {
+  register(input: { username: string; email: string; password: string; name?: string; clientId?: string; metadata?: Record<string, unknown> }): Promise<Result<AuthResponse>>;
+  login(input: { email: string; password: string; clientId?: string }): Promise<Result<AuthResponse>>;
+  refresh(refreshToken: string, clientId?: string): Promise<Result<{ accessToken: string; refreshToken: string; expiresAt: Date }>>;
+  logout(refreshToken?: string): Promise<Result<void>>;
+  createPasswordResetToken(email: string): Promise<Result<{ token: string; user: User } | null>>;
+  resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>>;
+}
+
+export interface IdentitySdk {
+  findUser(id: string): Promise<Result<User>>;
+  findUserByEmail(email: string): Promise<Result<User>>;
+  upsertInvitedUser(input: { email: string; name?: string; username?: string }): Promise<Result<User>>;
+  updateUserProfile(userId: string, updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>): Promise<Result<User>>;
+  deactivate(userId: string): Promise<Result<void>>;
+  listOrganizationUsers(orgId: string): Promise<User[]>;
+  linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+  getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{ url: string }>>;
+  completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{ user: User; tokens: { accessToken: string; refreshToken: string } }>>;
+}
+
+export interface OrganizationSdk {
+  createOrganization(userId: string, input: { name: string; slug?: string; plan?: string }): Promise<Result<Organization>>;
+  getOrganization(userId: string, orgId: string): Promise<Result<Organization>>;
+  listUserOrganizations(userId: string): Promise<Organization[]>;
+  inviteMember(actorId: string, orgId: string, input: { email: string; role: "owner" | "admin" | "member" }): Promise<Result<{ user: { id: string }; membership: OrgMembership }>>;
+  createApplication(actorId: string, orgId: string, input: { name: string; redirectUris?: string[]; allowedOrigins?: string[] }): Promise<Result<Application & { clientSecret: string }>>;
+  listOrganizationApplications(actorId: string, orgId: string): Promise<Result<Application[]>>;
+  updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean; branding: Record<string, unknown> }>): Promise<Result<Application>>;
+}
+
+export interface AuthorizationSdk {
+  hasPermission(role: string, resource: string, action: string): Promise<boolean>;
+  requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
+  requireOrgRole(userId: string, orgId: string, allowedRoles: Array<"owner" | "admin" | "member">): Promise<Result<OrgMembership>>;
+  isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
+}
+
+export interface KeystoneSdk {
+  authentication: AuthenticationSdk;
+  identity: IdentitySdk;
+  organization: OrganizationSdk;
+  authorization: AuthorizationSdk;
+}

package/src/services/anomalyDetection.ts

@@ -0,0 +1,73 @@
+import { redis } from "./redis.js";
+
+const ANOMALY_WINDOW_SECONDS = 300;
+const FAILED_LOGIN_THRESHOLD = 10;
+const NEW_DEVICE_THRESHOLD = 3;
+// Two logins from different IPs within this window are flagged as
+// suspicious (approximation of impossible travel without a GeoIP database).
+const IMPOSSIBLE_TRAVEL_WINDOW_SECONDS = 900;
+
+export async function recordFailedLogin(identifier: string): Promise<number> {
+  if (redis.status !== "ready" && redis.status !== "connect") return 0;
+  const key = `anomaly:failed_login:${identifier}`;
+  const now = Date.now();
+  const windowStart = now - ANOMALY_WINDOW_SECONDS * 1000;
+
+  const pipeline = redis.pipeline();
+  pipeline.zremrangebyscore(key, 0, windowStart);
+  pipeline.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
+  pipeline.zcard(key);
+  pipeline.pexpire(key, ANOMALY_WINDOW_SECONDS * 1000);
+  const results = await pipeline.exec();
+  return (results?.[2]?.[1] as number) ?? 0;
+}
+
+export async function isFailedLoginAnomaly(identifier: string): Promise<boolean> {
+  const count = await recordFailedLogin(identifier);
+  return count >= FAILED_LOGIN_THRESHOLD;
+}
+
+export async function recordNewDevice(userId: string): Promise<number> {
+  if (redis.status !== "ready" && redis.status !== "connect") return 0;
+  const key = `anomaly:new_device:${userId}`;
+  const now = Date.now();
+  const windowStart = now - ANOMALY_WINDOW_SECONDS * 1000;
+
+  const pipeline = redis.pipeline();
+  pipeline.zremrangebyscore(key, 0, windowStart);
+  pipeline.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
+  pipeline.zcard(key);
+  pipeline.pexpire(key, ANOMALY_WINDOW_SECONDS * 1000);
+  const results = await pipeline.exec();
+  return (results?.[2]?.[1] as number) ?? 0;
+}
+
+export async function isNewDeviceAnomaly(userId: string): Promise<boolean> {
+  const count = await recordNewDevice(userId);
+  return count >= NEW_DEVICE_THRESHOLD;
+}
+
+/**
+ * Records the login location (IP) for a user and returns true when the
+ * previous login happened from a *different* IP within the impossible-travel
+ * window. Without a GeoIP database this is an approximation: physically
+ * changing networks within a few minutes usually indicates credential misuse
+ * (or a VPN/mobile network switch, so alerts should say "suspicious", not
+ * "blocked").
+ */
+export async function checkImpossibleTravel(userId: string, ip: string | undefined): Promise<boolean> {
+  if (!ip || (redis.status !== "ready" && redis.status !== "connect")) return false;
+  const key = `anomaly:last_login:${userId}`;
+  const now = Date.now();
+
+  const previous = await redis.hgetall(key);
+  await redis
+    .multi()
+    .hset(key, "ip", ip, "ts", String(now))
+    .pexpire(key, 30 * 24 * 60 * 60 * 1000)
+    .exec();
+
+  if (!previous?.ip || !previous?.ts) return false;
+  const elapsed = now - Number(previous.ts);
+  return previous.ip !== ip && elapsed < IMPOSSIBLE_TRAVEL_WINDOW_SECONDS * 1000;
+}

package/src/services/application/authentication.ts

@@ -0,0 +1,75 @@
+import type { AuthenticationDomainService } from "../domain/authentication.js";
+import type { TokenSet } from "../tokens.js";
+import type { User } from "../../db/schema.js";
+import type { Result } from "../../lib/result.js";
+
+export interface RegisterRequest {
+  username: string;
+  email: string;
+  password: string;
+  name?: string;
+  clientId?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface LoginRequest {
+  email: string;
+  password: string;
+  clientId?: string;
+}
+
+export interface AuthResponse {
+  user: User;
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: Date;
+}
+
+export class AuthenticationApplicationService {
+  constructor(private readonly domain: AuthenticationDomainService) {}
+
+  async register(request: RegisterRequest): Promise<Result<AuthResponse>> {
+    const result = await this.domain.register(request);
+    if (!result.success) return result;
+    return {
+      success: true,
+      data: this.toAuthResponse(result.data.user, result.data.tokens),
+    };
+  }
+
+  async login(request: LoginRequest): Promise<Result<AuthResponse>> {
+    const result = await this.domain.login(request);
+    if (!result.success) return result;
+    return {
+      success: true,
+      data: this.toAuthResponse(result.data.user, result.data.tokens),
+    };
+  }
+
+  async refresh(refreshToken: string, clientId?: string): Promise<Result<TokenSet>> {
+    const result = await this.domain.refresh(refreshToken, clientId);
+    if (!result.success) return result;
+    return { success: true, data: result.data.tokens };
+  }
+
+  async logout(refreshToken?: string): Promise<Result<void>> {
+    return this.domain.logout(refreshToken);
+  }
+
+  async createPasswordResetToken(email: string): Promise<Result<{ token: string; user: User } | null>> {
+    return this.domain.createPasswordResetToken(email);
+  }
+
+  async resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>> {
+    return this.domain.resetPasswordWithToken(token, newPassword);
+  }
+
+  private toAuthResponse(user: User, tokens: TokenSet): AuthResponse {
+    return {
+      user,
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt,
+    };
+  }
+}