@hilbras/keystone 1.6.0 → 1.9.0

package/src/routes/webauthn.ts

@@ -1,147 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import {
-  type RegistrationResponseJSON,
-  type AuthenticationResponseJSON,
-} from "@simplewebauthn/server";
-import {
-  buildRegistrationOptions,
-  verifyAndStoreRegistration,
-  buildAuthenticationOptions,
-  verifyAuthentication,
-  consumeChallenge,
-} from "../services/webauthn.js";
-import { createTokenSet } from "../services/tokens.js";
-import { setSessionCookies } from "../plugins/auth.js";
-import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
-import { toPublicUser } from "../types.js";
-
-const ChallengeCookieName = "keystone_webauthn_challenge";
-
-function setChallengeCookie(reply: FastifyReply, challenge: string): void {
-  reply.setCookie(ChallengeCookieName, challenge, {
-    path: "/",
-    httpOnly: true,
-    secure: process.env.COOKIE_SECURE === "true",
-    sameSite: "lax",
-    maxAge: 300,
-  });
-}
-
-function getChallengeCookie(request: FastifyRequest): string | undefined {
-  return request.cookies[ChallengeCookieName];
-}
-
-function clearChallengeCookie(reply: FastifyReply): void {
-  reply.clearCookie(ChallengeCookieName, { path: "/" });
-}
-
-const RegisterVerifySchema = z.object({
-  response: z.record(z.string(), z.unknown()),
-  deviceName: z.string().max(100).optional(),
-});
-
-const AuthenticateOptionsSchema = z.object({
-  email: z.string().email().optional(),
-});
-
-const AuthenticateVerifySchema = z.object({
-  response: z.record(z.string(), z.unknown()),
-});
-
-export default async function webauthnRoutes(app: FastifyInstance) {
-  app.get(
-    "/webauthn/register/options",
-    { preHandler: [app.authenticate] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      const options = await buildRegistrationOptions(user);
-      setChallengeCookie(reply, options.challenge);
-      return options;
-    }
-  );
-
-  app.post(
-    "/webauthn/register/verify",
-    { preHandler: [app.authenticate] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      const body = RegisterVerifySchema.parse(request.body);
-      const challenge = getChallengeCookie(request);
-      if (!challenge) {
-        return reply.status(400).send({ error: "Challenge expired or missing" });
-      }
-
-      const stored = consumeChallenge(challenge);
-      if (!stored || stored.userId !== user.id) {
-        clearChallengeCookie(reply);
-        return reply.status(400).send({ error: "Invalid challenge" });
-      }
-
-      try {
-        await verifyAndStoreRegistration(
-          user,
-          body.response as unknown as RegistrationResponseJSON,
-          challenge,
-          body.deviceName
-        );
-        clearChallengeCookie(reply);
-        await request.audit("webauthn_registered", { userId: user.id });
-        return { success: true };
-      } catch (err) {
-        const message = err instanceof Error ? err.message : "Registration failed";
-        return reply.status(400).send({ error: message });
-      }
-    }
-  );
-
-  app.post("/webauthn/authenticate/options", async (request: FastifyRequest, reply: FastifyReply) => {
-    const body = AuthenticateOptionsSchema.parse(request.body);
-    const options = await buildAuthenticationOptions(body.email);
-    setChallengeCookie(reply, options.challenge);
-    return options;
-  });
-
-  app.post("/webauthn/authenticate/verify", async (request: FastifyRequest, reply: FastifyReply) => {
-    const body = AuthenticateVerifySchema.parse(request.body);
-    const challenge = getChallengeCookie(request);
-    if (!challenge) {
-      return reply.status(400).send({ error: "Challenge expired or missing" });
-    }
-
-    const stored = consumeChallenge(challenge);
-    if (!stored) {
-      clearChallengeCookie(reply);
-      return reply.status(400).send({ error: "Invalid challenge" });
-    }
-
-    try {
-      const { user } = await verifyAuthentication(
-        body.response as unknown as AuthenticationResponseJSON,
-        challenge
-      );
-      clearChallengeCookie(reply);
-
-      const fingerprint = fingerprintFromRequest(request);
-      await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
-      const tokens = await createTokenSet(
-        user,
-        request.ip,
-        request.headers["user-agent"],
-        {},
-        fingerprint
-      );
-      setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
-
-      await request.audit("webauthn_authenticated", { userId: user.id });
-      return {
-        user: toPublicUser(user),
-        accessToken: tokens.accessToken,
-        refreshToken: tokens.refreshToken,
-      };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : "Authentication failed";
-      return reply.status(400).send({ error: message });
-    }
-  });
-}

package/src/routes/workflows.ts

@@ -1,157 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import { eq, and } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { workflows, orgMemberships } from "../db/schema.js";
-import { registerWorkflow, listWorkflowRuns } from "../services/workflows/engine.js";
-
-const WorkflowStepSchema = z.object({
-  type: z.string(),
-  name: z.string().optional(),
-});
-
-const CreateWorkflowSchema = z.object({
-  orgId: z.string().uuid(),
-  name: z.string().min(1).max(255),
-  trigger: z.enum(["user_registered", "user_login", "organization_created"]),
-  definition: z.object({
-    steps: z.array(WorkflowStepSchema.and(z.record(z.string(), z.unknown()))),
-  }),
-  isActive: z.boolean().optional(),
-});
-
-async function requireOrgMembership(request: FastifyRequest, reply: FastifyReply, orgId: string) {
-  await request.server.authenticate(request, reply);
-  if (reply.sent) return false;
-
-  const userId = request.user!.id;
-  const [membership] = await db
-    .select()
-    .from(orgMemberships)
-    .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-    .limit(1);
-
-  if (!membership) {
-    reply.status(403).send({ error: "Forbidden: not a member of this organization" });
-    return false;
-  }
-  return true;
-}
-
-export default async function workflowRoutes(app: FastifyInstance) {
-  app.get("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
-    const query = request.query as { orgId?: string };
-    const orgId = query?.orgId;
-
-    if (!orgId) {
-      return reply.status(400).send({ error: "orgId query parameter is required" });
-    }
-
-    // Verify org membership
-    const userId = request.user!.id;
-    const [membership] = await db
-      .select()
-      .from(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
-      .limit(1);
-    if (!membership) {
-      return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
-    }
-
-    const all = await db.select().from(workflows).where(eq(workflows.orgId, orgId));
-    return { workflows: all };
-  });
-
-  app.post("/workflows", { preHandler: [app.authenticate] }, async (request, reply) => {
-    const body = CreateWorkflowSchema.parse(request.body);
-
-    // Verify org membership
-    const userId = request.user!.id;
-    const [membership] = await db
-      .select()
-      .from(orgMemberships)
-      .where(and(eq(orgMemberships.orgId, body.orgId), eq(orgMemberships.userId, userId)))
-      .limit(1);
-    if (!membership) {
-      return reply.status(403).send({ error: "Forbidden: not a member of this organization" });
-    }
-
-    const workflow = await registerWorkflow({
-      orgId: body.orgId,
-      name: body.name,
-      trigger: body.trigger,
-      definition: body.definition,
-    });
-    await request.audit("workflow_created", { workflowId: workflow.id, trigger: body.trigger, orgId: body.orgId });
-    return reply.status(201).send(workflow);
-  });
-
-  app.get("/workflows/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
-    if (!workflow) return reply.status(404).send({ error: "Workflow not found" });
-
-    // Verify org membership
-    if (workflow.orgId) {
-      const userId = request.user!.id;
-      const [membership] = await db
-        .select()
-        .from(orgMemberships)
-        .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
-        .limit(1);
-      if (!membership) {
-        return reply.status(403).send({ error: "Forbidden" });
-      }
-    }
-
-    return { workflow };
-  });
-
-  app.delete("/workflows/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const userId = request.user!.id;
-
-    // Find the workflow and verify org membership
-    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
-    if (!workflow) return reply.status(404).send({ error: "Workflow not found" });
-
-    // Verify org membership
-    if (workflow.orgId) {
-      const [membership] = await db
-        .select()
-        .from(orgMemberships)
-        .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
-        .limit(1);
-      if (!membership) {
-        return reply.status(403).send({ error: "Forbidden" });
-      }
-    }
-
-    const [record] = await db.delete(workflows).where(eq(workflows.id, id)).returning();
-    if (!record) return reply.status(404).send({ error: "Workflow not found" });
-    await request.audit("workflow_deleted", { workflowId: record.id });
-    return { success: true };
-  });
-
-  app.get("/workflows/:id/runs", { preHandler: [app.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
-    if (!workflow) return reply.status(404).send({ error: "Workflow not found" });
-
-    // Verify org membership
-    if (workflow.orgId) {
-      const userId = request.user!.id;
-      const [membership] = await db
-        .select()
-        .from(orgMemberships)
-        .where(and(eq(orgMemberships.orgId, workflow.orgId), eq(orgMemberships.userId, userId)))
-        .limit(1);
-      if (!membership) {
-        return reply.status(403).send({ error: "Forbidden" });
-      }
-    }
-
-    const runs = await listWorkflowRuns(id);
-    return { runs };
-  });
-}

package/src/sdk/index.ts

@@ -1,152 +0,0 @@
-import type { KeystoneSdk, AuthenticationSdk, IdentitySdk, OrganizationSdk, AuthorizationSdk } from "./types.js";
-import type {
-  AuthenticationApplicationService,
-  IdentityApplicationService,
-  OrganizationApplicationService,
-} from "../services/application/index.js";
-import type { AuthorizationDomainService } from "../services/domain/authorization.js";
-import { getContainer } from "../container.js";
-import { buildApplicationServices } from "../di.js";
-
-class SdkAuthenticationClient implements AuthenticationSdk {
-  constructor(private readonly app: AuthenticationApplicationService) {}
-
-  register(input: { username: string; email: string; password: string; name?: string; clientId?: string; metadata?: Record<string, unknown> }) {
-    return this.app.register(input);
-  }
-
-  login(input: { email: string; password: string; clientId?: string }) {
-    return this.app.login(input);
-  }
-
-  async refresh(refreshToken: string, clientId?: string) {
-    const result = await this.app.refresh(refreshToken, clientId);
-    if (!result.success) return result;
-    return { success: true as const, data: { accessToken: result.data.accessToken, refreshToken: result.data.refreshToken, expiresAt: result.data.expiresAt } };
-  }
-
-  logout(refreshToken?: string) {
-    return this.app.logout(refreshToken);
-  }
-
-  createPasswordResetToken(email: string) {
-    return this.app.createPasswordResetToken(email);
-  }
-
-  resetPasswordWithToken(token: string, newPassword: string) {
-    return this.app.resetPasswordWithToken(token, newPassword);
-  }
-}
-
-class SdkIdentityClient implements IdentitySdk {
-  constructor(private readonly app: IdentityApplicationService) {}
-
-  findUser(id: string) {
-    return this.app.findUser(id);
-  }
-
-  findUserByEmail(email: string) {
-    return this.app.findUserByEmail(email);
-  }
-
-  upsertInvitedUser(input: { email: string; name?: string; username?: string }) {
-    return this.app.upsertInvitedUser(input);
-  }
-
-  updateUserProfile(userId: string, updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>) {
-    return this.app.updateUserProfile(userId, updates);
-  }
-
-  deactivate(userId: string) {
-    return this.app.deactivate(userId);
-  }
-
-  listOrganizationUsers(orgId: string) {
-    return this.app.listOrganizationUsers(orgId);
-  }
-
-  linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string) {
-    return this.app.linkUserIdentity(userId, providerId, providerType, externalSub, email);
-  }
-
-  getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string) {
-    return this.app.getFederationAuthorizeUrl(provider, state, redirectUri);
-  }
-
-  completeFederationLogin(provider: string, code: string, redirectUri: string) {
-    return this.app.completeFederationLogin(provider, code, redirectUri);
-  }
-}
-
-class SdkOrganizationClient implements OrganizationSdk {
-  constructor(private readonly app: OrganizationApplicationService) {}
-
-  createOrganization(userId: string, input: { name: string; slug?: string; plan?: string }) {
-    return this.app.createOrganization(userId, input);
-  }
-
-  getOrganization(userId: string, orgId: string) {
-    return this.app.getOrganization(userId, orgId);
-  }
-
-  listUserOrganizations(userId: string) {
-    return this.app.listUserOrganizations(userId);
-  }
-
-  inviteMember(actorId: string, orgId: string, input: { email: string; role: "owner" | "admin" | "member" }) {
-    return this.app.inviteMember(actorId, orgId, input);
-  }
-
-  createApplication(actorId: string, orgId: string, input: { name: string; redirectUris?: string[]; allowedOrigins?: string[] }) {
-    return this.app.createApplication(actorId, orgId, input);
-  }
-
-  listOrganizationApplications(actorId: string, orgId: string) {
-    return this.app.listOrganizationApplications(actorId, orgId);
-  }
-
-  updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean; branding: Record<string, unknown> }>) {
-    return this.app.updateApplication(actorId, orgId, appId, updates);
-  }
-}
-
-class SdkAuthorizationClient implements AuthorizationSdk {
-  constructor(private readonly domain: AuthorizationDomainService) {}
-
-  hasPermission(role: string, resource: string, action: string) {
-    return this.domain.hasPermission(role, resource, action);
-  }
-
-  requirePermission(role: string, resource: string, action: string) {
-    return this.domain.requirePermission(role, resource, action);
-  }
-
-  requireOrgRole(userId: string, orgId: string, allowedRoles: Array<"owner" | "admin" | "member">) {
-    return this.domain.requireOrgRole(userId, orgId, allowedRoles);
-  }
-
-  isOrgMember(userId: string, orgId: string) {
-    return this.domain.isOrgMember(userId, orgId);
-  }
-}
-
-let cachedSdk: KeystoneSdk | null = null;
-
-export function getSdk(): KeystoneSdk {
-  if (cachedSdk) return cachedSdk;
-  const container = getContainer();
-  const apps = buildApplicationServices(container);
-  cachedSdk = {
-    authentication: new SdkAuthenticationClient(apps.auth),
-    identity: new SdkIdentityClient(apps.identity),
-    organization: new SdkOrganizationClient(apps.organization),
-    authorization: new SdkAuthorizationClient(apps.authorization),
-  };
-  return cachedSdk;
-}
-
-export function setSdk(sdk: KeystoneSdk): void {
-  cachedSdk = sdk;
-}
-
-export type { KeystoneSdk, AuthenticationSdk, IdentitySdk, OrganizationSdk, AuthorizationSdk } from "./types.js";

package/src/sdk/types.ts

@@ -1,54 +0,0 @@
-import type { User, Organization, Application, OrgMembership } from "../db/schema.js";
-import type { Result } from "../lib/result.js";
-
-export interface AuthResponse {
-  user: User;
-  accessToken: string;
-  refreshToken: string;
-  expiresAt: Date;
-}
-
-export interface AuthenticationSdk {
-  register(input: { username: string; email: string; password: string; name?: string; clientId?: string; metadata?: Record<string, unknown> }): Promise<Result<AuthResponse>>;
-  login(input: { email: string; password: string; clientId?: string }): Promise<Result<AuthResponse>>;
-  refresh(refreshToken: string, clientId?: string): Promise<Result<{ accessToken: string; refreshToken: string; expiresAt: Date }>>;
-  logout(refreshToken?: string): Promise<Result<void>>;
-  createPasswordResetToken(email: string): Promise<Result<{ token: string; user: User } | null>>;
-  resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>>;
-}
-
-export interface IdentitySdk {
-  findUser(id: string): Promise<Result<User>>;
-  findUserByEmail(email: string): Promise<Result<User>>;
-  upsertInvitedUser(input: { email: string; name?: string; username?: string }): Promise<Result<User>>;
-  updateUserProfile(userId: string, updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>): Promise<Result<User>>;
-  deactivate(userId: string): Promise<Result<void>>;
-  listOrganizationUsers(orgId: string): Promise<User[]>;
-  linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
-  getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{ url: string }>>;
-  completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{ user: User; tokens: { accessToken: string; refreshToken: string } }>>;
-}
-
-export interface OrganizationSdk {
-  createOrganization(userId: string, input: { name: string; slug?: string; plan?: string }): Promise<Result<Organization>>;
-  getOrganization(userId: string, orgId: string): Promise<Result<Organization>>;
-  listUserOrganizations(userId: string): Promise<Organization[]>;
-  inviteMember(actorId: string, orgId: string, input: { email: string; role: "owner" | "admin" | "member" }): Promise<Result<{ user: { id: string }; membership: OrgMembership }>>;
-  createApplication(actorId: string, orgId: string, input: { name: string; redirectUris?: string[]; allowedOrigins?: string[] }): Promise<Result<Application & { clientSecret: string }>>;
-  listOrganizationApplications(actorId: string, orgId: string): Promise<Result<Application[]>>;
-  updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean; branding: Record<string, unknown> }>): Promise<Result<Application>>;
-}
-
-export interface AuthorizationSdk {
-  hasPermission(role: string, resource: string, action: string): Promise<boolean>;
-  requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
-  requireOrgRole(userId: string, orgId: string, allowedRoles: Array<"owner" | "admin" | "member">): Promise<Result<OrgMembership>>;
-  isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
-}
-
-export interface KeystoneSdk {
-  authentication: AuthenticationSdk;
-  identity: IdentitySdk;
-  organization: OrganizationSdk;
-  authorization: AuthorizationSdk;
-}

package/src/services/anomalyDetection.ts

@@ -1,73 +0,0 @@
-import { redis } from "./redis.js";
-
-const ANOMALY_WINDOW_SECONDS = 300;
-const FAILED_LOGIN_THRESHOLD = 10;
-const NEW_DEVICE_THRESHOLD = 3;
-// Two logins from different IPs within this window are flagged as
-// suspicious (approximation of impossible travel without a GeoIP database).
-const IMPOSSIBLE_TRAVEL_WINDOW_SECONDS = 900;
-
-export async function recordFailedLogin(identifier: string): Promise<number> {
-  if (redis.status !== "ready" && redis.status !== "connect") return 0;
-  const key = `anomaly:failed_login:${identifier}`;
-  const now = Date.now();
-  const windowStart = now - ANOMALY_WINDOW_SECONDS * 1000;
-
-  const pipeline = redis.pipeline();
-  pipeline.zremrangebyscore(key, 0, windowStart);
-  pipeline.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
-  pipeline.zcard(key);
-  pipeline.pexpire(key, ANOMALY_WINDOW_SECONDS * 1000);
-  const results = await pipeline.exec();
-  return (results?.[2]?.[1] as number) ?? 0;
-}
-
-export async function isFailedLoginAnomaly(identifier: string): Promise<boolean> {
-  const count = await recordFailedLogin(identifier);
-  return count >= FAILED_LOGIN_THRESHOLD;
-}
-
-export async function recordNewDevice(userId: string): Promise<number> {
-  if (redis.status !== "ready" && redis.status !== "connect") return 0;
-  const key = `anomaly:new_device:${userId}`;
-  const now = Date.now();
-  const windowStart = now - ANOMALY_WINDOW_SECONDS * 1000;
-
-  const pipeline = redis.pipeline();
-  pipeline.zremrangebyscore(key, 0, windowStart);
-  pipeline.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
-  pipeline.zcard(key);
-  pipeline.pexpire(key, ANOMALY_WINDOW_SECONDS * 1000);
-  const results = await pipeline.exec();
-  return (results?.[2]?.[1] as number) ?? 0;
-}
-
-export async function isNewDeviceAnomaly(userId: string): Promise<boolean> {
-  const count = await recordNewDevice(userId);
-  return count >= NEW_DEVICE_THRESHOLD;
-}
-
-/**
- * Records the login location (IP) for a user and returns true when the
- * previous login happened from a *different* IP within the impossible-travel
- * window. Without a GeoIP database this is an approximation: physically
- * changing networks within a few minutes usually indicates credential misuse
- * (or a VPN/mobile network switch, so alerts should say "suspicious", not
- * "blocked").
- */
-export async function checkImpossibleTravel(userId: string, ip: string | undefined): Promise<boolean> {
-  if (!ip || (redis.status !== "ready" && redis.status !== "connect")) return false;
-  const key = `anomaly:last_login:${userId}`;
-  const now = Date.now();
-
-  const previous = await redis.hgetall(key);
-  await redis
-    .multi()
-    .hset(key, "ip", ip, "ts", String(now))
-    .pexpire(key, 30 * 24 * 60 * 60 * 1000)
-    .exec();
-
-  if (!previous?.ip || !previous?.ts) return false;
-  const elapsed = now - Number(previous.ts);
-  return previous.ip !== ip && elapsed < IMPOSSIBLE_TRAVEL_WINDOW_SECONDS * 1000;
-}

package/src/services/application/authentication.ts

@@ -1,75 +0,0 @@
-import type { AuthenticationDomainService } from "../domain/authentication.js";
-import type { TokenSet } from "../tokens.js";
-import type { User } from "../../db/schema.js";
-import type { Result } from "../../lib/result.js";
-
-export interface RegisterRequest {
-  username: string;
-  email: string;
-  password: string;
-  name?: string;
-  clientId?: string;
-  metadata?: Record<string, unknown>;
-}
-
-export interface LoginRequest {
-  email: string;
-  password: string;
-  clientId?: string;
-}
-
-export interface AuthResponse {
-  user: User;
-  accessToken: string;
-  refreshToken: string;
-  expiresAt: Date;
-}
-
-export class AuthenticationApplicationService {
-  constructor(private readonly domain: AuthenticationDomainService) {}
-
-  async register(request: RegisterRequest): Promise<Result<AuthResponse>> {
-    const result = await this.domain.register(request);
-    if (!result.success) return result;
-    return {
-      success: true,
-      data: this.toAuthResponse(result.data.user, result.data.tokens),
-    };
-  }
-
-  async login(request: LoginRequest): Promise<Result<AuthResponse>> {
-    const result = await this.domain.login(request);
-    if (!result.success) return result;
-    return {
-      success: true,
-      data: this.toAuthResponse(result.data.user, result.data.tokens),
-    };
-  }
-
-  async refresh(refreshToken: string, clientId?: string): Promise<Result<TokenSet>> {
-    const result = await this.domain.refresh(refreshToken, clientId);
-    if (!result.success) return result;
-    return { success: true, data: result.data.tokens };
-  }
-
-  async logout(refreshToken?: string): Promise<Result<void>> {
-    return this.domain.logout(refreshToken);
-  }
-
-  async createPasswordResetToken(email: string): Promise<Result<{ token: string; user: User } | null>> {
-    return this.domain.createPasswordResetToken(email);
-  }
-
-  async resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>> {
-    return this.domain.resetPasswordWithToken(token, newPassword);
-  }
-
-  private toAuthResponse(user: User, tokens: TokenSet): AuthResponse {
-    return {
-      user,
-      accessToken: tokens.accessToken,
-      refreshToken: tokens.refreshToken,
-      expiresAt: tokens.expiresAt,
-    };
-  }
-}