Legacy User And Auth Inventory

This inventory was taken from the legacy NestJS API under /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api and cross-checked against the Go platform audit docs before changing the Go microservice runtime.

Legacy Framework And Module Shape

• The legacy backend is a NestJS API using Prisma/PostgreSQL.
• Auth HTTP routes live in node-platform/apps/api/src/modules/auth/auth.controller.ts.
• Login/register/refresh/logout/profile flows live in node-platform/apps/api/src/modules/auth/auth.service.ts.
• The legacy code has a class named AuthService; it is not a deployable microservice boundary. The Go platform boundary is iam-service.
• JWT guards read Bearer tokens or the hoctapaz.accessToken cookie; tenant guards read X-Organization-Id or query organizationId.

Contract-Critical Auth Routes

These routes remain public compatibility contracts through the API Gateway:

• POST /api/auth/register
• POST /api/auth/login
• POST /api/auth/refresh
• POST /api/auth/logout
• GET /api/auth/me
• PATCH /api/auth/me/profile
• PATCH /api/auth/me/teacher-profile
• PATCH /api/auth/me/student-profile
• PATCH /api/auth/me/parent-profile
• POST /api/auth/me/password
• POST /api/auth/forgot-password
• POST /api/auth/reset-password
• POST /api/auth/google
• GET /api/auth/google/config

Native iam-service route rehearsal now covers the session endpoints, password change/reset endpoints, Google Auth endpoints, and admin Google settings. Profile route-table rehearsal covers the native profile and KYC carve-outs; the remaining blocker for default public routing is gateway response-shape coverage, browser/runtime evidence, and rollback notes for each promoted route.

Naming note: /api/auth and /v1/auth are compatibility HTTP route namespaces. The runtime service, service task pack, OpenAPI service contract, deployment manifest, and agent dispatch row are all iam-service.

Legacy Data Ownership

The legacy Prisma User model mixes identity, profile, tenant, and product relations. The Go split keeps credentials and permissions out of profile data.

IAM-owned legacy inputs:

• User.accountCode, email, phone, passwordHash, role, status
• RefreshToken
• AuthProviderSetting
• UserAuthProvider
• access-token and refresh-token minting
• organization membership data used for access control
• login/security audit events

Profile-owned legacy inputs:

• User.fullName, avatarUrl, public account metadata
• TeacherProfile
• TeacherKyc schema/read-redaction foundation
• StudentProfile
• ParentProfile
• ParentStudent
• staff-facing display/profile metadata when implemented

Not IAM/Profile-owned:

• organization metadata and units belong to school-service
• classroom roster and classroom membership belong to classroom-service
• wallet/payment/subscription/quota data belongs to wallet/payment/billing/usage services
• learning progress, attempts, course progress, and analytics stay outside IAM

Legacy Token Behavior To Preserve

Legacy access tokens include user identity and frontend compatibility claims:

• sub
• type=access
• role
• accountCode
• fullName
• email
• isGuest
• guestSourceLinkId
• defaultOrganizationId
• optional impersonation fields

Legacy refresh tokens include sub, type=refresh, and jti, expire after seven days, and are persisted by RefreshToken. Native IAM stores refresh-token material hashed at rest and preserves consume-once rotation semantics.

Native Mapping Status

• iam-service already owns native auth identity/session foundations, password change/reset flows, Google provider linking/settings, directory/invite tables, JWT-compatible session payloads, and focused tests.
• profile-service already owns native profile snapshot/read/update foundations, role-profile tables, and focused tests.
• Default /api/auth/* traffic stays conservative until each carve-out has route-table rehearsal, response adapter coverage, browser evidence, and rollback notes.
• There is no deployable auth-service, services/auth-service, or auth-service task pack in go-platform. Remaining auth-service mentions are negative guardrails or migration rationale that point identity work to iam-service; legacy AuthService references in audit docs intentionally describe source-code classes.
• IAM Postgres integration coverage is opt-in through IAM_SERVICE_POSTGRES_TEST_DATABASE_URL and now includes invite workflow plus directory role/permission/organization-membership parity.

Follow-Up Gaps

• Finish IAM as canonical organization-membership owner or document the synchronized read-model contract with school-service.
• Expose profile KYC and profile-owned parent-student read-model APIs only after privacy/audit and gateway response compatibility are explicit.
• Backfill legacy users into service-owned IAM/Profile databases with validation reports before default route cutover.
• Run the opt-in IAM/Profile Postgres integration suites against clean service databases before default public route promotion.