identity hexagonal refactor

apps/api/src/app/app.module.ts

@@ -5,6 +5,7 @@ import { ScheduleModule } from '@nestjs/schedule';
 import { EventEmitterModule } from '@nestjs/event-emitter';
 import { AppController } from './app.controller.js';
 import { AppService } from './app.service.js';
+import { EncryptionModule } from '@soopa/security';
 import { UsersModule } from '../modules/identity/users/users.module.js';
 import { TenantsModule } from '../modules/identity/tenants/tenants.module.js';
 import { AuthModule } from '@soopa/auth';
@@ -47,6 +48,18 @@ import { PluginsModule } from '../modules/plugins/plugins.module.js';
     // ObservabilityModule must be first so pino is active before all other modules
     // bootstrap and emit their own startup logs.
     ObservabilityModule,
+    // Global encryption module
+    EncryptionModule.forRootAsync({
+      imports: [ConfigModule],
+      inject: [ConfigService],
+      useFactory: (cfg: ConfigService) => ({
+        mode: cfg.get('INFRA_MODE') === 'local' ? 'local' : 'kms',
+        encryptionKey: cfg.get('ENCRYPTION_KEY'),
+        kmsKeyId: cfg.get('KMS_KEY_ID'),
+        kmsEndpoint: cfg.get('KMS_ENDPOINT'),
+        region: cfg.get('KMS_REGION'),
+      }),
+    }),
     // Global Redis client — available to all modules via REDIS_CLIENT token
     CacheModule,
     // Global SQS queue — available to all modules via QUEUE_SERVICE / QueueService token

apps/api/src/modules/identity/auth/auth.controller.coverage.spec.ts

@@ -1,7 +1,7 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { AuthController } from './auth.controller.js';
 import { AuthService, AuthGuard } from '@soopa/auth';
-import { USER_PROVIDER, TENANT_PROVIDER } from '@soopa/identity';
+import { USER_REPOSITORY, TENANT_REPOSITORY } from '@soopa/identity';
 import { InvitationsService } from '../invitations/invitations.service.js';
 import { BadRequestException } from '@nestjs/common';
 import { vi, describe, it, expect, beforeEach, Mock } from 'vitest';
@@ -75,8 +75,8 @@ describe('AuthController Coverage', () => {
       controllers: [AuthController],
       providers: [
         { provide: AuthService, useValue: authService },
-        { provide: USER_PROVIDER, useValue: userProvider },
-        { provide: TENANT_PROVIDER, useValue: tenantProvider },
+        { provide: USER_REPOSITORY, useValue: userProvider },
+        { provide: TENANT_REPOSITORY, useValue: tenantProvider },
         { provide: InvitationsService, useValue: invitationsService },
       ],
     })

apps/api/src/modules/identity/auth/auth.controller.spec.ts

@@ -2,7 +2,7 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { AuthController } from './auth.controller.js';
 import { AuthService, type RequestAuthContext } from '@soopa/auth';
-import { USER_PROVIDER, TENANT_PROVIDER } from '@soopa/identity';
+import { USER_REPOSITORY, TENANT_REPOSITORY } from '@soopa/identity';
 import type { User, Session } from '@soopa/identity';
 import { InvitationsService } from '../invitations/invitations.service.js';
 import { Request, Response } from 'express';
@@ -54,11 +54,11 @@ describe('AuthController', () => {
           useValue: mockAuthService,
         },
         {
-          provide: USER_PROVIDER,
+          provide: USER_REPOSITORY,
           useValue: mockUserProvider,
         },
         {
-          provide: TENANT_PROVIDER,
+          provide: TENANT_REPOSITORY,
           useValue: mockTenantProvider,
         },
         {

apps/api/src/modules/identity/auth/auth.controller.ts

@@ -16,10 +16,10 @@ import {
   AuthContext,
   type RequestAuthContext,
 } from '@soopa/auth';
-import { USER_PROVIDER, TENANT_PROVIDER } from '@soopa/identity';
+import { USER_REPOSITORY, TENANT_REPOSITORY } from '@soopa/identity';
 import type {
-  IUserProvider,
-  ITenantProvider,
+  IUserRepository,
+  ITenantRepository,
   Session,
   User,
 } from '@soopa/identity';
@@ -53,8 +53,9 @@ export class ResendVerificationDto extends createZodDto(
 export class AuthController {
   constructor(
     private readonly authService: AuthService,
-    @Inject(USER_PROVIDER) private readonly userProvider: IUserProvider,
-    @Inject(TENANT_PROVIDER) private readonly tenantProvider: ITenantProvider,
+    @Inject(USER_REPOSITORY) private readonly userProvider: IUserRepository,
+    @Inject(TENANT_REPOSITORY)
+    private readonly tenantProvider: ITenantRepository,
     private readonly invitationsService: InvitationsService,
   ) {}
 

apps/api/src/modules/identity/auth/platform.guard.spec.ts

@@ -6,7 +6,7 @@ import {
   UnauthorizedException,
   ExecutionContext,
 } from '@nestjs/common';
-import { PERMISSION_PROVIDER } from '@soopa/identity';
+import { PERMISSION_REPOSITORY } from '@soopa/identity';
 import { describe, it, expect, beforeEach, vi, type Mock } from 'vitest';
 
 describe('PlatformGuard', () => {
@@ -31,7 +31,7 @@ describe('PlatformGuard', () => {
           },
         },
         {
-          provide: PERMISSION_PROVIDER,
+          provide: PERMISSION_REPOSITORY,
           useValue: {
             hasRole: vi.fn(),
           },

apps/api/src/modules/identity/roles/roles.controller.spec.ts

@@ -1,6 +1,6 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { RolesController } from './roles.controller.js';
-import { ROLE_PROVIDER, RoleScope } from '@soopa/identity';
+import { ROLE_REPOSITORY, RoleScope } from '@soopa/identity';
 import {
   AuthGuard,
   PermissionsGuard,
@@ -38,7 +38,7 @@ describe('RolesController', () => {
       controllers: [RolesController],
       providers: [
         {
-          provide: ROLE_PROVIDER,
+          provide: ROLE_REPOSITORY,
           useValue: roleProvider,
         },
       ],

apps/api/src/modules/identity/roles/roles.controller.ts

@@ -19,9 +19,9 @@ import {
   AuthContext,
   type RequestAuthContext,
 } from '@soopa/auth';
-import { ROLE_PROVIDER, RoleScope } from '@soopa/identity';
+import { ROLE_REPOSITORY, RoleScope } from '@soopa/identity';
 import type {
-  IRoleProvider,
+  IRoleRepository,
   CreateRoleInput,
   UpdateRoleInput,
 } from '@soopa/identity';
@@ -31,7 +31,7 @@ import { filterRolesForRequester } from '@soopa/identity/utils/role-visibility';
 @UseGuards(AuthGuard, PermissionsGuard)
 export class RolesController {
   constructor(
-    @Inject(ROLE_PROVIDER) private readonly roleProvider: IRoleProvider,
+    @Inject(ROLE_REPOSITORY) private readonly roleProvider: IRoleRepository,
   ) {}
 
   @Get()

apps/api/src/modules/identity/roles/roles.controller.visibility.spec.ts

@@ -1,6 +1,6 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { RolesController } from './roles.controller.js';
-import { ROLE_PROVIDER } from '@soopa/identity';
+import { ROLE_REPOSITORY } from '@soopa/identity';
 import {
   AuthGuard,
   PermissionsGuard,
@@ -38,7 +38,7 @@ describe('RolesController - Visibility Logic', () => {
       controllers: [RolesController],
       providers: [
         {
-          provide: ROLE_PROVIDER,
+          provide: ROLE_REPOSITORY,
           useValue: mockRoleProvider,
         },
       ],

apps/api/src/modules/identity/system-admin/system-admin.controller.spec.ts

@@ -8,9 +8,9 @@ import {
 } from '@nestjs/common';
 import {
   AUTH_PROVIDER,
-  USER_PROVIDER,
-  TENANT_PROVIDER,
-  ROLE_PROVIDER,
+  USER_REPOSITORY,
+  TENANT_REPOSITORY,
+  ROLE_REPOSITORY,
 } from '@soopa/identity';
 import {
   getRequiredAdminRoleId,
@@ -77,9 +77,9 @@ describe('SystemAdminController', () => {
       controllers: [SystemAdminController],
       providers: [
         { provide: AUTH_PROVIDER, useValue: mockAuthProvider },
-        { provide: USER_PROVIDER, useValue: mockUserProvider },
-        { provide: TENANT_PROVIDER, useValue: mockTenantProvider },
-        { provide: ROLE_PROVIDER, useValue: mockRoleProvider },
+        { provide: USER_REPOSITORY, useValue: mockUserProvider },
+        { provide: TENANT_REPOSITORY, useValue: mockTenantProvider },
+        { provide: ROLE_REPOSITORY, useValue: mockRoleProvider },
       ],
     })
       .overrideGuard(SystemAdminGuard)
@@ -206,6 +206,10 @@ describe('SystemAdminController', () => {
 
     it('should create user via provider', async () => {
       mockUserProvider.findByEmail.mockResolvedValue(null);
+      mockRoleProvider.findById.mockResolvedValue({
+        id: 'member',
+        name: 'Member',
+      });
       const mockUser = {
         id: 'u1',
         email: 'new@example.com',
@@ -219,6 +223,7 @@ describe('SystemAdminController', () => {
       });
 
       expect(result).toEqual(mockUser);
+      expect(mockRoleProvider.findById).toHaveBeenCalledWith('member');
       expect(mockUserProvider.create).toHaveBeenCalledWith({
         name: 'Test',
         email: 'new@example.com',

apps/api/src/modules/identity/system-admin/system-admin.controller.ts

@@ -15,15 +15,15 @@ import {
 } from '@nestjs/common';
 import {
   AUTH_PROVIDER,
-  USER_PROVIDER,
-  TENANT_PROVIDER,
-  ROLE_PROVIDER,
+  USER_REPOSITORY,
+  TENANT_REPOSITORY,
+  ROLE_REPOSITORY,
 } from '@soopa/identity';
 import type {
   IAuthProvider,
-  IUserProvider,
-  ITenantProvider,
-  IRoleProvider,
+  IUserRepository,
+  ITenantRepository,
+  IRoleRepository,
 } from '@soopa/identity';
 import { AuthContext, type RequestAuthContext } from '@soopa/auth';
 import {
@@ -47,9 +47,10 @@ import { RequirePermission, PermissionsGuard, AuthGuard } from '@soopa/auth';
 export class SystemAdminController {
   constructor(
     @Inject(AUTH_PROVIDER) private readonly authProvider: IAuthProvider,
-    @Inject(USER_PROVIDER) private readonly userProvider: IUserProvider,
-    @Inject(TENANT_PROVIDER) private readonly tenantProvider: ITenantProvider,
-    @Inject(ROLE_PROVIDER) private readonly roleProvider: IRoleProvider,
+    @Inject(USER_REPOSITORY) private readonly userProvider: IUserRepository,
+    @Inject(TENANT_REPOSITORY)
+    private readonly tenantProvider: ITenantRepository,
+    @Inject(ROLE_REPOSITORY) private readonly roleProvider: IRoleRepository,
   ) {}
 
   @Post('users/:id/invite')

apps/api/src/modules/identity/tenants/tenants.controller.spec.ts

@@ -1,7 +1,7 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { Request } from 'express';
 import { TenantsController } from './tenants.controller.js';
-import { TENANT_PROVIDER, Tenant } from '@soopa/identity';
+import { TENANT_REPOSITORY, Tenant } from '@soopa/identity';
 import { AuthGuard } from '@soopa/auth';
 import { UpdateTenantStatus } from './tenants.validation.js';
 
@@ -24,7 +24,7 @@ describe('TenantsController', () => {
       controllers: [TenantsController],
       providers: [
         {
-          provide: TENANT_PROVIDER,
+          provide: TENANT_REPOSITORY,
           useValue: mockTenantProvider,
         },
       ],

apps/api/src/modules/identity/tenants/tenants.controller.ts

@@ -12,14 +12,15 @@ import {
 import { Request } from 'express';
 import { AuthGuard, PermissionsGuard, RequirePermission } from '@soopa/auth';
 import { UpdateTenantStatus, UpdateTenantDto } from './tenants.validation.js';
-import { TENANT_PROVIDER } from '@soopa/identity';
-import type { ITenantProvider } from '@soopa/identity';
+import { TENANT_REPOSITORY } from '@soopa/identity';
+import type { ITenantRepository } from '@soopa/identity';
 
 @Controller('tenants')
 @UseGuards(AuthGuard, PermissionsGuard)
 export class TenantsController {
   constructor(
-    @Inject(TENANT_PROVIDER) private readonly tenantProvider: ITenantProvider,
+    @Inject(TENANT_REPOSITORY)
+    private readonly tenantProvider: ITenantRepository,
   ) {}
 
   @Get()