Auth

Auth manages API identity and access flows through AuthController and AuthService, including registration, login, JWT refresh, email verification, password reset, logout, and current-user retrieval. It issues and exchanges authentication tokens, rejects missing or invalid users and tokens, and applies multi-tenant and role access checks through guards such as OrganizationGuard, ProjectOrgGuard, and PlatformAdminGuard. It also owns organization SAML configuration, metadata, SSO login, assertion handling, handoff codes, and domain discovery.

121 entities in atloria-monorepo/apps/api/src/auth. 37 other subsystems depend on it, which makes it the 2nd most depended-upon part of this codebase.

What it is made of

Its 121 entities sit in 27 files under atloria-monorepo/apps/api/src/auth: 58 doc comments, 18 HTTP endpoints, 14 classes, 10 services and 21 more. auth.controller.ts holds 10 of them — more than any other file here. SamlService declares 22 methods, the widest surface here.

Where work enters

3 controllers publish 18 HTTP endpoints — 12 POST, 5 GET and 1 PUT. They answer under /auth, /auth/saml and /auth/sso. AuthController carries 9 of them; the remaining 9 are split across 2 other controllers. 13 of them declare a guard — JwtAuthGuard on 13 and RolesGuard on 4 — and 5 declare none.

• AuthController — atloria-monorepo/apps/api/src/auth/auth.controller.ts:20
• register — atloria-monorepo/apps/api/src/auth/auth.controller.ts:26
• login — atloria-monorepo/apps/api/src/auth/auth.controller.ts:48
• refresh — atloria-monorepo/apps/api/src/auth/auth.controller.ts:66
• verifyEmail — atloria-monorepo/apps/api/src/auth/auth.controller.ts:83
• forgotPassword — atloria-monorepo/apps/api/src/auth/auth.controller.ts:93

How work moves through it

mermaid
flowchart LR
  AuthController0["AuthController"]
  AuthService10["AuthService"]
  AuthController0 --> AuthService10
  PrismaService20["PrismaService"]
  AuthService10 --> PrismaService20
  RedisService21["RedisService"]
  AuthService10 --> RedisService21
  EmailService22["EmailService"]
  AuthService10 --> EmailService22
  AuditService23["AuditService"]
  AuthService10 --> AuditService23
  stop["refused"]
  AuthService10 -. "UnauthorizedException" .-> stop

Work enters at AuthController and passes through 5 other components. Each step below is a dependency edge between two entities in this repository, followed outward in order.

1. AuthController takes the work first — atloria-monorepo/apps/api/src/auth/auth.controller.ts:20.
2. Next, AuthController hands off to AuthService — atloria-monorepo/apps/api/src/auth/auth.service.ts:30.
3. Finally, AuthService calls PrismaService, RedisService, EmailService and AuditService.

Where the work stops

• AuthService stops the work with UnauthorizedException when !user — “User not found”, in 2 places.
• AuthService stops the work with ConflictException when existingUser — “User with this email already exists”.

When a step fails

• AuthService handles failure in 2 places: it logs it and continues in 1, and lets it reach the caller in 1.
• PrismaService handles failure in 1 place: it lets it reach the caller in all 1.
• RedisService handles failure in 8 places: it discards it silently in 4, logs it and continues in 2, and turns it into a return value in 2.
• EmailService handles failure in 2 places: it turns it into a return value in all 2.

How it refuses and fails

11 of its components record a refusal or a failure handler. All 11 of them refuse work outright, under a condition written into the component itself. Their catch blocks handle a failure that already happened in 10 places. Of those 10, 3 turn it into a return value, 3 discard it without recording anything, 2 log it and continue and 2 let it reach the caller. SamlService holds 3 of the silent ones — a failure discarded silently leaves no trace for whoever debugs this later.

Boundaries

37 other subsystems depend on this one — Ai, Analytics, Api, Audience, Billing, Bitbucket, Boards, Branding, Capture, Changelog, Comment, Content Tasks, Doc Version, Docs Pr, Document, Documentation, Events, Git Sync, Github, Gitlab, Issues, L10n, Manuals Insights, Notification, Ops, Organization, Platform, Project, Reader Account, Scim, Sdk, Snippets, Support Agent, Technical Docs, Template, Tours, Trial. Changing what it exposes changes them.

Those 37 hold 44 edges between them, unevenly: Platform reaches in across 4 edges, while 33 of them hold one each. 44 edges arrive against 19 leaving — more of this repository reaches into it than it reaches out to. What they reach is narrower than the folder: 7 of its 121 members carry every inbound edge — AuthModule (37), SamlModule (2) and PlatformAdminGuard (1), plus 4 more. Of the 19 it sends out, 11 go to Database — more than to any other.

It depends on Database, Email, Audit, Reader Access, Billing, and on nothing else in this repository.

How this code is named

These conventions cover most of the codebase. Learning them is faster than reading an index — each one lets you find any member of its family without looking it up.