Service claw auth service

claw-auth-service

Rendered from .ai/manifests/ on every publish. Rules for this service: CLAUDE.md · guide: service guide.

Property	Value
Directory	apps/claw-auth-service
Port	4001
Database	postgresql
Test files	227 (vitest)
Internal packages	@claw/shared-auth, @claw/shared-constants, @claw/shared-rabbitmq, @claw/shared-types, @claw/shared-utilities

Persistence models

• CreditFreeAllowanceUsage
• CreditLedgerEntry
• CreditPackage
• CreditPackageVersion
• DeploymentCredential
• DeviceAuthorizationGrant
• EmailChangeRequest
• EmailVerificationToken
• EntitlementInboxEvent
• FeatureUsageRecord
• OpsAccessToken
• PasswordResetToken
• Plan
• PlanFeatureRule
• PlanModelAccess
• PlanPriceVersion
• PlanRetirementMigration
• PlanTrialRedemption
• PushSubscription
• Role
• RolePermission
• SeedExecution
• Session
• SessionAdminAudit
• SystemSetting
• ThreadJobBudget
• ThreadJobBudgetCall
• TokenUsageLedger
• User
• UserCreditWallet
• UserDeletionOutboxEvent
• UserNotification
• UserNotificationPreference
• UserPlanAssignment
• WeightedUsageRecord

HTTP API (162)

Method	Route	Source
GET	/admin/credit/packages	admin-credit.controller.ts
POST	/admin/credit/packages	admin-credit.controller.ts
POST	/admin/credit/packages/:id/versions	admin-credit.controller.ts
GET	/admin/credit/wallets/:userId	admin-credit.controller.ts
POST	/admin/credit/wallets/:userId/adjust	admin-credit.controller.ts
GET	/admin/deployment	deployment-admin.controller.ts
POST	/admin/deployment/automation	deployment-admin.controller.ts
DELETE	/admin/deployment/credentials	deployment-admin.controller.ts
PUT	/admin/deployment/credentials	deployment-admin.controller.ts
POST	/admin/deployment/reset	deployment-admin.controller.ts
GET	/admin/deployment/run	deployment-admin.controller.ts
POST	/admin/deployment/trigger	deployment-admin.controller.ts
GET	/admin/observability/filter-options	admin-observability.controller.ts
GET	/admin/observability/health	admin-observability.controller.ts
GET	/admin/observability/models	admin-observability.controller.ts
GET	/admin/observability/models/detail	admin-observability.controller.ts
GET	/admin/observability/overview	admin-observability.controller.ts
GET	/admin/observability/plans	admin-observability.controller.ts
GET	/admin/observability/providers	admin-observability.controller.ts
GET	/admin/observability/providers/:provider	admin-observability.controller.ts
GET	/admin/observability/users	admin-observability.controller.ts
GET	/admin/observability/users/export	admin-observability.controller.ts
GET	/admin/observability/workflows	admin-observability.controller.ts
GET	/admin/ops-tokens	admin-ops-token.controller.ts
POST	/admin/ops-tokens	admin-ops-token.controller.ts
DELETE	/admin/ops-tokens/:id	admin-ops-token.controller.ts
GET	/admin/plans	plans.controller.ts
POST	/admin/plans	plans.controller.ts
DELETE	/admin/plans/:id	plans.controller.ts
DELETE	/admin/plans/:id	plans.controller.ts
GET	/admin/plans/:id	plans.controller.ts
PATCH	/admin/plans/:id	plans.controller.ts
POST	/admin/plans/:id/activate	plans.controller.ts
POST	/admin/plans/:id/deactivate	plans.controller.ts
PUT	/admin/plans/:id/interval-discounts	plans.controller.ts
GET	/admin/plans/:id/interval-pricing	plans.controller.ts
PUT	/admin/plans/:id/model-access	plans.controller.ts
GET	/admin/plans/:id/price-versions	plans.controller.ts
POST	/admin/plans/:id/price-versions	plans.controller.ts
POST	/admin/plans/:id/set-default	plans.controller.ts
POST	/admin/plans/:id/set-popular	plans.controller.ts
GET	/admin/plans/:id/users	plans.controller.ts
DELETE	/admin/plans/popular	plans.controller.ts
POST	/admin/plans/reorder	plans.controller.ts
POST	/admin/plans/users/:userId/assign	plans.controller.ts
POST	/admin/plans/users/:userId/trial-days	plans.controller.ts
GET	/admin/roles	roles.controller.ts
POST	/admin/roles	roles.controller.ts
DELETE	/admin/roles/:id	roles.controller.ts
GET	/admin/roles/:id	roles.controller.ts
PATCH	/admin/roles/:id	roles.controller.ts
PUT	/admin/roles/:id/permissions	roles.controller.ts
GET	/admin/roles/permissions	roles.controller.ts
GET	/admin/settings	admin-system-setting.controller.ts
GET	/admin/settings/:key	admin-system-setting.controller.ts
PUT	/admin/settings/:key	admin-system-setting.controller.ts
GET	/admin/usage-analytics	admin-usage-analytics.controller.ts
GET	/admin/usage-explorer/leaderboard	admin-usage-explorer.controller.ts
GET	/admin/usage-explorer/timeseries	admin-usage-explorer.controller.ts
GET	/admin/usage-explorer/users	admin-usage-explorer.controller.ts
GET	/admin/usage-explorer/users/:userId	admin-usage-explorer.controller.ts
GET	/admin/usage-explorer/users/:userId/requests	admin-usage-explorer.controller.ts
GET	/admin/usage-explorer/users/export	admin-usage-explorer.controller.ts
GET	/admin/users/:userId/plan-overview	admin-user-statistics.controller.ts
GET	/admin/users/:userId/usage-breakdown	admin-user-statistics.controller.ts
GET	/admin/users/:userId/usage-statistics	admin-user-statistics.controller.ts
POST	/auth/email-change/confirm	auth.controller.ts
POST	/auth/email-verification/confirm	auth.controller.ts
POST	/auth/email-verification/resend	auth.controller.ts
POST	/auth/grafana-access	grafana-access.controller.ts
GET	/auth/grafana-access/verify	grafana-access.controller.ts
POST	/auth/login	auth.controller.ts
POST	/auth/logout	auth.controller.ts
GET	/auth/me	auth.controller.ts
GET	/auth/me/entitlements	me-entitlements.controller.ts
GET	/auth/me/organizations/:organizationId/usage	me-usage-attribution.controller.ts
GET	/auth/me/usage	me-entitlements.controller.ts
GET	/auth/me/usage/breakdown	me-usage-attribution.controller.ts
POST	/auth/password-reset/confirm	auth.controller.ts
POST	/auth/password-reset/request	auth.controller.ts
POST	/auth/refresh	auth.controller.ts
POST	/auth/register	auth.controller.ts
POST	/auth/session-security/challenge	session-global.controller.ts
POST	/auth/session-security/clear-logs	session-global.controller.ts
POST	/auth/session-security/terminate-all	session-global.controller.ts
POST	/auth/vscode/authorize/approve	vscode-authorization.controller.ts
POST	/auth/vscode/authorize/details	vscode-authorization.controller.ts
POST	/auth/vscode/authorize/exchange	vscode-authorization.controller.ts
POST	/auth/vscode/authorize/init	vscode-authorization.controller.ts
GET	/credit/me	credit.controller.ts
GET	/credit/me/ledger	credit.controller.ts
GET	/credit/packages	credit.controller.ts
GET	/health	health.controller.ts
GET	/internal/billing-metrics/provider-costs	provider-cost-metrics-internal.controller.ts
POST	/internal/credit/finalize	credit-internal.controller.ts
GET	/internal/credit/packages	credit-internal.controller.ts
GET	/internal/credit/packages/:id/active-version	credit-internal.controller.ts
POST	/internal/credit/release	credit-internal.controller.ts
POST	/internal/credit/reserve	credit-internal.controller.ts
GET	/internal/credit/wallet/:userId	credit-internal.controller.ts
POST	/internal/deployment/notify	deployment-internal.controller.ts
POST	/internal/ops-tokens/verify	ops-token-internal.controller.ts
GET	/internal/plans/catalog	plans-internal.controller.ts
GET	/internal/plans/price	plans-internal.controller.ts
GET	/internal/plans/price-versions/:id	plans-internal.controller.ts
POST	/internal/plans/retirement-migrations/:id/outcome	plans-internal.controller.ts
GET	/internal/plans/retirement-migrations/pending	plans-internal.controller.ts
POST	/internal/quota/features/consume	quota-internal.controller.ts
POST	/internal/quota/features/reserve	quota-internal.controller.ts
POST	/internal/quota/features/settle	quota-internal.controller.ts
POST	/internal/quota/finalize	quota-internal.controller.ts
POST	/internal/quota/release	quota-internal.controller.ts
POST	/internal/quota/reserve	quota-internal.controller.ts
POST	/internal/runtime/admissions	runtime-admission-internal.controller.ts
POST	/internal/runtime/admissions/release	runtime-admission-internal.controller.ts
POST	/internal/threads/budgets/calls/finalize	thread-job-budget-internal.controller.ts
POST	/internal/threads/budgets/calls/release	thread-job-budget-internal.controller.ts
POST	/internal/threads/budgets/calls/reserve	thread-job-budget-internal.controller.ts
POST	/internal/threads/budgets/close	thread-job-budget-internal.controller.ts
POST	/internal/threads/budgets/reserve	thread-job-budget-internal.controller.ts
POST	/internal/threads/budgets/summary	thread-job-budget-internal.controller.ts
GET	/internal/users/:id/entitlements	entitlements-internal.controller.ts
GET	/internal/users/:id/identity	users-internal.controller.ts
GET	/internal/users/:id/speech-preferences	users-internal.controller.ts
GET	/internal/users/by-username/:username	users-internal.controller.ts
POST	/internal/users/public-profiles	users-internal.controller.ts
GET	/notifications	notifications.controller.ts
POST	/notifications/:id/read	notifications.controller.ts
GET	/notifications/preferences	notifications.controller.ts
PUT	/notifications/preferences	notifications.controller.ts
GET	/notifications/push/config	notifications.controller.ts
DELETE	/notifications/push/subscriptions	notifications.controller.ts
POST	/notifications/push/subscriptions	notifications.controller.ts
POST	/notifications/read-all	notifications.controller.ts
GET	/users	users.controller.ts
POST	/users	users.controller.ts
DELETE	/users/:id	users.controller.ts
GET	/users/:id	users.controller.ts
PATCH	/users/:id	users.controller.ts
PATCH	/users/:id/activate	users.controller.ts
POST	/users/:id/ban	users.controller.ts
POST	/users/:id/password	users.controller.ts
PATCH	/users/:id/reactivate	users.controller.ts
PATCH	/users/:id/role	users.controller.ts
GET	/users/:id/sessions	session-admin.controller.ts
DELETE	/users/:id/sessions/:familyId/log	session-admin.controller.ts
POST	/users/:id/sessions/:familyId/terminate	session-admin.controller.ts
DELETE	/users/:id/sessions/logs	session-admin.controller.ts
POST	/users/:id/sessions/terminate-all	session-admin.controller.ts
POST	/users/:id/temporary-password	users.controller.ts
POST	/users/:id/unban	users.controller.ts
DELETE	/users/me	users.controller.ts
PATCH	/users/me	users.controller.ts
DELETE	/users/me/email-change	users.controller.ts
GET	/users/me/email-change	users.controller.ts
POST	/users/me/email-change	users.controller.ts
POST	/users/me/email-change/resend	users.controller.ts
POST	/users/me/email-change/verify-current	users.controller.ts
POST	/users/me/heartbeat	users.controller.ts
PATCH	/users/me/password	users.controller.ts
PATCH	/users/me/preferences	users.controller.ts
GET	/users/presence-summary	users.controller.ts

Events (inferred from source; verify before a critical change)

• Publishes: credit.balance.exhausted, credit.balance.low, credit.grant.renewed, log.server, user.activated, user.created, user.deactivated, user.deleted, user.login, user.logout, user.reactivated, user.role_changed, user.temporary_password_issued, user.updated
• Consumes: billing.credit.topup_reversed, billing.credit.topup_succeeded, billing.entitlement.reconcile_requested, billing.payment.chargeback, billing.payment.refunded, billing.subscription.activated, billing.subscription.cancelled, billing.subscription.downgraded, billing.subscription.expired, billing.subscription.renewed, billing.subscription.suspended, billing.subscription.upgraded, routing.model_cost.published, user.notification_requested