0005: Services own domain operations
Shared Project and Application operations stay outside Auth and HTTP adapters
- Status: Accepted
- Date: 2026-09-09
- Decision maker: Trevor Gerhardt
Context
Auth once mixed Project and Application business operations with identity, organization access, and HTTP request details. The API needs domain operations that do not depend on headers or Drizzle rows.
Decision
@concourse/services owns Project and Application commands, queries, and permissions. Auth retains identity, sessions, organizations, members, invitations, SSO, and system users. Rackspace report verification remains app-local. Database-specific RSDB behavior uses isolated Services entry points under ADR 0011.
The API creates one request context from an authoritative session and audit request facts. Services receives that context. Organization operations also receive an explicit organization ID. Services enforces tenant scope and returns contract values. Framework adapters own headers, navigation, and response mapping. The Services guide owns operations and access rules.
Consequences
- Callers cannot bypass domain permissions by selecting a different transport.
- Services does not import Next.js, React, or API implementations.
- Auth remains the owner of its existing organization and identity operations.
History
Project and Application operations moved from Auth. The API also exposes remaining Auth operations without moving their ownership.