Auth refactor 4/10 — Unified middleware plugin factory + package test suite

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

The heart of the refactor: one shared Elysia plugin factory at @reloop/auth/middleware that every backend service will eventually mount. It takes injected config, validates both session cookies and API keys, caches results, and returns one canonical shape. It is fully tested at the package level but not yet adopted by any service.

Canonical context shape (from the grilling session):

type AuthContext = {
  userId: string;
  organizationId: string | null;   // null only via authNoOrg / platformAdmin routes
  role: string | null;
  authType: "session" | "apikey";  // legacy "auth" literal removed
};

Acceptance criteria

• Plugin factory accepts injected { baseUrl, redis, ttl } (default ttl 5s) — no hardcoded per-service values
• Registers macros: auth (fail-closed on missing active org), authNoOrg, apiKeyAuth, platformAdmin
• Returns the canonical AuthContext for both session and API-key paths
• Session results cached keyed by session token (extracted from cookie), plus a per-user index of tokens; writes both on cache miss
• Always checks the get-session HTTP response status before trusting it
• API-key path reuses the absorbed validation and derives organizationId from the key's owning organization
• Package-level test suite mounts the plugin on a throwaway Elysia app and covers session auth, API-key auth, caching, fail-closed org logic, and all four macros (401 vs 200 + AuthContext)
• No service consumes the plugin yet; tripwire (Auth refactor 1/10 — Test harness + characterization tripwire #44) still passes

Blocked by

• Auth refactor 2/10 — Single-source Better Auth config + split package exports #45
• Auth refactor 3/10 — Absorb the api-key package (expand) #46