Integrate unfinished server-rs refactor worklists

server-rs/crates/module-auth/src/application.rs

@@ -1,3 +1,112 @@
-//! 认证应用编排过渡落位。
+//! 认证应用返回类型。
 //!
 //! 这里只返回纯应用结果与领域事件；短信 provider、JWT 签发和持久化由外层 adapter 完成。
+
+use serde::{Deserialize, Serialize};
+
+use crate::domain::{
+    AuthStoreSnapshotRecord, AuthUser, RefreshSessionRecord, WechatAuthStateRecord,
+};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AuthMeResult {
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PublicUserSearchResult {
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PasswordEntryResult {
+    pub user: AuthUser,
+    pub created: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ChangePasswordResult {
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ResetPasswordResult {
+    pub user: AuthUser,
+    pub provider: String,
+    pub provider_out_id: Option<String>,
+    pub phone_number_masked: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SendPhoneCodeResult {
+    pub cooldown_seconds: u64,
+    pub expires_in_seconds: u64,
+    pub provider_request_id: Option<String>,
+    pub provider_out_id: Option<String>,
+    pub provider: String,
+    pub scene: String,
+    pub phone_number_masked: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PhoneLoginResult {
+    pub user: AuthUser,
+    pub created: bool,
+    pub provider: String,
+    pub provider_out_id: Option<String>,
+    pub phone_number_masked: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ResolveWechatLoginResult {
+    pub user: AuthUser,
+    pub created: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CreateWechatAuthStateResult {
+    pub state: WechatAuthStateRecord,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ConsumeWechatAuthStateResult {
+    pub state: WechatAuthStateRecord,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct BindWechatPhoneResult {
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CreateRefreshSessionResult {
+    pub session: RefreshSessionRecord,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RotateRefreshSessionResult {
+    pub session: RefreshSessionRecord,
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ListActiveRefreshSessionsResult {
+    pub sessions: Vec<RefreshSessionRecord>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct LogoutCurrentSessionResult {
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct LogoutAllSessionsResult {
+    pub user: AuthUser,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AuthStoreSnapshotProcedureResult {
+    pub ok: bool,
+    pub record: Option<AuthStoreSnapshotRecord>,
+    pub error_message: Option<String>,
+}

server-rs/crates/module-auth/src/commands.rs

@@ -1,3 +1,92 @@
-//! 认证写入命令过渡落位。
+//! 认证写入命令。
 //!
 //! 用于表达密码入口、手机号验证码、微信登录、刷新会话签发和吊销等用例输入。
+
+use serde::{Deserialize, Serialize};
+
+use crate::domain::{
+    AuthLoginMethod, PhoneAuthScene, RefreshSessionClientInfo, WechatAuthScene,
+    WechatIdentityProfile,
+};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PasswordEntryInput {
+    pub phone_number: String,
+    pub password: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ChangePasswordInput {
+    pub user_id: String,
+    pub current_password: Option<String>,
+    pub new_password: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ResetPasswordInput {
+    pub phone_number: String,
+    pub verify_code: String,
+    pub new_password: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SendPhoneCodeInput {
+    pub phone_number: String,
+    pub scene: PhoneAuthScene,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PhoneLoginInput {
+    pub phone_number: String,
+    pub verify_code: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ResolveWechatLoginInput {
+    pub profile: WechatIdentityProfile,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CreateWechatAuthStateInput {
+    pub redirect_path: String,
+    pub scene: WechatAuthScene,
+    pub request_user_agent: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct BindWechatPhoneInput {
+    pub user_id: String,
+    pub phone_number: String,
+    pub verify_code: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CreateRefreshSessionInput {
+    pub user_id: String,
+    pub refresh_token_hash: String,
+    pub issued_by_provider: AuthLoginMethod,
+    pub client_info: RefreshSessionClientInfo,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RotateRefreshSessionInput {
+    pub refresh_token_hash: String,
+    pub next_refresh_token_hash: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct LogoutCurrentSessionInput {
+    pub user_id: String,
+    pub refresh_token_hash: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct LogoutAllSessionsInput {
+    pub user_id: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AuthStoreSnapshotUpsertInput {
+    pub snapshot_json: String,
+    pub updated_at_micros: i64,
+}

server-rs/crates/module-auth/src/domain.rs

@@ -1,4 +1,252 @@
-//! 认证领域模型过渡落位。
+//! 认证领域模型。
 //!
-//! 后续迁移账号、刷新会话、验证码和微信绑定聚合时，只保留认证规则；
-//! 文件持久化、真实短信发送、cookie 写入和 HTTP 上下文都不属于领域核心。
+//! 这里只保留账号、登录方式、绑定状态等纯领域事实。文件持久化、真实短信发送、
+//! cookie 写入、JWT 签发和 HTTP 上下文都属于外层 adapter。
+
+use serde::{Deserialize, Serialize};
+
+use crate::errors::{PasswordEntryError, PhoneAuthError};
+
+pub const PASSWORD_MIN_LENGTH: usize = 6;
+pub const PASSWORD_MAX_LENGTH: usize = 128;
+pub const SMS_CODE_LENGTH: usize = 6;
+pub const SMS_CODE_TTL_MINUTES: i64 = 5;
+pub const SMS_CODE_COOLDOWN_SECONDS: u64 = 60;
+pub const SMS_CODE_MAX_FAILED_ATTEMPTS: u32 = 5;
+
+/// 用户最近一次完成认证的入口类型。
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AuthLoginMethod {
+    Password,
+    Phone,
+    Wechat,
+}
+
+impl AuthLoginMethod {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Password => "password",
+            Self::Phone => "phone",
+            Self::Wechat => "wechat",
+        }
+    }
+}
+
+/// 账号是否已经完成必要绑定。
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AuthBindingStatus {
+    Active,
+    PendingBindPhone,
+}
+
+impl AuthBindingStatus {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Active => "active",
+            Self::PendingBindPhone => "pending_bind_phone",
+        }
+    }
+}
+
+/// 认证用户快照。
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AuthUser {
+    pub id: String,
+    pub public_user_code: String,
+    pub username: String,
+    pub display_name: String,
+    pub phone_number_masked: Option<String>,
+    pub login_method: AuthLoginMethod,
+    pub binding_status: AuthBindingStatus,
+    pub wechat_bound: bool,
+    pub token_version: u64,
+}
+
+/// 规范化后的手机号快照。
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PhoneNumberSnapshot {
+    pub e164: String,
+    pub masked_national_number: String,
+}
+
+/// 手机验证码使用场景。
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum PhoneAuthScene {
+    Login,
+    BindPhone,
+    ChangePhone,
+    ResetPassword,
+}
+
+impl PhoneAuthScene {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Login => "login",
+            Self::BindPhone => "bind_phone",
+            Self::ChangePhone => "change_phone",
+            Self::ResetPassword => "reset_password",
+        }
+    }
+}
+
+/// 微信授权入口场景。
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum WechatAuthScene {
+    Desktop,
+    WechatInApp,
+}
+
+impl WechatAuthScene {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Desktop => "desktop",
+            Self::WechatInApp => "wechat_in_app",
+        }
+    }
+}
+
+/// 微信身份资料快照。
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct WechatIdentityProfile {
+    pub provider_uid: String,
+    pub provider_union_id: Option<String>,
+    pub display_name: Option<String>,
+    pub avatar_url: Option<String>,
+}
+
+/// 微信授权 state 快照。
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct WechatAuthStateRecord {
+    pub wechat_state_id: String,
+    pub state_token: String,
+    pub redirect_path: String,
+    pub scene: WechatAuthScene,
+    pub request_user_agent: Option<String>,
+    pub expires_at: String,
+    pub consumed_at: Option<String>,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+/// refresh session 的客户端环境快照。
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RefreshSessionClientInfo {
+    pub client_type: String,
+    pub client_runtime: String,
+    pub client_platform: String,
+    pub client_instance_id: Option<String>,
+    pub device_fingerprint: Option<String>,
+    pub device_display_name: String,
+    pub mini_program_app_id: Option<String>,
+    pub mini_program_env: Option<String>,
+    pub user_agent: Option<String>,
+    pub ip: Option<String>,
+}
+
+/// refresh session 快照。
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RefreshSessionRecord {
+    pub session_id: String,
+    pub user_id: String,
+    pub refresh_token_hash: String,
+    pub issued_by_provider: AuthLoginMethod,
+    pub client_info: RefreshSessionClientInfo,
+    pub expires_at: String,
+    pub revoked_at: Option<String>,
+    pub created_at: String,
+    pub updated_at: String,
+    pub last_seen_at: String,
+}
+
+/// Auth store 持久化快照记录。
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AuthStoreSnapshotRecord {
+    pub snapshot_json: Option<String>,
+    pub updated_at_micros: Option<i64>,
+}
+
+pub fn validate_password(password: &str) -> Result<(), PasswordEntryError> {
+    let length = password.chars().count();
+    if !(PASSWORD_MIN_LENGTH..=PASSWORD_MAX_LENGTH).contains(&length) {
+        return Err(PasswordEntryError::InvalidPasswordLength);
+    }
+
+    Ok(())
+}
+
+pub fn verify_sms_code_format(verify_code: &str) -> Result<(), PhoneAuthError> {
+    let verify_code = verify_code.trim();
+    if verify_code.len() != SMS_CODE_LENGTH
+        || !verify_code
+            .chars()
+            .all(|character| character.is_ascii_digit())
+    {
+        return Err(PhoneAuthError::InvalidVerifyCode);
+    }
+
+    Ok(())
+}
+
+pub fn normalize_mainland_china_phone_number(
+    raw_phone_number: &str,
+) -> Result<PhoneNumberSnapshot, PhoneAuthError> {
+    let digits = raw_phone_number
+        .trim()
+        .chars()
+        .filter(|character| character.is_ascii_digit())
+        .collect::<String>();
+    if digits.len() != 11 || !digits.starts_with('1') {
+        return Err(PhoneAuthError::InvalidPhoneNumber);
+    }
+
+    Ok(PhoneNumberSnapshot {
+        e164: format!("+86{digits}"),
+        masked_national_number: mask_phone_number(&digits),
+    })
+}
+
+pub fn mask_phone_number(phone_number: &str) -> String {
+    format!("{}****{}", &phone_number[..3], &phone_number[7..11])
+}
+
+pub fn build_national_phone_number(e164_phone_number: &str) -> Result<String, PhoneAuthError> {
+    let digits = e164_phone_number.trim().trim_start_matches('+');
+    if let Some(national) = digits.strip_prefix("86")
+        && national.len() == 11
+    {
+        return Ok(national.to_string());
+    }
+    Err(PhoneAuthError::InvalidPhoneNumber)
+}
+
+pub fn build_system_username(prefix: &str, sequence: u64) -> String {
+    format!("{prefix}_{sequence:08}")
+}
+
+// 公开叙世号是稳定的公开检索键，不替代内部 user_id，仅用于展示、分享与搜索。
+pub fn build_public_user_code(sequence: u64) -> String {
+    format!("SY-{sequence:08}")
+}
+
+pub fn normalize_public_user_code(input: &str) -> Result<String, PasswordEntryError> {
+    let normalized = input
+        .trim()
+        .chars()
+        .filter(|character| character.is_ascii_alphanumeric())
+        .collect::<String>()
+        .to_ascii_uppercase();
+    let digits = normalized.strip_prefix("SY").unwrap_or(&normalized);
+
+    if digits.is_empty()
+        || digits.len() > 8
+        || !digits.chars().all(|character| character.is_ascii_digit())
+    {
+        return Err(PasswordEntryError::InvalidPublicUserCode);
+    }
+
+    Ok(format!("SY-{digits:0>8}"))
+}
+
+pub fn build_phone_code_key(phone_number: &str, scene: &PhoneAuthScene) -> String {
+    format!("{}:{}", phone_number.trim(), scene.as_str())
+}

server-rs/crates/module-auth/src/errors.rs

@@ -1,3 +1,179 @@
-//! 认证领域错误过渡落位。
+//! 认证领域错误。
 //!
 //! 领域错误保持可测试、可映射，不能直接依赖 Axum、cookie 或平台 provider 错误模型。
+
+use std::{error::Error, fmt};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum PasswordEntryError {
+    InvalidPhoneNumber,
+    InvalidPasswordLength,
+    InvalidPublicUserCode,
+    InvalidCredentials,
+    UserNotFound,
+    Store(String),
+    PasswordHash(String),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum PhoneAuthError {
+    InvalidPhoneNumber,
+    InvalidVerifyCode,
+    VerifyCodeNotFound,
+    VerifyCodeExpired,
+    SendCoolingDown { retry_after_seconds: u64 },
+    VerifyAttemptsExceeded,
+    UserNotFound,
+    UserStateMismatch,
+    Store(String),
+    PasswordHash(String),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum WechatAuthError {
+    MissingProfile,
+    StateNotFound,
+    StateExpired,
+    StateConsumed,
+    UserNotFound,
+    MissingWechatIdentity,
+    Store(String),
+    PasswordHash(String),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum RefreshSessionError {
+    MissingToken,
+    SessionNotFound,
+    SessionExpired,
+    UserNotFound,
+    Store(String),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum LogoutError {
+    UserNotFound,
+    Store(String),
+}
+
+impl fmt::Display for PasswordEntryError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidPhoneNumber => f.write_str("手机号格式不正确"),
+            Self::InvalidPasswordLength => f.write_str("密码长度需要在 6 到 128 位之间"),
+            Self::InvalidPublicUserCode => f.write_str("叙世号格式不正确"),
+            Self::InvalidCredentials => f.write_str("手机号或密码错误"),
+            Self::UserNotFound => f.write_str("用户不存在"),
+            Self::Store(message) | Self::PasswordHash(message) => f.write_str(message),
+        }
+    }
+}
+
+impl Error for PasswordEntryError {}
+
+impl fmt::Display for PhoneAuthError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidPhoneNumber => f.write_str("手机号格式不正确"),
+            Self::InvalidVerifyCode => f.write_str("验证码错误"),
+            Self::VerifyCodeNotFound => f.write_str("验证码不存在或已失效"),
+            Self::VerifyCodeExpired => f.write_str("验证码已过期"),
+            Self::SendCoolingDown { .. } => f.write_str("验证码发送过于频繁，请稍后再试"),
+            Self::VerifyAttemptsExceeded => f.write_str("验证码错误次数过多，请重新获取验证码"),
+            Self::UserNotFound => f.write_str("用户不存在"),
+            Self::UserStateMismatch => f.write_str("当前账号状态不允许执行该操作"),
+            Self::Store(message) | Self::PasswordHash(message) => f.write_str(message),
+        }
+    }
+}
+
+impl Error for PhoneAuthError {}
+
+impl fmt::Display for WechatAuthError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::MissingProfile => f.write_str("缺少微信身份信息"),
+            Self::StateNotFound => f.write_str("微信登录状态已失效，请重新发起登录"),
+            Self::StateExpired => f.write_str("微信登录状态已过期，请重新发起登录"),
+            Self::StateConsumed => f.write_str("微信登录状态已被消费，请重新发起登录"),
+            Self::UserNotFound => f.write_str("用户不存在"),
+            Self::MissingWechatIdentity => f.write_str("当前账号缺少微信身份"),
+            Self::Store(message) | Self::PasswordHash(message) => f.write_str(message),
+        }
+    }
+}
+
+impl Error for WechatAuthError {}
+
+impl fmt::Display for RefreshSessionError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::MissingToken => f.write_str("缺少刷新会话"),
+            Self::SessionNotFound | Self::SessionExpired | Self::UserNotFound => {
+                f.write_str("当前登录态已失效，请重新登录")
+            }
+            Self::Store(message) => f.write_str(message),
+        }
+    }
+}
+
+impl Error for RefreshSessionError {}
+
+impl fmt::Display for LogoutError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::UserNotFound => f.write_str("当前登录态已失效，请重新登录"),
+            Self::Store(message) => f.write_str(message),
+        }
+    }
+}
+
+impl Error for LogoutError {}
+
+pub(crate) fn map_password_store_error(error: PasswordEntryError) -> RefreshSessionError {
+    match error {
+        PasswordEntryError::Store(message) => RefreshSessionError::Store(message),
+        PasswordEntryError::InvalidPhoneNumber
+        | PasswordEntryError::InvalidPasswordLength
+        | PasswordEntryError::InvalidPublicUserCode
+        | PasswordEntryError::InvalidCredentials
+        | PasswordEntryError::UserNotFound
+        | PasswordEntryError::PasswordHash(_) => {
+            RefreshSessionError::Store("用户仓储读取失败".to_string())
+        }
+    }
+}
+
+pub(crate) fn map_password_error_to_phone_error(error: PasswordEntryError) -> PhoneAuthError {
+    match error {
+        PasswordEntryError::Store(message) => PhoneAuthError::Store(message),
+        PasswordEntryError::PasswordHash(message) => PhoneAuthError::PasswordHash(message),
+        PasswordEntryError::InvalidPhoneNumber
+        | PasswordEntryError::InvalidPasswordLength
+        | PasswordEntryError::InvalidPublicUserCode
+        | PasswordEntryError::InvalidCredentials
+        | PasswordEntryError::UserNotFound => PhoneAuthError::Store("用户仓储读取失败".to_string()),
+    }
+}
+
+pub(crate) fn map_password_error_to_logout_error(error: PasswordEntryError) -> LogoutError {
+    match error {
+        PasswordEntryError::Store(message) => LogoutError::Store(message),
+        PasswordEntryError::InvalidPhoneNumber
+        | PasswordEntryError::InvalidPasswordLength
+        | PasswordEntryError::InvalidPublicUserCode
+        | PasswordEntryError::InvalidCredentials
+        | PasswordEntryError::UserNotFound
+        | PasswordEntryError::PasswordHash(_) => LogoutError::Store("用户仓储读取失败".to_string()),
+    }
+}
+
+pub(crate) fn map_refresh_error_to_logout_error(error: RefreshSessionError) -> LogoutError {
+    match error {
+        RefreshSessionError::Store(message) => LogoutError::Store(message),
+        RefreshSessionError::MissingToken
+        | RefreshSessionError::SessionNotFound
+        | RefreshSessionError::SessionExpired
+        | RefreshSessionError::UserNotFound => LogoutError::Store("会话吊销失败".to_string()),
+    }
+}

server-rs/crates/module-auth/src/events.rs

@@ -1,3 +1,27 @@
-//! 认证领域事件过渡落位。
+//! 认证领域事件。
 //!
 //! 用于表达用户创建、会话签发/吊销、手机号验证通过和微信身份绑定等事实。
+
+use crate::domain::AuthLoginMethod;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum AuthDomainEvent {
+    UserCreated {
+        user_id: String,
+        login_method: AuthLoginMethod,
+    },
+    RefreshSessionIssued {
+        session_id: String,
+        user_id: String,
+    },
+    RefreshSessionRevoked {
+        session_id: String,
+        user_id: String,
+    },
+    PhoneVerified {
+        user_id: String,
+    },
+    WechatIdentityBound {
+        user_id: String,
+    },
+}

server-rs/crates/module-auth/src/lib.rs

@@ -4,10 +4,15 @@ mod domain;
 mod errors;
 mod events;
 
+pub use application::*;
+pub use commands::*;
+pub use domain::*;
+pub use errors::*;
+pub use events::*;
+
 use std::{
     collections::HashMap,
-    error::Error,
-    fmt, fs,
+    fs,
     path::{Path, PathBuf},
     sync::{Arc, Mutex},
 };
@@ -24,351 +29,6 @@ use shared_kernel::{
 use time::{Duration, OffsetDateTime};
 use tracing::{info, warn};
 
-const PASSWORD_MIN_LENGTH: usize = 6;
-const PASSWORD_MAX_LENGTH: usize = 128;
-const SMS_CODE_LENGTH: usize = 6;
-const SMS_CODE_TTL_MINUTES: i64 = 5;
-const SMS_CODE_COOLDOWN_SECONDS: u64 = 60;
-const SMS_CODE_MAX_FAILED_ATTEMPTS: u32 = 5;
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AuthLoginMethod {
-    Password,
-    Phone,
-    Wechat,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AuthBindingStatus {
-    Active,
-    PendingBindPhone,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AuthUser {
-    pub id: String,
-    pub public_user_code: String,
-    pub username: String,
-    pub display_name: String,
-    pub phone_number_masked: Option<String>,
-    pub login_method: AuthLoginMethod,
-    pub binding_status: AuthBindingStatus,
-    pub wechat_bound: bool,
-    pub token_version: u64,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct AuthMeResult {
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PublicUserSearchResult {
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PasswordEntryInput {
-    pub phone_number: String,
-    pub password: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PasswordEntryResult {
-    pub user: AuthUser,
-    pub created: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ChangePasswordInput {
-    pub user_id: String,
-    pub current_password: Option<String>,
-    pub new_password: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ChangePasswordResult {
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ResetPasswordInput {
-    pub phone_number: String,
-    pub verify_code: String,
-    pub new_password: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ResetPasswordResult {
-    pub user: AuthUser,
-    pub provider: String,
-    pub provider_out_id: Option<String>,
-    pub phone_number_masked: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum PhoneAuthScene {
-    Login,
-    BindPhone,
-    ChangePhone,
-    ResetPassword,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PhoneNumberSnapshot {
-    pub e164: String,
-    pub masked_national_number: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct SendPhoneCodeInput {
-    pub phone_number: String,
-    pub scene: PhoneAuthScene,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct SendPhoneCodeResult {
-    pub cooldown_seconds: u64,
-    pub expires_in_seconds: u64,
-    pub provider_request_id: Option<String>,
-    pub provider_out_id: Option<String>,
-    pub provider: String,
-    pub scene: String,
-    pub phone_number_masked: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PhoneLoginInput {
-    pub phone_number: String,
-    pub verify_code: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PhoneLoginResult {
-    pub user: AuthUser,
-    pub created: bool,
-    pub provider: String,
-    pub provider_out_id: Option<String>,
-    pub phone_number_masked: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct WechatIdentityProfile {
-    pub provider_uid: String,
-    pub provider_union_id: Option<String>,
-    pub display_name: Option<String>,
-    pub avatar_url: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ResolveWechatLoginInput {
-    pub profile: WechatIdentityProfile,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ResolveWechatLoginResult {
-    pub user: AuthUser,
-    pub created: bool,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum WechatAuthScene {
-    Desktop,
-    WechatInApp,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CreateWechatAuthStateInput {
-    pub redirect_path: String,
-    pub scene: WechatAuthScene,
-    pub request_user_agent: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct WechatAuthStateRecord {
-    pub wechat_state_id: String,
-    pub state_token: String,
-    pub redirect_path: String,
-    pub scene: WechatAuthScene,
-    pub request_user_agent: Option<String>,
-    pub expires_at: String,
-    pub consumed_at: Option<String>,
-    pub created_at: String,
-    pub updated_at: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CreateWechatAuthStateResult {
-    pub state: WechatAuthStateRecord,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ConsumeWechatAuthStateResult {
-    pub state: WechatAuthStateRecord,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct BindWechatPhoneInput {
-    pub user_id: String,
-    pub phone_number: String,
-    pub verify_code: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct BindWechatPhoneResult {
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CreateRefreshSessionInput {
-    pub user_id: String,
-    pub refresh_token_hash: String,
-    pub issued_by_provider: AuthLoginMethod,
-    pub client_info: RefreshSessionClientInfo,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct RefreshSessionClientInfo {
-    pub client_type: String,
-    pub client_runtime: String,
-    pub client_platform: String,
-    pub client_instance_id: Option<String>,
-    pub device_fingerprint: Option<String>,
-    pub device_display_name: String,
-    pub mini_program_app_id: Option<String>,
-    pub mini_program_env: Option<String>,
-    pub user_agent: Option<String>,
-    pub ip: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct RefreshSessionRecord {
-    pub session_id: String,
-    pub user_id: String,
-    pub refresh_token_hash: String,
-    pub issued_by_provider: AuthLoginMethod,
-    pub client_info: RefreshSessionClientInfo,
-    pub expires_at: String,
-    pub revoked_at: Option<String>,
-    pub created_at: String,
-    pub updated_at: String,
-    pub last_seen_at: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct CreateRefreshSessionResult {
-    pub session: RefreshSessionRecord,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct RotateRefreshSessionInput {
-    pub refresh_token_hash: String,
-    pub next_refresh_token_hash: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct RotateRefreshSessionResult {
-    pub session: RefreshSessionRecord,
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct ListActiveRefreshSessionsResult {
-    pub sessions: Vec<RefreshSessionRecord>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct LogoutCurrentSessionInput {
-    pub user_id: String,
-    pub refresh_token_hash: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct LogoutCurrentSessionResult {
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct LogoutAllSessionsInput {
-    pub user_id: String,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct LogoutAllSessionsResult {
-    pub user: AuthUser,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AuthStoreSnapshotRecord {
-    pub snapshot_json: Option<String>,
-    pub updated_at_micros: Option<i64>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AuthStoreSnapshotUpsertInput {
-    pub snapshot_json: String,
-    pub updated_at_micros: i64,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AuthStoreSnapshotProcedureResult {
-    pub ok: bool,
-    pub record: Option<AuthStoreSnapshotRecord>,
-    pub error_message: Option<String>,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum PasswordEntryError {
-    InvalidPhoneNumber,
-    InvalidPasswordLength,
-    InvalidPublicUserCode,
-    InvalidCredentials,
-    UserNotFound,
-    Store(String),
-    PasswordHash(String),
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum PhoneAuthError {
-    InvalidPhoneNumber,
-    InvalidVerifyCode,
-    VerifyCodeNotFound,
-    VerifyCodeExpired,
-    SendCoolingDown { retry_after_seconds: u64 },
-    VerifyAttemptsExceeded,
-    UserNotFound,
-    UserStateMismatch,
-    Store(String),
-    PasswordHash(String),
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum WechatAuthError {
-    MissingProfile,
-    StateNotFound,
-    StateExpired,
-    StateConsumed,
-    UserNotFound,
-    MissingWechatIdentity,
-    Store(String),
-    PasswordHash(String),
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum RefreshSessionError {
-    MissingToken,
-    SessionNotFound,
-    SessionExpired,
-    UserNotFound,
-    Store(String),
-}
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum LogoutError {
-    UserNotFound,
-    Store(String),
-}
-
 #[derive(Clone, Debug)]
 pub struct InMemoryAuthStore {
     inner: Arc<Mutex<InMemoryAuthStoreState>>,
@@ -2126,137 +1786,6 @@ impl InMemoryAuthStore {
     }
 }
 
-impl AuthLoginMethod {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Password => "password",
-            Self::Phone => "phone",
-            Self::Wechat => "wechat",
-        }
-    }
-}
-
-impl AuthBindingStatus {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Active => "active",
-            Self::PendingBindPhone => "pending_bind_phone",
-        }
-    }
-}
-
-impl fmt::Display for PasswordEntryError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::InvalidPhoneNumber => f.write_str("手机号格式不正确"),
-            Self::InvalidPasswordLength => f.write_str("密码长度需要在 6 到 128 位之间"),
-            Self::InvalidPublicUserCode => f.write_str("叙世号格式不正确"),
-            Self::InvalidCredentials => f.write_str("手机号或密码错误"),
-            Self::UserNotFound => f.write_str("用户不存在"),
-            Self::Store(message) | Self::PasswordHash(message) => f.write_str(message),
-        }
-    }
-}
-
-impl Error for PasswordEntryError {}
-
-impl fmt::Display for PhoneAuthError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::InvalidPhoneNumber => f.write_str("手机号格式不正确"),
-            Self::InvalidVerifyCode => f.write_str("验证码错误"),
-            Self::VerifyCodeNotFound => f.write_str("验证码不存在或已失效"),
-            Self::VerifyCodeExpired => f.write_str("验证码已过期"),
-            Self::SendCoolingDown { .. } => f.write_str("验证码发送过于频繁，请稍后再试"),
-            Self::VerifyAttemptsExceeded => f.write_str("验证码错误次数过多，请重新获取验证码"),
-            Self::UserNotFound => f.write_str("用户不存在"),
-            Self::UserStateMismatch => f.write_str("当前账号状态不允许执行该操作"),
-            Self::Store(message) | Self::PasswordHash(message) => f.write_str(message),
-        }
-    }
-}
-
-impl Error for PhoneAuthError {}
-
-impl fmt::Display for WechatAuthError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::MissingProfile => f.write_str("缺少微信身份信息"),
-            Self::StateNotFound => f.write_str("微信登录状态已失效，请重新发起登录"),
-            Self::StateExpired => f.write_str("微信登录状态已过期，请重新发起登录"),
-            Self::StateConsumed => f.write_str("微信登录状态已被消费，请重新发起登录"),
-            Self::UserNotFound => f.write_str("用户不存在"),
-            Self::MissingWechatIdentity => f.write_str("当前账号缺少微信身份"),
-            Self::Store(message) | Self::PasswordHash(message) => f.write_str(message),
-        }
-    }
-}
-
-impl Error for WechatAuthError {}
-
-impl fmt::Display for RefreshSessionError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::MissingToken => f.write_str("缺少刷新会话"),
-            Self::SessionNotFound | Self::SessionExpired | Self::UserNotFound => {
-                f.write_str("当前登录态已失效，请重新登录")
-            }
-            Self::Store(message) => f.write_str(message),
-        }
-    }
-}
-
-impl Error for RefreshSessionError {}
-
-impl fmt::Display for LogoutError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::UserNotFound => f.write_str("当前登录态已失效，请重新登录"),
-            Self::Store(message) => f.write_str(message),
-        }
-    }
-}
-
-impl Error for LogoutError {}
-
-fn map_password_store_error(error: PasswordEntryError) -> RefreshSessionError {
-    match error {
-        PasswordEntryError::Store(message) => RefreshSessionError::Store(message),
-        PasswordEntryError::InvalidPhoneNumber
-        | PasswordEntryError::InvalidPasswordLength
-        | PasswordEntryError::InvalidPublicUserCode
-        | PasswordEntryError::InvalidCredentials
-        | PasswordEntryError::UserNotFound
-        | PasswordEntryError::PasswordHash(_) => {
-            RefreshSessionError::Store("用户仓储读取失败".to_string())
-        }
-    }
-}
-
-fn map_password_error_to_phone_error(error: PasswordEntryError) -> PhoneAuthError {
-    match error {
-        PasswordEntryError::Store(message) => PhoneAuthError::Store(message),
-        PasswordEntryError::PasswordHash(message) => PhoneAuthError::PasswordHash(message),
-        PasswordEntryError::InvalidPhoneNumber
-        | PasswordEntryError::InvalidPasswordLength
-        | PasswordEntryError::InvalidPublicUserCode
-        | PasswordEntryError::InvalidCredentials
-        | PasswordEntryError::UserNotFound => PhoneAuthError::Store("用户仓储读取失败".to_string()),
-    }
-}
-
-fn map_password_error_to_logout_error(error: PasswordEntryError) -> LogoutError {
-    match error {
-        PasswordEntryError::Store(message) => LogoutError::Store(message),
-        PasswordEntryError::InvalidPhoneNumber
-        | PasswordEntryError::InvalidPasswordLength
-        | PasswordEntryError::InvalidPublicUserCode
-        | PasswordEntryError::InvalidCredentials
-        | PasswordEntryError::UserNotFound
-        | PasswordEntryError::PasswordHash(_) => LogoutError::Store("用户仓储读取失败".to_string()),
-    }
-}
-
 fn map_sms_provider_error_to_phone_error(error: SmsProviderError) -> PhoneAuthError {
     match error {
         SmsProviderError::InvalidVerifyCode => PhoneAuthError::InvalidVerifyCode,
@@ -2266,25 +1795,6 @@ fn map_sms_provider_error_to_phone_error(error: SmsProviderError) -> PhoneAuthEr
     }
 }
 
-fn map_refresh_error_to_logout_error(error: RefreshSessionError) -> LogoutError {
-    match error {
-        RefreshSessionError::Store(message) => LogoutError::Store(message),
-        RefreshSessionError::MissingToken
-        | RefreshSessionError::SessionNotFound
-        | RefreshSessionError::SessionExpired
-        | RefreshSessionError::UserNotFound => LogoutError::Store("会话吊销失败".to_string()),
-    }
-}
-
-fn validate_password(password: &str) -> Result<(), PasswordEntryError> {
-    let length = password.chars().count();
-    if !(PASSWORD_MIN_LENGTH..=PASSWORD_MAX_LENGTH).contains(&length) {
-        return Err(PasswordEntryError::InvalidPasswordLength);
-    }
-
-    Ok(())
-}
-
 async fn verify_stored_password_user(
     existing_user: StoredPasswordUser,
     password: &str,
@@ -2309,51 +1819,6 @@ async fn verify_stored_password_user(
     })
 }
 
-fn verify_sms_code_format(verify_code: &str) -> Result<(), PhoneAuthError> {
-    let verify_code = verify_code.trim();
-    if verify_code.len() != SMS_CODE_LENGTH
-        || !verify_code
-            .chars()
-            .all(|character| character.is_ascii_digit())
-    {
-        return Err(PhoneAuthError::InvalidVerifyCode);
-    }
-
-    Ok(())
-}
-
-fn normalize_mainland_china_phone_number(
-    raw_phone_number: &str,
-) -> Result<PhoneNumberSnapshot, PhoneAuthError> {
-    let digits = raw_phone_number
-        .trim()
-        .chars()
-        .filter(|character| character.is_ascii_digit())
-        .collect::<String>();
-    if digits.len() != 11 || !digits.starts_with('1') {
-        return Err(PhoneAuthError::InvalidPhoneNumber);
-    }
-
-    Ok(PhoneNumberSnapshot {
-        e164: format!("+86{digits}"),
-        masked_national_number: mask_phone_number(&digits),
-    })
-}
-
-fn mask_phone_number(phone_number: &str) -> String {
-    format!("{}****{}", &phone_number[..3], &phone_number[7..11])
-}
-
-fn build_national_phone_number(e164_phone_number: &str) -> Result<String, PhoneAuthError> {
-    let digits = e164_phone_number.trim().trim_start_matches('+');
-    if let Some(national) = digits.strip_prefix("86")
-        && national.len() == 11
-    {
-        return Ok(national.to_string());
-    }
-    Err(PhoneAuthError::InvalidPhoneNumber)
-}
-
 fn build_random_password_seed() -> String {
     format!(
         "seed_{}_{}",
@@ -2362,34 +1827,6 @@ fn build_random_password_seed() -> String {
     )
 }
 
-fn build_system_username(prefix: &str, sequence: u64) -> String {
-    format!("{prefix}_{sequence:08}")
-}
-
-// 公开叙世号是稳定的公开检索键，不替代内部 user_id，仅用于展示、分享与搜索。
-fn build_public_user_code(sequence: u64) -> String {
-    format!("SY-{sequence:08}")
-}
-
-pub fn normalize_public_user_code(input: &str) -> Result<String, PasswordEntryError> {
-    let normalized = input
-        .trim()
-        .chars()
-        .filter(|character| character.is_ascii_alphanumeric())
-        .collect::<String>()
-        .to_ascii_uppercase();
-    let digits = normalized.strip_prefix("SY").unwrap_or(&normalized);
-
-    if digits.is_empty()
-        || digits.len() > 8
-        || !digits.chars().all(|character| character.is_ascii_digit())
-    {
-        return Err(PasswordEntryError::InvalidPublicUserCode);
-    }
-
-    Ok(format!("SY-{digits:0>8}"))
-}
-
 fn format_rfc3339(value: OffsetDateTime) -> Result<String, String> {
     format_shared_rfc3339(value)
 }
@@ -2404,10 +1841,6 @@ fn seconds_until(now: OffsetDateTime, target: OffsetDateTime) -> u64 {
     u64::try_from(seconds.max(1)).unwrap_or(1)
 }
 
-fn build_phone_code_key(phone_number: &str, scene: &PhoneAuthScene) -> String {
-    format!("{}:{}", phone_number.trim(), scene.as_str())
-}
-
 fn create_wechat_state_token() -> String {
     new_uuid_simple_string()
 }
@@ -2428,26 +1861,6 @@ fn parse_rfc3339_with_context(
         .map_err(|error| RefreshSessionError::Store(format!("{field_label}解析失败：{error}")))
 }
 
-impl PhoneAuthScene {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Login => "login",
-            Self::BindPhone => "bind_phone",
-            Self::ChangePhone => "change_phone",
-            Self::ResetPassword => "reset_password",
-        }
-    }
-}
-
-impl WechatAuthScene {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Desktop => "desktop",
-            Self::WechatInApp => "wechat_in_app",
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use platform_auth::{