refactor: migrate to clean architecture with trait-based DI (v0.2.0)

Complete architectural overhaul across all 12 crates:

- Replace validator crate with zod-rs for all DTO validation
- Replace manual pagination with paginator-rs/paginator-sea-orm
- Migrate all modules (iam, cms, gacha, dimentorin) to clean architecture:
  domain → application → infrastructure layers
- Introduce trait-based DI (Arc<dyn Trait>) at every layer for repositories and services
- Delete all v1/ legacy SurrealDB-era code across every crate
- Replace opaque response helpers with typed IntoResponse structs (ApiSuccess, ApiCreated, ApiPaginated, ApiMessage)
- Remove dual_mode_repository, migration_validation_errors, validator.rs dead code
- Zero cargo clippy warnings; release build clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

imphnen-iam/src/auth/infrastructure/http/dto.rs

@@ -0,0 +1,100 @@
+use crate::users::infrastructure::http::dto::UsersDetailItemDto;
+use imphnen_libs::ZodValidate;
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+use zod_rs::prelude::*;
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, ZodSchema)]
+pub struct AuthLoginRequestDto {
+    #[zod(email, min_length(1))]
+    pub email: String,
+    #[zod(min_length(1))]
+    pub password: String,
+}
+
+impl ZodValidate for AuthLoginRequestDto {
+    fn zod_validate(value: &serde_json::Value) -> Result<Self, String> {
+        Self::validate_and_parse(value).map_err(|e| e.to_string())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, Default)]
+pub struct TokenDto {
+    pub access_token: String,
+    pub refresh_token: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema)]
+pub struct AuthLoginResponsetDto {
+    pub token: TokenDto,
+    pub user: UsersDetailItemDto,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, ZodSchema)]
+pub struct AuthRegisterRequestDto {
+    #[zod(email, min_length(1))]
+    pub email: String,
+    #[zod(min_length(8), regex(pattern = "^[A-Za-z\\d@$!%*?&]{8,}$"))]
+    pub password: String,
+    #[zod(min_length(2))]
+    pub fullname: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub phone_number: Option<String>,
+}
+
+impl ZodValidate for AuthRegisterRequestDto {
+    fn zod_validate(value: &serde_json::Value) -> Result<Self, String> {
+        Self::validate_and_parse(value).map_err(|e| e.to_string())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, ZodSchema)]
+pub struct AuthVerifyEmailRequestDto {
+    #[zod(email, min_length(1))]
+    pub email: String,
+    pub otp: u32,
+}
+
+impl ZodValidate for AuthVerifyEmailRequestDto {
+    fn zod_validate(value: &serde_json::Value) -> Result<Self, String> {
+        Self::validate_and_parse(value).map_err(|e| e.to_string())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, ZodSchema)]
+pub struct AuthResendOtpRequestDto {
+    #[zod(email, min_length(1))]
+    pub email: String,
+}
+
+impl ZodValidate for AuthResendOtpRequestDto {
+    fn zod_validate(value: &serde_json::Value) -> Result<Self, String> {
+        Self::validate_and_parse(value).map_err(|e| e.to_string())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, ZodSchema)]
+pub struct AuthRefreshTokenRequestDto {
+    #[zod(min_length(1))]
+    pub refresh_token: String,
+}
+
+impl ZodValidate for AuthRefreshTokenRequestDto {
+    fn zod_validate(value: &serde_json::Value) -> Result<Self, String> {
+        Self::validate_and_parse(value).map_err(|e| e.to_string())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, ToSchema, ZodSchema)]
+pub struct AuthNewPasswordRequestDto {
+    #[zod(min_length(1))]
+    pub token: String,
+    #[zod(min_length(8), regex(pattern = "^[A-Za-z\\d@$!%*?&]{8,}$"))]
+    pub password: String,
+}
+
+impl ZodValidate for AuthNewPasswordRequestDto {
+    fn zod_validate(value: &serde_json::Value) -> Result<Self, String> {
+        Self::validate_and_parse(value).map_err(|e| e.to_string())
+    }
+}

imphnen-iam/src/auth/infrastructure/http/handlers.rs

@@ -0,0 +1,156 @@
+use std::sync::Arc;
+use axum::{Extension, response::IntoResponse};
+use imphnen_libs::ValidatedJson;
+use imphnen_utils::{ApiSuccess, ApiMessage, AppError};
+use super::dto::{
+    AuthLoginRequestDto, AuthRegisterRequestDto, AuthResendOtpRequestDto,
+    AuthVerifyEmailRequestDto, AuthNewPasswordRequestDto, AuthRefreshTokenRequestDto,
+};
+use crate::auth::domain::AuthService;
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/login",
+    request_body = AuthLoginRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] Login successful"),
+        (status = 401, description = "[PUBLIC] Login failed")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_login(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthLoginRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    let resp = service.login(payload).await?;
+    Ok(ApiSuccess(resp))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/login-mentor",
+    request_body = AuthLoginRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] Mentor login successful"),
+        (status = 401, description = "[PUBLIC] Mentor login failed"),
+        (status = 403, description = "[PUBLIC] Forbidden - Not a mentor")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_login_mentor(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthLoginRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    let resp = service.login_mentor(payload).await?;
+    Ok(ApiSuccess(resp))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/register",
+    request_body = AuthRegisterRequestDto,
+    responses(
+        (status = 201, description = "[PUBLIC] Register successful"),
+        (status = 400, description = "[PUBLIC] Register failed")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_register(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthRegisterRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    service.register(payload).await?;
+    Ok(ApiMessage::created("Registration successful"))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/verify-email",
+    request_body = AuthVerifyEmailRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] Verify email successful"),
+        (status = 400, description = "[PUBLIC] Verify email failed")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_verify_email(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthVerifyEmailRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    service.verify_email(payload).await?;
+    Ok(ApiMessage::ok("Email verified successfully"))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/send-otp",
+    request_body = AuthResendOtpRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] Resend OTP successful"),
+        (status = 400, description = "[PUBLIC] Resend OTP failed")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_resend_otp(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthResendOtpRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    service.resend_otp(payload).await?;
+    Ok(ApiMessage::ok("OTP sent"))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/forgot",
+    request_body = AuthResendOtpRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] Forgot password request successful")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_forgot_password(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthResendOtpRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    service.forgot_password(payload).await?;
+    Ok(ApiMessage::ok(
+        "If your email is registered, you will receive a password reset link.",
+    ))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/new-password",
+    request_body = AuthNewPasswordRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] New password set successfully"),
+        (status = 400, description = "[PUBLIC] New password request failed")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_new_password(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthNewPasswordRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    service.new_password(payload).await?;
+    Ok(ApiMessage::ok("Password updated successfully"))
+}
+
+#[utoipa::path(
+    post,
+    path = "/v1/auth/refresh",
+    request_body = AuthRefreshTokenRequestDto,
+    responses(
+        (status = 200, description = "[PUBLIC] Refresh token successful"),
+        (status = 401, description = "[PUBLIC] Invalid refresh token")
+    ),
+    tag = "Authentication"
+)]
+pub async fn post_refresh_token(
+    Extension(service): Extension<Arc<dyn AuthService>>,
+    ValidatedJson(payload): ValidatedJson<AuthRefreshTokenRequestDto>,
+) -> Result<impl IntoResponse, AppError> {
+    let resp = service.refresh_token(payload).await?;
+    Ok(ApiSuccess(resp))
+}
+

imphnen-iam/src/auth/infrastructure/http/mod.rs

@@ -0,0 +1,5 @@
+pub mod dto;
+pub mod handlers;
+pub mod routes;
+
+pub use routes::auth_public_routes;

imphnen-iam/src/auth/infrastructure/http/routes.rs

@@ -0,0 +1,29 @@
+use std::sync::Arc;
+use axum::{Router, routing::post, Extension};
+use sea_orm::DatabaseConnection;
+use imphnen_libs::AppState;
+use crate::auth::domain::AuthService;
+use crate::auth::application::AuthServiceImpl;
+use crate::users::infrastructure::persistence::PostgresUserRepository;
+use crate::roles::infrastructure::persistence::PostgresRoleRepository;
+use super::handlers::{
+    post_login, post_login_mentor, post_register, post_verify_email,
+    post_resend_otp, post_forgot_password, post_new_password, post_refresh_token,
+};
+
+pub fn auth_public_routes(_db: DatabaseConnection, state: Arc<AppState>) -> Router {
+    let user_repo = Arc::new(PostgresUserRepository::new(state.postgres_connection.conn.clone()));
+    let role_repo = Arc::new(PostgresRoleRepository::new(state.postgres_connection.conn.clone()));
+    let auth_service: Arc<dyn AuthService> = Arc::new(AuthServiceImpl::new(user_repo, role_repo));
+    Router::new()
+        .route("/auth/login", post(post_login))
+        .route("/auth/login-mentor", post(post_login_mentor))
+        .route("/auth/register", post(post_register))
+        .route("/auth/verify-email", post(post_verify_email))
+        .route("/auth/send-otp", post(post_resend_otp))
+        .route("/auth/forgot", post(post_forgot_password))
+        .route("/auth/new-password", post(post_new_password))
+        .route("/auth/refresh", post(post_refresh_token))
+        .layer(Extension(auth_service))
+        .layer(Extension((*state).clone()))
+}

imphnen-iam/src/auth/infrastructure/mod.rs

@@ -0,0 +1,2 @@
+pub mod http;
+pub mod persistence;

imphnen-iam/src/auth/infrastructure/persistence/mod.rs

@@ -0,0 +1 @@
+// Auth persistence - uses v1 AuthRepository directly