From b9aac2859a642811b3ccfd1711173634dc14455b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= <hi+github@ullrich.is>
Date: Fri, 8 May 2026 03:01:30 +0200
Subject: [PATCH] Drop auth.server.ts re-exports + rename to .server.ts
 convention (task 5.2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two cleanups in one pass:

1. Update import paths app-wide from `~/lib/auth.server` to
   `~/lib/auth/session.server` for the four session helpers
   (sessionStorage, createSession, getSessionUser, destroySession).
   ~40 files: 33 simple path swaps where the file imported only session
   symbols, 5 splits where it also imported per-method auth functions
   (auth.verify.tsx, api.settings.email.ts, activities.\$id.tsx,
   routes.\$id.tsx, auth.accept-terms.tsx) — those keep one import
   from auth.server (for verifyMagicToken, canView, recordTermsAcceptance,
   etc.) and gain a second import from auth/session.server.
   Two more files used relative paths and were missed by the first
   grep pass (lib/oauth.server.ts and routes/oauth.authorize.tsx) —
   migrated too.
   The @deprecated re-exports block in auth.server.ts is gone.

2. Rename the new auth files to follow the project's `.server.ts`
   convention so Vite/React Router treat them as server-only (they
   read process.env.SESSION_SECRET, hit the DB, etc. — must NOT enter
   the client bundle):
   - auth/session.ts → auth/session.server.ts
   - auth/completion.ts → auth/completion.server.ts
   - auth/completion.test.ts → auth/completion.server.test.ts
   Done with `git mv` so blame is preserved.

Verified: typecheck + lint green; 126 unit tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 apps/journal/app/lib/auth.server.ts            | 18 ++++--------------
 ...etion.test.ts => completion.server.test.ts} |  2 +-
 .../{completion.ts => completion.server.ts}    |  2 +-
 .../lib/auth/{session.ts => session.server.ts} |  0
 apps/journal/app/lib/oauth.server.ts           |  2 +-
 apps/journal/app/root.tsx                      |  2 +-
 apps/journal/app/routes/activities.$id.tsx     |  3 ++-
 apps/journal/app/routes/activities._index.tsx  |  2 +-
 apps/journal/app/routes/activities.new.tsx     |  2 +-
 apps/journal/app/routes/api.auth.login.ts      |  2 +-
 apps/journal/app/routes/api.auth.register.ts   |  2 +-
 apps/journal/app/routes/api.events.ts          |  2 +-
 .../app/routes/api.follows.$id.approve.ts      |  2 +-
 .../app/routes/api.follows.$id.reject.ts       |  2 +-
 .../app/routes/api.notifications.$id.read.ts   |  2 +-
 .../app/routes/api.notifications.read-all.ts   |  2 +-
 .../routes/api.routes.$id.edit-in-planner.ts   |  2 +-
 .../app/routes/api.settings.delete-account.ts  |  2 +-
 apps/journal/app/routes/api.settings.email.ts  |  3 ++-
 .../app/routes/api.settings.passkey.delete.ts  |  2 +-
 .../journal/app/routes/api.settings.profile.ts |  2 +-
 .../app/routes/api.sync.callback.$provider.ts  |  2 +-
 .../app/routes/api.sync.connect.$provider.ts   |  2 +-
 .../routes/api.sync.disconnect.$provider.ts    |  2 +-
 .../routes/api.sync.push.$provider.$routeId.ts |  2 +-
 .../app/routes/api.users.$username.follow.ts   |  2 +-
 .../app/routes/api.users.$username.unfollow.ts |  2 +-
 apps/journal/app/routes/auth.accept-terms.tsx  |  3 ++-
 apps/journal/app/routes/auth.logout.tsx        |  2 +-
 apps/journal/app/routes/auth.verify.tsx        |  5 +++--
 apps/journal/app/routes/explore.tsx            |  2 +-
 apps/journal/app/routes/feed.tsx               |  2 +-
 apps/journal/app/routes/home.tsx               |  2 +-
 apps/journal/app/routes/notifications.tsx      |  2 +-
 apps/journal/app/routes/oauth.authorize.tsx    |  2 +-
 apps/journal/app/routes/routes.$id.edit.tsx    |  2 +-
 apps/journal/app/routes/routes.$id.tsx         |  3 ++-
 apps/journal/app/routes/routes._index.tsx      |  2 +-
 apps/journal/app/routes/routes.new.tsx         |  2 +-
 apps/journal/app/routes/settings.account.tsx   |  2 +-
 .../app/routes/settings.connections.tsx        |  2 +-
 apps/journal/app/routes/settings.profile.tsx   |  2 +-
 apps/journal/app/routes/settings.security.tsx  |  2 +-
 apps/journal/app/routes/settings.tsx           |  2 +-
 .../app/routes/sync.import.$provider.tsx       |  2 +-
 .../app/routes/users.$username.followers.tsx   |  2 +-
 .../app/routes/users.$username.following.tsx   |  2 +-
 apps/journal/app/routes/users.$username.tsx    |  2 +-
 .../changes/unify-auth-completion/tasks.md     |  2 +-
 49 files changed, 57 insertions(+), 62 deletions(-)
 rename apps/journal/app/lib/auth/{completion.test.ts => completion.server.test.ts} (98%)
 rename apps/journal/app/lib/auth/{completion.ts => completion.server.ts} (98%)
 rename apps/journal/app/lib/auth/{session.ts => session.server.ts} (100%)

diff --git a/apps/journal/app/lib/auth.server.ts b/apps/journal/app/lib/auth.server.ts
index b25615d..6df9c3f 100644
--- a/apps/journal/app/lib/auth.server.ts
+++ b/apps/journal/app/lib/auth.server.ts
@@ -396,20 +396,10 @@ export async function verifyEmailChange(token: string, userId: string): Promise<
   return newEmail;
 }
 
-// --- Sessions ---
-//
-// Cookie session storage moved to `./auth/session.ts` so the post-verify
-// chokepoint (`./auth/completion.ts`, see ADR-0004) can compose it. The
-// re-exports below preserve the legacy `~/lib/auth.server` import path —
-// new code should import from `~/lib/auth/session` directly.
-
-/** @deprecated Import from `~/lib/auth/session` instead. */
-export {
-  sessionStorage,
-  createSession,
-  getSessionUser,
-  destroySession,
-} from "./auth/session.ts";
+// Cookie session storage lives at `./auth/session.ts` (see ADR-0004 + the
+// `auth/completion.ts` chokepoint). Import session helpers directly from
+// there; this file owns only per-method identity verification (passkey
+// ceremony + magic-token lifecycle) and Terms recording.
 
 /**
  * A row that carries the minimum a visibility check needs.
diff --git a/apps/journal/app/lib/auth/completion.test.ts b/apps/journal/app/lib/auth/completion.server.test.ts
similarity index 98%
rename from apps/journal/app/lib/auth/completion.test.ts
rename to apps/journal/app/lib/auth/completion.server.test.ts
index 4da2a58..f5400b9 100644
--- a/apps/journal/app/lib/auth/completion.test.ts
+++ b/apps/journal/app/lib/auth/completion.server.test.ts
@@ -2,7 +2,7 @@
 // docs/adr/0005-no-authmethod-polymorphism.md for why this exists.
 
 import { describe, it, expect } from "vitest";
-import { completeAuth } from "./completion.ts";
+import { completeAuth } from "./completion.server.ts";
 
 function reqWith(headers: Record<string, string> = {}) {
   return new Request("https://localhost/whatever", { headers });
diff --git a/apps/journal/app/lib/auth/completion.ts b/apps/journal/app/lib/auth/completion.server.ts
similarity index 98%
rename from apps/journal/app/lib/auth/completion.ts
rename to apps/journal/app/lib/auth/completion.server.ts
index cc56200..cbf7dcf 100644
--- a/apps/journal/app/lib/auth/completion.ts
+++ b/apps/journal/app/lib/auth/completion.server.ts
@@ -19,7 +19,7 @@
 // user-creation time, before any path can reach completeAuth.
 
 import { redirect } from "react-router";
-import { createSession } from "./session.ts";
+import { createSession } from "./session.server.ts";
 
 export type CompleteAuthMode = "redirect" | "json";
 
diff --git a/apps/journal/app/lib/auth/session.ts b/apps/journal/app/lib/auth/session.server.ts
similarity index 100%
rename from apps/journal/app/lib/auth/session.ts
rename to apps/journal/app/lib/auth/session.server.ts
diff --git a/apps/journal/app/lib/oauth.server.ts b/apps/journal/app/lib/oauth.server.ts
index a4c8c30..d1cd525 100644
--- a/apps/journal/app/lib/oauth.server.ts
+++ b/apps/journal/app/lib/oauth.server.ts
@@ -7,7 +7,7 @@ import {
   oauthCodes,
   oauthTokens,
 } from "@trails-cool/db/schema/journal";
-import { getSessionUser } from "./auth.server.ts";
+import { getSessionUser } from "./auth/session.server.ts";
 
 const CODE_EXPIRY_MS = 10 * 60 * 1000; // 10 minutes
 const ACCESS_TOKEN_EXPIRY_MS = 60 * 60 * 1000; // 1 hour
diff --git a/apps/journal/app/root.tsx b/apps/journal/app/root.tsx
index 1a475db..65ff76a 100644
--- a/apps/journal/app/root.tsx
+++ b/apps/journal/app/root.tsx
@@ -5,7 +5,7 @@ import type { Route } from "./+types/root";
 import * as Sentry from "@sentry/react";
 import { useTranslation } from "react-i18next";
 import { detectLocale } from "@trails-cool/i18n";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { LocaleProvider } from "~/components/LocaleContext";
 import { AlphaBanner } from "~/components/AlphaBanner";
 import { useUnreadNotifications } from "~/hooks/useUnreadNotifications";
diff --git a/apps/journal/app/routes/activities.$id.tsx b/apps/journal/app/routes/activities.$id.tsx
index 3c840ae..7b4da0d 100644
--- a/apps/journal/app/routes/activities.$id.tsx
+++ b/apps/journal/app/routes/activities.$id.tsx
@@ -1,7 +1,8 @@
 import { data, redirect } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/activities.$id";
-import { canView, getSessionUser } from "~/lib/auth.server";
+import { canView } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getActivity, deleteActivity, linkActivityToRoute, createRouteFromActivity, updateActivityVisibility } from "~/lib/activities.server";
 import { deleteImportByActivity } from "~/lib/sync/imports.server";
 import { listRoutes } from "~/lib/routes.server";
diff --git a/apps/journal/app/routes/activities._index.tsx b/apps/journal/app/routes/activities._index.tsx
index 4380be9..78e3526 100644
--- a/apps/journal/app/routes/activities._index.tsx
+++ b/apps/journal/app/routes/activities._index.tsx
@@ -1,7 +1,7 @@
 import { data, redirect } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/activities._index";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { listActivities } from "~/lib/activities.server";
 import { ClientDate } from "~/components/ClientDate";
 import { ClientMap } from "~/components/ClientMap";
diff --git a/apps/journal/app/routes/activities.new.tsx b/apps/journal/app/routes/activities.new.tsx
index 4200010..5de4291 100644
--- a/apps/journal/app/routes/activities.new.tsx
+++ b/apps/journal/app/routes/activities.new.tsx
@@ -1,6 +1,6 @@
 import { data, redirect } from "react-router";
 import type { Route } from "./+types/activities.new";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { createActivity } from "~/lib/activities.server";
 import { listRoutes } from "~/lib/routes.server";
 
diff --git a/apps/journal/app/routes/api.auth.login.ts b/apps/journal/app/routes/api.auth.login.ts
index 184f685..1ac014e 100644
--- a/apps/journal/app/routes/api.auth.login.ts
+++ b/apps/journal/app/routes/api.auth.login.ts
@@ -1,7 +1,7 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.auth.login";
 import { startAuthentication, finishAuthentication, createMagicToken, verifyLoginCode } from "~/lib/auth.server";
-import { completeAuth } from "~/lib/auth/completion";
+import { completeAuth } from "~/lib/auth/completion.server";
 import { sendMagicLink } from "~/lib/email.server";
 
 export async function action({ request }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.auth.register.ts b/apps/journal/app/routes/api.auth.register.ts
index b9a8e31..a6421a1 100644
--- a/apps/journal/app/routes/api.auth.register.ts
+++ b/apps/journal/app/routes/api.auth.register.ts
@@ -1,7 +1,7 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.auth.register";
 import { startRegistration, finishRegistration, addPasskeyStart, addPasskeyFinish, registerWithMagicLink } from "~/lib/auth.server";
-import { completeAuth } from "~/lib/auth/completion";
+import { completeAuth } from "~/lib/auth/completion.server";
 import { sendWelcome, sendMagicLink } from "~/lib/email.server";
 import { logger } from "~/lib/logger.server";
 
diff --git a/apps/journal/app/routes/api.events.ts b/apps/journal/app/routes/api.events.ts
index 5c0bbce..3b89d98 100644
--- a/apps/journal/app/routes/api.events.ts
+++ b/apps/journal/app/routes/api.events.ts
@@ -1,5 +1,5 @@
 import type { Route } from "./+types/api.events";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { register } from "~/lib/events.server";
 import { countUnread } from "~/lib/notifications.server";
 
diff --git a/apps/journal/app/routes/api.follows.$id.approve.ts b/apps/journal/app/routes/api.follows.$id.approve.ts
index fc7db5b..cfa90ae 100644
--- a/apps/journal/app/routes/api.follows.$id.approve.ts
+++ b/apps/journal/app/routes/api.follows.$id.approve.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.follows.$id.approve";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { approveFollowRequest } from "~/lib/follow.server";
 
 export async function action({ request, params }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.follows.$id.reject.ts b/apps/journal/app/routes/api.follows.$id.reject.ts
index b7d20fa..6fb03e1 100644
--- a/apps/journal/app/routes/api.follows.$id.reject.ts
+++ b/apps/journal/app/routes/api.follows.$id.reject.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.follows.$id.reject";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { rejectFollowRequest } from "~/lib/follow.server";
 
 export async function action({ request, params }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.notifications.$id.read.ts b/apps/journal/app/routes/api.notifications.$id.read.ts
index 0e39f26..c90653c 100644
--- a/apps/journal/app/routes/api.notifications.$id.read.ts
+++ b/apps/journal/app/routes/api.notifications.$id.read.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.notifications.$id.read";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { markRead } from "~/lib/notifications.server";
 
 export async function action({ request, params }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.notifications.read-all.ts b/apps/journal/app/routes/api.notifications.read-all.ts
index 38b4875..150f95a 100644
--- a/apps/journal/app/routes/api.notifications.read-all.ts
+++ b/apps/journal/app/routes/api.notifications.read-all.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.notifications.read-all";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { markAllRead } from "~/lib/notifications.server";
 
 export async function action({ request }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.routes.$id.edit-in-planner.ts b/apps/journal/app/routes/api.routes.$id.edit-in-planner.ts
index 3fa5b1d..6f4e502 100644
--- a/apps/journal/app/routes/api.routes.$id.edit-in-planner.ts
+++ b/apps/journal/app/routes/api.routes.$id.edit-in-planner.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.routes.$id.edit-in-planner";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getRouteWithVersions } from "~/lib/routes.server";
 import { createRouteToken } from "~/lib/jwt.server";
 
diff --git a/apps/journal/app/routes/api.settings.delete-account.ts b/apps/journal/app/routes/api.settings.delete-account.ts
index c569de7..88e3168 100644
--- a/apps/journal/app/routes/api.settings.delete-account.ts
+++ b/apps/journal/app/routes/api.settings.delete-account.ts
@@ -1,7 +1,7 @@
 import { redirect } from "react-router";
 import { eq } from "drizzle-orm";
 import type { Route } from "./+types/api.settings.delete-account";
-import { getSessionUser, destroySession } from "~/lib/auth.server";
+import { getSessionUser, destroySession } from "~/lib/auth/session.server";
 import { getDb } from "~/lib/db";
 import { users } from "@trails-cool/db/schema/journal";
 
diff --git a/apps/journal/app/routes/api.settings.email.ts b/apps/journal/app/routes/api.settings.email.ts
index 8f0505f..75ee66f 100644
--- a/apps/journal/app/routes/api.settings.email.ts
+++ b/apps/journal/app/routes/api.settings.email.ts
@@ -1,6 +1,7 @@
 import { data, redirect } from "react-router";
 import type { Route } from "./+types/api.settings.email";
-import { getSessionUser, initiateEmailChange } from "~/lib/auth.server";
+import { initiateEmailChange } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { sendMagicLink } from "~/lib/email.server";
 
 export async function action({ request }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.settings.passkey.delete.ts b/apps/journal/app/routes/api.settings.passkey.delete.ts
index 1aa1dda..e96dade 100644
--- a/apps/journal/app/routes/api.settings.passkey.delete.ts
+++ b/apps/journal/app/routes/api.settings.passkey.delete.ts
@@ -1,7 +1,7 @@
 import { data, redirect } from "react-router";
 import { eq, and } from "drizzle-orm";
 import type { Route } from "./+types/api.settings.passkey.delete";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getDb } from "~/lib/db";
 import { credentials } from "@trails-cool/db/schema/journal";
 
diff --git a/apps/journal/app/routes/api.settings.profile.ts b/apps/journal/app/routes/api.settings.profile.ts
index 79abf04..adfd301 100644
--- a/apps/journal/app/routes/api.settings.profile.ts
+++ b/apps/journal/app/routes/api.settings.profile.ts
@@ -1,7 +1,7 @@
 import { data, redirect } from "react-router";
 import { eq } from "drizzle-orm";
 import type { Route } from "./+types/api.settings.profile";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getDb } from "~/lib/db";
 import { users } from "@trails-cool/db/schema/journal";
 
diff --git a/apps/journal/app/routes/api.sync.callback.$provider.ts b/apps/journal/app/routes/api.sync.callback.$provider.ts
index df8980c..1741070 100644
--- a/apps/journal/app/routes/api.sync.callback.$provider.ts
+++ b/apps/journal/app/routes/api.sync.callback.$provider.ts
@@ -1,6 +1,6 @@
 import { redirect, data } from "react-router";
 import type { Route } from "./+types/api.sync.callback.$provider";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getManifest, link } from "~/lib/connected-services";
 import {
   decodeOAuthState,
diff --git a/apps/journal/app/routes/api.sync.connect.$provider.ts b/apps/journal/app/routes/api.sync.connect.$provider.ts
index 3239c9f..4ead0e4 100644
--- a/apps/journal/app/routes/api.sync.connect.$provider.ts
+++ b/apps/journal/app/routes/api.sync.connect.$provider.ts
@@ -1,6 +1,6 @@
 import { redirect, data } from "react-router";
 import type { Route } from "./+types/api.sync.connect.$provider";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getManifest } from "~/lib/connected-services";
 import { encodeOAuthState } from "~/lib/connected-services/oauth-state.server";
 
diff --git a/apps/journal/app/routes/api.sync.disconnect.$provider.ts b/apps/journal/app/routes/api.sync.disconnect.$provider.ts
index 5c23cb5..03bcf90 100644
--- a/apps/journal/app/routes/api.sync.disconnect.$provider.ts
+++ b/apps/journal/app/routes/api.sync.disconnect.$provider.ts
@@ -1,6 +1,6 @@
 import { redirect, data } from "react-router";
 import type { Route } from "./+types/api.sync.disconnect.$provider";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getManifest, unlinkByUserProvider } from "~/lib/connected-services";
 
 export async function action({ params, request }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.sync.push.$provider.$routeId.ts b/apps/journal/app/routes/api.sync.push.$provider.$routeId.ts
index 548c4a0..ac15efe 100644
--- a/apps/journal/app/routes/api.sync.push.$provider.$routeId.ts
+++ b/apps/journal/app/routes/api.sync.push.$provider.$routeId.ts
@@ -1,6 +1,6 @@
 import { redirect, data } from "react-router";
 import type { Route } from "./+types/api.sync.push.$provider.$routeId";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getManifest } from "~/lib/connected-services";
 import { pushRouteToProvider } from "~/lib/connected-services/push-action.server";
 import { encodeOAuthState } from "~/lib/connected-services/oauth-state.server";
diff --git a/apps/journal/app/routes/api.users.$username.follow.ts b/apps/journal/app/routes/api.users.$username.follow.ts
index 83bff8f..c515874 100644
--- a/apps/journal/app/routes/api.users.$username.follow.ts
+++ b/apps/journal/app/routes/api.users.$username.follow.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.users.$username.follow";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { followUser, FollowError } from "~/lib/follow.server";
 
 export async function action({ request, params }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/api.users.$username.unfollow.ts b/apps/journal/app/routes/api.users.$username.unfollow.ts
index 485dc0f..036d342 100644
--- a/apps/journal/app/routes/api.users.$username.unfollow.ts
+++ b/apps/journal/app/routes/api.users.$username.unfollow.ts
@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.users.$username.unfollow";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { unfollowUser, FollowError } from "~/lib/follow.server";
 
 export async function action({ request, params }: Route.ActionArgs) {
diff --git a/apps/journal/app/routes/auth.accept-terms.tsx b/apps/journal/app/routes/auth.accept-terms.tsx
index 111b186..81da750 100644
--- a/apps/journal/app/routes/auth.accept-terms.tsx
+++ b/apps/journal/app/routes/auth.accept-terms.tsx
@@ -2,7 +2,8 @@ import { useState } from "react";
 import { Form, data, redirect, useLoaderData, useSearchParams } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/auth.accept-terms";
-import { getSessionUser, recordTermsAcceptance } from "~/lib/auth.server";
+import { recordTermsAcceptance } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { TERMS_VERSION } from "~/lib/legal";
 
 export function meta() {
diff --git a/apps/journal/app/routes/auth.logout.tsx b/apps/journal/app/routes/auth.logout.tsx
index 44e9cf2..37f9c03 100644
--- a/apps/journal/app/routes/auth.logout.tsx
+++ b/apps/journal/app/routes/auth.logout.tsx
@@ -1,6 +1,6 @@
 import { redirect } from "react-router";
 import type { Route } from "./+types/auth.logout";
-import { destroySession } from "~/lib/auth.server";
+import { destroySession } from "~/lib/auth/session.server";
 
 export async function action({ request }: Route.ActionArgs) {
   const cookie = await destroySession(request);
diff --git a/apps/journal/app/routes/auth.verify.tsx b/apps/journal/app/routes/auth.verify.tsx
index d6c2965..12fc00b 100644
--- a/apps/journal/app/routes/auth.verify.tsx
+++ b/apps/journal/app/routes/auth.verify.tsx
@@ -1,7 +1,8 @@
 import { redirect, data } from "react-router";
 import type { Route } from "./+types/auth.verify";
-import { verifyMagicToken, verifyEmailChange, getSessionUser } from "~/lib/auth.server";
-import { completeAuth } from "~/lib/auth/completion";
+import { verifyMagicToken, verifyEmailChange } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
+import { completeAuth } from "~/lib/auth/completion.server";
 
 export async function loader({ request }: Route.LoaderArgs) {
   const url = new URL(request.url);
diff --git a/apps/journal/app/routes/explore.tsx b/apps/journal/app/routes/explore.tsx
index 1479acb..6386a80 100644
--- a/apps/journal/app/routes/explore.tsx
+++ b/apps/journal/app/routes/explore.tsx
@@ -2,7 +2,7 @@ import { data } from "react-router";
 import { Link } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/explore";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import {
   EXPLORE_DEFAULT_PAGE_SIZE,
   countFollowersBatch,
diff --git a/apps/journal/app/routes/feed.tsx b/apps/journal/app/routes/feed.tsx
index 755ac3b..4590144 100644
--- a/apps/journal/app/routes/feed.tsx
+++ b/apps/journal/app/routes/feed.tsx
@@ -2,7 +2,7 @@ import { data, redirect } from "react-router";
 import { Link } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/feed";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { listSocialFeed, listRecentPublicActivities } from "~/lib/activities.server";
 import { ClientDate } from "~/components/ClientDate";
 import { ClientMap } from "~/components/ClientMap";
diff --git a/apps/journal/app/routes/home.tsx b/apps/journal/app/routes/home.tsx
index 071f681..981c2ac 100644
--- a/apps/journal/app/routes/home.tsx
+++ b/apps/journal/app/routes/home.tsx
@@ -3,7 +3,7 @@ import { data } from "react-router";
 import { useTranslation } from "react-i18next";
 import { eq, count } from "drizzle-orm";
 import type { Route } from "./+types/home";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getDb } from "~/lib/db";
 import { credentials } from "@trails-cool/db/schema/journal";
 import { listActivities, listRecentPublicActivities } from "~/lib/activities.server";
diff --git a/apps/journal/app/routes/notifications.tsx b/apps/journal/app/routes/notifications.tsx
index 5306d16..dda955a 100644
--- a/apps/journal/app/routes/notifications.tsx
+++ b/apps/journal/app/routes/notifications.tsx
@@ -4,7 +4,7 @@ import { useTranslation } from "react-i18next";
 import { inArray, eq, and } from "drizzle-orm";
 import type { Route } from "./+types/notifications";
 import { getDb } from "~/lib/db";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { listForUser } from "~/lib/notifications.server";
 import { linkFor } from "~/lib/notifications/link-for";
 import { readPayload } from "~/lib/notifications/payload";
diff --git a/apps/journal/app/routes/oauth.authorize.tsx b/apps/journal/app/routes/oauth.authorize.tsx
index 91342d9..fa918f0 100644
--- a/apps/journal/app/routes/oauth.authorize.tsx
+++ b/apps/journal/app/routes/oauth.authorize.tsx
@@ -1,6 +1,6 @@
 import type { Route } from "./+types/oauth.authorize";
 import { redirect } from "react-router";
-import { getSessionUser } from "../lib/auth.server.ts";
+import { getSessionUser } from "../lib/auth/session.server.ts";
 import {
   getOAuthClient,
   validateRedirectUri,
diff --git a/apps/journal/app/routes/routes.$id.edit.tsx b/apps/journal/app/routes/routes.$id.edit.tsx
index e1fe2e9..59497fb 100644
--- a/apps/journal/app/routes/routes.$id.edit.tsx
+++ b/apps/journal/app/routes/routes.$id.edit.tsx
@@ -1,7 +1,7 @@
 import { data, redirect } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/routes.$id.edit";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getRoute, updateRoute } from "~/lib/routes.server";
 import type { Visibility } from "@trails-cool/db/schema/journal";
 
diff --git a/apps/journal/app/routes/routes.$id.tsx b/apps/journal/app/routes/routes.$id.tsx
index 3313a1b..a85c066 100644
--- a/apps/journal/app/routes/routes.$id.tsx
+++ b/apps/journal/app/routes/routes.$id.tsx
@@ -3,7 +3,8 @@ import { data, redirect } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/routes.$id";
 import { and, eq } from "drizzle-orm";
-import { canView, getSessionUser } from "~/lib/auth.server";
+import { canView } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getRoute, getRouteWithVersions, deleteRoute, updateRoute } from "~/lib/routes.server";
 import { getDb } from "~/lib/db";
 import { syncPushes } from "@trails-cool/db/schema/journal";
diff --git a/apps/journal/app/routes/routes._index.tsx b/apps/journal/app/routes/routes._index.tsx
index 85511a6..a4fed7a 100644
--- a/apps/journal/app/routes/routes._index.tsx
+++ b/apps/journal/app/routes/routes._index.tsx
@@ -1,7 +1,7 @@
 import { data, redirect } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/routes._index";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { listRoutes } from "~/lib/routes.server";
 import { ClientDate } from "~/components/ClientDate";
 import { ClientMap } from "~/components/ClientMap";
diff --git a/apps/journal/app/routes/routes.new.tsx b/apps/journal/app/routes/routes.new.tsx
index 7a939bd..caf02b2 100644
--- a/apps/journal/app/routes/routes.new.tsx
+++ b/apps/journal/app/routes/routes.new.tsx
@@ -1,7 +1,7 @@
 
 import { data, redirect } from "react-router";
 import type { Route } from "./+types/routes.new";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { createRoute } from "~/lib/routes.server";
 
 export async function loader({ request }: Route.LoaderArgs) {
diff --git a/apps/journal/app/routes/settings.account.tsx b/apps/journal/app/routes/settings.account.tsx
index 17aa3ca..0dc41c1 100644
--- a/apps/journal/app/routes/settings.account.tsx
+++ b/apps/journal/app/routes/settings.account.tsx
@@ -2,7 +2,7 @@ import { useState, useEffect } from "react";
 import { data, redirect, useFetcher } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/settings.account";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 
 export function meta() {
   return [{ title: "Account — Settings — trails.cool" }];
diff --git a/apps/journal/app/routes/settings.connections.tsx b/apps/journal/app/routes/settings.connections.tsx
index 583d45b..b0d905e 100644
--- a/apps/journal/app/routes/settings.connections.tsx
+++ b/apps/journal/app/routes/settings.connections.tsx
@@ -2,7 +2,7 @@ import { data, redirect, useSearchParams } from "react-router";
 import { useTranslation } from "react-i18next";
 import { eq } from "drizzle-orm";
 import type { Route } from "./+types/settings.connections";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getDb } from "~/lib/db";
 import { connectedServices } from "@trails-cool/db/schema/journal";
 import { getAllManifests } from "~/lib/connected-services";
diff --git a/apps/journal/app/routes/settings.profile.tsx b/apps/journal/app/routes/settings.profile.tsx
index 2c9956b..8f8ad5c 100644
--- a/apps/journal/app/routes/settings.profile.tsx
+++ b/apps/journal/app/routes/settings.profile.tsx
@@ -2,7 +2,7 @@ import { useState, useEffect } from "react";
 import { data, redirect, useFetcher } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/settings.profile";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 
 export function meta() {
   return [{ title: "Profile — Settings — trails.cool" }];
diff --git a/apps/journal/app/routes/settings.security.tsx b/apps/journal/app/routes/settings.security.tsx
index d499120..0062ca4 100644
--- a/apps/journal/app/routes/settings.security.tsx
+++ b/apps/journal/app/routes/settings.security.tsx
@@ -3,7 +3,7 @@ import { data, redirect, useFetcher } from "react-router";
 import { useTranslation } from "react-i18next";
 import { eq } from "drizzle-orm";
 import type { Route } from "./+types/settings.security";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { getDb } from "~/lib/db";
 import { credentials } from "@trails-cool/db/schema/journal";
 import { ClientDate } from "~/components/ClientDate";
diff --git a/apps/journal/app/routes/settings.tsx b/apps/journal/app/routes/settings.tsx
index 1df5d11..a85c0e4 100644
--- a/apps/journal/app/routes/settings.tsx
+++ b/apps/journal/app/routes/settings.tsx
@@ -2,7 +2,7 @@ import { Outlet, redirect } from "react-router";
 import { Link, useLocation } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/settings";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 
 export function meta() {
   return [{ title: "Settings — trails.cool" }];
diff --git a/apps/journal/app/routes/sync.import.$provider.tsx b/apps/journal/app/routes/sync.import.$provider.tsx
index c401ac0..e90b811 100644
--- a/apps/journal/app/routes/sync.import.$provider.tsx
+++ b/apps/journal/app/routes/sync.import.$provider.tsx
@@ -2,7 +2,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import { data, redirect, useFetcher } from "react-router";
 import { useTranslation } from "react-i18next";
 import type { Route } from "./+types/sync.import.$provider";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import {
   getManifest,
   getService,
diff --git a/apps/journal/app/routes/users.$username.followers.tsx b/apps/journal/app/routes/users.$username.followers.tsx
index df2ab30..9b22fcd 100644
--- a/apps/journal/app/routes/users.$username.followers.tsx
+++ b/apps/journal/app/routes/users.$username.followers.tsx
@@ -4,7 +4,7 @@ import type { Route } from "./+types/users.$username.followers";
 import { getDb } from "~/lib/db";
 import { users } from "@trails-cool/db/schema/journal";
 import { listFollowers, countFollowers, getFollowState } from "~/lib/follow.server";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { CollectionPage } from "~/components/CollectionPage";
 
 export async function loader({ params, request }: Route.LoaderArgs) {
diff --git a/apps/journal/app/routes/users.$username.following.tsx b/apps/journal/app/routes/users.$username.following.tsx
index 680083b..1c8237f 100644
--- a/apps/journal/app/routes/users.$username.following.tsx
+++ b/apps/journal/app/routes/users.$username.following.tsx
@@ -4,7 +4,7 @@ import type { Route } from "./+types/users.$username.following";
 import { getDb } from "~/lib/db";
 import { users } from "@trails-cool/db/schema/journal";
 import { listFollowing, countFollowing, getFollowState } from "~/lib/follow.server";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { CollectionPage } from "~/components/CollectionPage";
 
 export async function loader({ params, request }: Route.LoaderArgs) {
diff --git a/apps/journal/app/routes/users.$username.tsx b/apps/journal/app/routes/users.$username.tsx
index 5163971..83b566c 100644
--- a/apps/journal/app/routes/users.$username.tsx
+++ b/apps/journal/app/routes/users.$username.tsx
@@ -4,7 +4,7 @@ import { useTranslation } from "react-i18next";
 import { getDb } from "~/lib/db";
 import { users } from "@trails-cool/db/schema/journal";
 import { eq } from "drizzle-orm";
-import { getSessionUser } from "~/lib/auth.server";
+import { getSessionUser } from "~/lib/auth/session.server";
 import { listPublicRoutesForOwner } from "~/lib/routes.server";
 import { listPublicActivitiesForOwner } from "~/lib/activities.server";
 import { loadPersona } from "~/lib/demo-bot.server";
diff --git a/openspec/changes/unify-auth-completion/tasks.md b/openspec/changes/unify-auth-completion/tasks.md
index 7281465..0bdceff 100644
--- a/openspec/changes/unify-auth-completion/tasks.md
+++ b/openspec/changes/unify-auth-completion/tasks.md
@@ -27,4 +27,4 @@
 ## 5. Documentation + follow-up
 
 - [ ] 5.1 At archive time, apply the spec delta in `specs/authentication-methods/` to `openspec/specs/`.
-- [ ] 5.2 (Optional follow-up — not part of this change) update import paths app-wide from `auth.server.ts` to `./auth/session.ts` and drop the re-exports. Track separately.
+- [x] 5.2 Update import paths app-wide from `auth.server.ts` to `./auth/session.ts` and drop the re-exports. (Folded into this PR after the smoke test confirmed everything works.)