refactor(auth): factory-style use cases + controllers + real Payload impls

- Use cases (sign-in, sign-up, sign-out) → factory functions with I*UseCase aliases
- Controllers → factory functions with I*Controller aliases
- DI symbols + module updated with .toDynamicValue() bindings for factories
- New: real UsersRepository (Payload-backed, SanitizedConfig, contract-tested)
- New: real AuthenticationService (node:crypto hashing/UUIDs; createSession/
  validateSession/invalidateSession deferred — see refactor log §7)
- bindProductionAuth swaps both mocks for real impls (was a no-op before)
- Tests refactored to construct mocks and inject directly (no container rebinding)
- Feature test constructs full chain via direct factory injection

Refactor log: §2, §4.1, §4.2, §5.1, §5.2, §6.1, §7
Spec: §6.1, §7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/di/bind-production.ts

@@ -1,13 +1,28 @@
-import type { SanitizedConfig as _SanitizedConfig } from "payload";
+import type { SanitizedConfig } from "payload";
+import { authContainer } from "./container";
+import { AUTH_SYMBOLS } from "./symbols";
+import { UsersRepository } from "../infrastructure/repositories/users.repository";
+import { AuthenticationService } from "../infrastructure/services/authentication.service";
+import type { IUsersRepository } from "../application/repositories/users.repository.interface";
+import type { IAuthenticationService } from "../application/services/authentication.service.interface";
 
-// Auth currently uses Mock repositories even in production: see Plan 3
-// decisions. This helper exists for API symmetry with other features and
-// for forward-compatibility if a Payload-backed users repo is added later.
-//
-// Until then it's a no-op that intentionally accepts (and ignores) the
-// SanitizedConfig argument so app-boot code can call it uniformly.
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-export function bindProductionAuth(_config: _SanitizedConfig): void {
-  // Default mock bindings from `module.ts` already loaded by container.ts;
-  // nothing to swap.
+let bound = false;
+
+export function bindProductionAuth(config: SanitizedConfig): void {
+  if (bound) return;
+  bound = true;
+
+  if (authContainer.isBound(AUTH_SYMBOLS.IUsersRepository)) {
+    authContainer.unbind(AUTH_SYMBOLS.IUsersRepository);
+  }
+  authContainer
+    .bind<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository)
+    .toConstantValue(new UsersRepository(config));
+
+  if (authContainer.isBound(AUTH_SYMBOLS.IAuthenticationService)) {
+    authContainer.unbind(AUTH_SYMBOLS.IAuthenticationService);
+  }
+  authContainer
+    .bind<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService)
+    .toConstantValue(new AuthenticationService(config));
 }

packages/auth/src/di/container.test.ts

@@ -6,6 +6,8 @@ import { MockUsersRepository } from "@/infrastructure/repositories/users.reposit
 import { MockAuthenticationService } from "@/infrastructure/services/authentication.service.mock";
 import type { IUsersRepository } from "@/application/repositories/users.repository.interface";
 import type { IAuthenticationService } from "@/application/services/authentication.service.interface";
+import type { ISignInUseCase } from "@/application/use-cases/sign-in.use-case";
+import type { ISignInController } from "@/interface-adapters/controllers/sign-in.controller";
 import { userFactory } from "@/__factories__/user.factory";
 
 describe("authContainer", () => {
@@ -36,14 +38,22 @@ describe("authContainer", () => {
     const service = authContainer.get<IAuthenticationService>(
       AUTH_SYMBOLS.IAuthenticationService,
     );
-    // The service should be able to validate against the seeded users
     const user = userFactory.build({ id: "1", username: "alice", passwordHash: "hashed_password_alice" });
     const { session, cookie } = await service.createSession(user);
     expect(session.userId).toBe("1");
     expect(cookie.value).toBe(session.id);
 
-    // After session creation, validateSession should resolve user via the repo
     const validated = await service.validateSession(session.id);
     expect(validated.user.username).toBe("alice");
   });
+
+  it("resolves ISignInUseCase via toDynamicValue binding", () => {
+    const useCase = authContainer.get<ISignInUseCase>(AUTH_SYMBOLS.ISignInUseCase);
+    expect(typeof useCase).toBe("function");
+  });
+
+  it("resolves ISignInController via toDynamicValue binding", () => {
+    const controller = authContainer.get<ISignInController>(AUTH_SYMBOLS.ISignInController);
+    expect(typeof controller).toBe("function");
+  });
 });

packages/auth/src/di/module.ts

@@ -4,6 +4,30 @@ import type { IUsersRepository } from "../application/repositories/users.reposit
 import type { IAuthenticationService } from "../application/services/authentication.service.interface";
 import { MockUsersRepository } from "../infrastructure/repositories/users.repository.mock";
 import { MockAuthenticationService } from "../infrastructure/services/authentication.service.mock";
+import {
+  signInUseCase,
+  type ISignInUseCase,
+} from "../application/use-cases/sign-in.use-case";
+import {
+  signUpUseCase,
+  type ISignUpUseCase,
+} from "../application/use-cases/sign-up.use-case";
+import {
+  signOutUseCase,
+  type ISignOutUseCase,
+} from "../application/use-cases/sign-out.use-case";
+import {
+  signInController,
+  type ISignInController,
+} from "../interface-adapters/controllers/sign-in.controller";
+import {
+  signUpController,
+  type ISignUpController,
+} from "../interface-adapters/controllers/sign-up.controller";
+import {
+  signOutController,
+  type ISignOutController,
+} from "../interface-adapters/controllers/sign-out.controller";
 import { AUTH_SYMBOLS } from "./symbols";
 
 export const AuthModule = new ContainerModule((bind: interfaces.Bind) => {
@@ -11,4 +35,42 @@ export const AuthModule = new ContainerModule((bind: interfaces.Bind) => {
   bind<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService).to(
     MockAuthenticationService,
   );
+
+  bind<ISignInUseCase>(AUTH_SYMBOLS.ISignInUseCase).toDynamicValue((ctx) =>
+    signInUseCase(
+      ctx.container.get<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository),
+      ctx.container.get<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService),
+    ),
+  );
+
+  bind<ISignUpUseCase>(AUTH_SYMBOLS.ISignUpUseCase).toDynamicValue((ctx) =>
+    signUpUseCase(
+      ctx.container.get<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository),
+      ctx.container.get<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService),
+    ),
+  );
+
+  bind<ISignOutUseCase>(AUTH_SYMBOLS.ISignOutUseCase).toDynamicValue((ctx) =>
+    signOutUseCase(
+      ctx.container.get<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService),
+    ),
+  );
+
+  bind<ISignInController>(AUTH_SYMBOLS.ISignInController).toDynamicValue((ctx) =>
+    signInController(
+      ctx.container.get<ISignInUseCase>(AUTH_SYMBOLS.ISignInUseCase),
+    ),
+  );
+
+  bind<ISignUpController>(AUTH_SYMBOLS.ISignUpController).toDynamicValue((ctx) =>
+    signUpController(
+      ctx.container.get<ISignUpUseCase>(AUTH_SYMBOLS.ISignUpUseCase),
+    ),
+  );
+
+  bind<ISignOutController>(AUTH_SYMBOLS.ISignOutController).toDynamicValue((ctx) =>
+    signOutController(
+      ctx.container.get<ISignOutUseCase>(AUTH_SYMBOLS.ISignOutUseCase),
+    ),
+  );
 });

packages/auth/src/di/symbols.ts

@@ -1,4 +1,12 @@
 export const AUTH_SYMBOLS = {
   IUsersRepository: Symbol.for("auth:IUsersRepository"),
   IAuthenticationService: Symbol.for("auth:IAuthenticationService"),
+  // Use cases
+  ISignInUseCase: Symbol.for("auth:ISignInUseCase"),
+  ISignUpUseCase: Symbol.for("auth:ISignUpUseCase"),
+  ISignOutUseCase: Symbol.for("auth:ISignOutUseCase"),
+  // Controllers
+  ISignInController: Symbol.for("auth:ISignInController"),
+  ISignUpController: Symbol.for("auth:ISignUpController"),
+  ISignOutController: Symbol.for("auth:ISignOutController"),
 } as const;