Auth Migration Strategies — Migrating Between Authentication Systems

// Dual auth support during migration
class AuthMigrationRouter {
  constructor() {
    this.providers = {
      legacy: new LegacyAuthProvider(),
      new: new NewAuthProvider()
    };
    this.migrationState = {}; // userId -> migrated flag
  }

  async authenticate(req, res, next) {
    const token = extractToken(req);
    if (!token) return res.status(401).json({ error: 'No token' });

    // Try new system first
    try {
      const user = await this.providers.new.validateToken(token);
      req.user = user;
      req.authProvider = 'new';
      return next();
    } catch {
      // Fall back to legacy
    }

    try {
      const user = await this.providers.legacy.validateToken(token);
      req.user = user;
      req.authProvider = 'legacy';

      // Check if user should be migrated
      if (this.shouldMigrate(user)) {
        res.setHeader('X-Auth-Migration', 'pending');
      }

      return next();
    } catch {
      return res.status(401).json({ error: 'Invalid token' });
    }
  }

  async migrateUser(userId) {
    const legacyUser = await this.providers.legacy.getUser(userId);
    const newUser = await this.providers.new.createUser({
      id: legacyUser.id,
      email: legacyUser.email,
      passwordHash: legacyUser.passwordHash, // Compatible hash
      metadata: legacyUser.metadata
    });
    this.migrationState[userId] = true;
    return newUser;
  }
}

// Migration phases
// Phase 1: Both systems active, new system accepts writes
// Phase 2: New system handles reads, legacy is fallback
// Phase 3: Legacy decommissioned