From d25100ed6a3633918e82b845f37cfe24d329b80d Mon Sep 17 00:00:00 2001
From: ben-fornefeld <ben.fornefeld@gmail.com>
Date: Wed, 22 Jul 2026 20:28:54 +0200
Subject: [PATCH 1/2] feat(auth): re-export OIDC and provider verifiers through
 the public facade

External consumers (belt) previously imported pkg/auth/oidc directly
(oidc.NewVerifier, oidc.IdentityLookup, oidc.ErrIdentityNotFound) and used
auth.Verifier/auth.NewVerifier from the old facade. Both surfaces were
removed in #3314, which breaks belt's daily infra sync at go mod tidy
(module found, but does not contain package .../pkg/auth/oidc) and at
compile time in argus-api.

Expose the equivalents on the auth facade so all consumers use auth.*:

- IdentityLookup, ErrIdentityNotFound
- OIDCVerifier, NewOIDCVerifier (single issuer)
- ProviderVerifier, NewProviderVerifier (multi-issuer, keeps the
  (nil, nil) no-provider semantics of the old auth.NewVerifier)

Config/issuer types were already re-exported as JWTConfig/JWTIssuer.
---
 packages/auth/pkg/auth/token.go | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/packages/auth/pkg/auth/token.go b/packages/auth/pkg/auth/token.go
index 12886609d2..c103e03efe 100644
--- a/packages/auth/pkg/auth/token.go
+++ b/packages/auth/pkg/auth/token.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/e2b-dev/infra/packages/auth/internal/token"
 	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/internal/token/oidc"
 )
 
 type ProviderConfig = token.ProviderConfig
@@ -27,3 +28,34 @@ func ParseProviderConfig(value string) (ProviderConfig, error) {
 func NewAdminVerifier(ctx context.Context, config ProviderConfig, httpClient *http.Client) (*AdminVerifier, error) {
 	return token.NewAdminVerifier(ctx, config, httpClient)
 }
+
+// IdentityLookup resolves an OIDC identity (issuer + subject) to an internal
+// user UUID. Implementations should return ErrIdentityNotFound when no
+// matching identity exists.
+type IdentityLookup = oidc.IdentityLookup
+
+// OIDCVerifier verifies auth-provider user JWTs for a single issuer and
+// resolves the internal user identity through an IdentityLookup.
+type OIDCVerifier = oidc.Verifier
+
+// ErrIdentityNotFound is returned by OIDC verification when the token is
+// valid but no matching identity exists.
+var ErrIdentityNotFound = oidc.ErrIdentityNotFound
+
+// NewOIDCVerifier constructs an OIDCVerifier for the given issuer config.
+// External consumers (e.g. belt) use this to verify auth-provider tokens with
+// their own identity storage.
+func NewOIDCVerifier(ctx context.Context, config JWTConfig, httpClient *http.Client, identities IdentityLookup) (*OIDCVerifier, error) {
+	return oidc.NewVerifier(ctx, config, httpClient, identities)
+}
+
+// ProviderVerifier verifies auth-provider user JWTs across every issuer in a
+// ProviderConfig.
+type ProviderVerifier = token.ProviderVerifier
+
+// NewProviderVerifier constructs a ProviderVerifier for the given provider
+// config. When the config has no JWT issuers it returns (nil, nil); a nil
+// ProviderVerifier denies all verification attempts at runtime.
+func NewProviderVerifier(ctx context.Context, config ProviderConfig, httpClient *http.Client, identities IdentityLookup) (*ProviderVerifier, error) {
+	return token.NewProviderVerifier(ctx, config, httpClient, identities)
+}

From 57128f564efed4854beaf98c0d281758b46cc3e2 Mon Sep 17 00:00:00 2001
From: ben-fornefeld <ben.fornefeld@gmail.com>
Date: Wed, 22 Jul 2026 20:30:18 +0200
Subject: [PATCH 2/2] refactor(auth): nest internal packages under pkg/auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move packages/auth/internal/* to packages/auth/pkg/auth/internal/* so the
implementation lives inside the consumer-facing pkg tree. Consumers keep
importing the stable facade at .../packages/auth/pkg/auth.

Go's internal visibility now scopes the implementation to pkg/auth alone
(pkg/types and pkg/tests can no longer reach it), and image builds that
COPY ./auth/pkg pick up the implementation for free — drop the separate
./auth/internal COPY that #3323 added to unbreak image builds after #3314.
---
 packages/api/Dockerfile                                   | 1 -
 packages/auth/pkg/auth/error.go                           | 2 +-
 packages/auth/pkg/auth/gin.go                             | 2 +-
 .../auth/{ => pkg/auth}/internal/authcontext/context.go   | 0
 .../auth/{ => pkg/auth}/internal/middleware/middleware.go | 8 ++++----
 .../{ => pkg/auth}/internal/middleware/middleware_test.go | 2 +-
 packages/auth/{ => pkg/auth}/internal/service/cache.go    | 0
 .../{ => pkg/auth}/internal/service/identity_lookup.go    | 2 +-
 .../auth}/internal/service/identity_lookup_test.go        | 2 +-
 packages/auth/{ => pkg/auth}/internal/service/service.go  | 6 +++---
 packages/auth/{ => pkg/auth}/internal/service/store.go    | 4 ++--
 packages/auth/{ => pkg/auth}/internal/team/error.go       | 0
 packages/auth/{ => pkg/auth}/internal/team/middleware.go  | 2 +-
 .../auth/{ => pkg/auth}/internal/team/middleware_test.go  | 2 +-
 packages/auth/{ => pkg/auth}/internal/team/state.go       | 0
 packages/auth/{ => pkg/auth}/internal/team/state_test.go  | 0
 packages/auth/{ => pkg/auth}/internal/token/admin.go      | 2 +-
 packages/auth/{ => pkg/auth}/internal/token/admin_test.go | 2 +-
 .../auth/{ => pkg/auth}/internal/token/jwks/audience.go   | 0
 .../{ => pkg/auth}/internal/token/jwks/audience_test.go   | 0
 .../auth/{ => pkg/auth}/internal/token/jwks/config.go     | 0
 .../{ => pkg/auth}/internal/token/jwks/config_test.go     | 0
 .../auth/{ => pkg/auth}/internal/token/jwks/testserver.go | 0
 .../auth/{ => pkg/auth}/internal/token/jwks/verifier.go   | 0
 .../{ => pkg/auth}/internal/token/jwks/verifier_test.go   | 0
 packages/auth/{ => pkg/auth}/internal/token/oidc/oidc.go  | 2 +-
 .../auth/{ => pkg/auth}/internal/token/oidc/oidc_test.go  | 2 +-
 packages/auth/{ => pkg/auth}/internal/token/provider.go   | 4 ++--
 .../auth}/internal/token/provider_config_parse.go         | 0
 .../auth/{ => pkg/auth}/internal/token/provider_test.go   | 4 ++--
 packages/auth/pkg/auth/middleware.go                      | 2 +-
 packages/auth/pkg/auth/service.go                         | 2 +-
 packages/auth/pkg/auth/team.go                            | 2 +-
 packages/auth/pkg/auth/testing.go                         | 2 +-
 packages/auth/pkg/auth/token.go                           | 6 +++---
 packages/dashboard-api/Dockerfile                         | 1 -
 36 files changed, 31 insertions(+), 33 deletions(-)
 rename packages/auth/{ => pkg/auth}/internal/authcontext/context.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/middleware/middleware.go (97%)
 rename packages/auth/{ => pkg/auth}/internal/middleware/middleware_test.go (96%)
 rename packages/auth/{ => pkg/auth}/internal/service/cache.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/service/identity_lookup.go (97%)
 rename packages/auth/{ => pkg/auth}/internal/service/identity_lookup_test.go (97%)
 rename packages/auth/{ => pkg/auth}/internal/service/service.go (98%)
 rename packages/auth/{ => pkg/auth}/internal/service/store.go (96%)
 rename packages/auth/{ => pkg/auth}/internal/team/error.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/team/middleware.go (96%)
 rename packages/auth/{ => pkg/auth}/internal/team/middleware_test.go (99%)
 rename packages/auth/{ => pkg/auth}/internal/team/state.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/team/state_test.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/admin.go (96%)
 rename packages/auth/{ => pkg/auth}/internal/token/admin_test.go (98%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/audience.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/audience_test.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/config.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/config_test.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/testserver.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/verifier.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/jwks/verifier_test.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/oidc/oidc.go (97%)
 rename packages/auth/{ => pkg/auth}/internal/token/oidc/oidc_test.go (98%)
 rename packages/auth/{ => pkg/auth}/internal/token/provider.go (96%)
 rename packages/auth/{ => pkg/auth}/internal/token/provider_config_parse.go (100%)
 rename packages/auth/{ => pkg/auth}/internal/token/provider_test.go (97%)

diff --git a/packages/api/Dockerfile b/packages/api/Dockerfile
index 0cc1e468e9..63d82e1cd7 100644
--- a/packages/api/Dockerfile
+++ b/packages/api/Dockerfile
@@ -24,7 +24,6 @@ RUN cd /build/shared && go mod download && \
 WORKDIR /build
 
 COPY ./auth/pkg ./auth/pkg
-COPY ./auth/internal ./auth/internal
 COPY ./clickhouse/pkg ./clickhouse/pkg
 COPY ./shared/pkg ./shared/pkg
 COPY ./db/client ./db/client
diff --git a/packages/auth/pkg/auth/error.go b/packages/auth/pkg/auth/error.go
index b656a19040..0cc5e39adf 100644
--- a/packages/auth/pkg/auth/error.go
+++ b/packages/auth/pkg/auth/error.go
@@ -1,7 +1,7 @@
 package auth
 
 import (
-	internalauthteam "github.com/e2b-dev/infra/packages/auth/internal/team"
+	internalauthteam "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/team"
 	"github.com/e2b-dev/infra/packages/shared/pkg/apierrors"
 )
 
diff --git a/packages/auth/pkg/auth/gin.go b/packages/auth/pkg/auth/gin.go
index d3cf6a0d58..bbc87e5adf 100644
--- a/packages/auth/pkg/auth/gin.go
+++ b/packages/auth/pkg/auth/gin.go
@@ -4,7 +4,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 )
 
diff --git a/packages/auth/internal/authcontext/context.go b/packages/auth/pkg/auth/internal/authcontext/context.go
similarity index 100%
rename from packages/auth/internal/authcontext/context.go
rename to packages/auth/pkg/auth/internal/authcontext/context.go
diff --git a/packages/auth/internal/middleware/middleware.go b/packages/auth/pkg/auth/internal/middleware/middleware.go
similarity index 97%
rename from packages/auth/internal/middleware/middleware.go
rename to packages/auth/pkg/auth/internal/middleware/middleware.go
index a8f9e959cb..c0a0cd89af 100644
--- a/packages/auth/internal/middleware/middleware.go
+++ b/packages/auth/pkg/auth/internal/middleware/middleware.go
@@ -15,9 +15,9 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
-	internalauthteam "github.com/e2b-dev/infra/packages/auth/internal/team"
-	"github.com/e2b-dev/infra/packages/auth/internal/token"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
+	internalauthteam "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/team"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	"github.com/e2b-dev/infra/packages/shared/pkg/apierrors"
 	"github.com/e2b-dev/infra/packages/shared/pkg/telemetry"
@@ -35,7 +35,7 @@ const (
 
 type APIError = apierrors.APIError
 
-var tracer = otel.Tracer("github.com/e2b-dev/infra/packages/auth/internal/middleware")
+var tracer = otel.Tracer("github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/middleware")
 
 var (
 	ErrNoAuthHeader      = errors.New("authorization header is missing")
diff --git a/packages/auth/internal/middleware/middleware_test.go b/packages/auth/pkg/auth/internal/middleware/middleware_test.go
similarity index 96%
rename from packages/auth/internal/middleware/middleware_test.go
rename to packages/auth/pkg/auth/internal/middleware/middleware_test.go
index 144bd14f8b..2062f7d6ef 100644
--- a/packages/auth/internal/middleware/middleware_test.go
+++ b/packages/auth/pkg/auth/internal/middleware/middleware_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	authqueries "github.com/e2b-dev/infra/packages/db/pkg/auth/queries"
 )
diff --git a/packages/auth/internal/service/cache.go b/packages/auth/pkg/auth/internal/service/cache.go
similarity index 100%
rename from packages/auth/internal/service/cache.go
rename to packages/auth/pkg/auth/internal/service/cache.go
diff --git a/packages/auth/internal/service/identity_lookup.go b/packages/auth/pkg/auth/internal/service/identity_lookup.go
similarity index 97%
rename from packages/auth/internal/service/identity_lookup.go
rename to packages/auth/pkg/auth/internal/service/identity_lookup.go
index f65714c8ce..08f46f9053 100644
--- a/packages/auth/internal/service/identity_lookup.go
+++ b/packages/auth/pkg/auth/internal/service/identity_lookup.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/oidc"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/oidc"
 	authqueries "github.com/e2b-dev/infra/packages/db/pkg/auth/queries"
 	"github.com/e2b-dev/infra/packages/db/pkg/dberrors"
 	"github.com/e2b-dev/infra/packages/shared/pkg/cache"
diff --git a/packages/auth/internal/service/identity_lookup_test.go b/packages/auth/pkg/auth/internal/service/identity_lookup_test.go
similarity index 97%
rename from packages/auth/internal/service/identity_lookup_test.go
rename to packages/auth/pkg/auth/internal/service/identity_lookup_test.go
index 080a13b0dd..071df9e5e6 100644
--- a/packages/auth/internal/service/identity_lookup_test.go
+++ b/packages/auth/pkg/auth/internal/service/identity_lookup_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/oidc"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/oidc"
 )
 
 type countingIdentityLookup struct {
diff --git a/packages/auth/internal/service/service.go b/packages/auth/pkg/auth/internal/service/service.go
similarity index 98%
rename from packages/auth/internal/service/service.go
rename to packages/auth/pkg/auth/internal/service/service.go
index 8667d3433e..abbebb203e 100644
--- a/packages/auth/internal/service/service.go
+++ b/packages/auth/pkg/auth/internal/service/service.go
@@ -11,9 +11,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/redis/go-redis/v9"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
-	internalauthteam "github.com/e2b-dev/infra/packages/auth/internal/team"
-	"github.com/e2b-dev/infra/packages/auth/internal/token"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
+	internalauthteam "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/team"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	authdb "github.com/e2b-dev/infra/packages/db/pkg/auth"
 	"github.com/e2b-dev/infra/packages/shared/pkg/apierrors"
diff --git a/packages/auth/internal/service/store.go b/packages/auth/pkg/auth/internal/service/store.go
similarity index 96%
rename from packages/auth/internal/service/store.go
rename to packages/auth/pkg/auth/internal/service/store.go
index 787387038e..43ede9009e 100644
--- a/packages/auth/internal/service/store.go
+++ b/packages/auth/pkg/auth/internal/service/store.go
@@ -8,14 +8,14 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.uber.org/zap"
 
-	internalauthteam "github.com/e2b-dev/infra/packages/auth/internal/team"
+	internalauthteam "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/team"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	authdb "github.com/e2b-dev/infra/packages/db/pkg/auth"
 	authqueries "github.com/e2b-dev/infra/packages/db/pkg/auth/queries"
 	"github.com/e2b-dev/infra/packages/shared/pkg/logger"
 )
 
-var tracer = otel.Tracer("github.com/e2b-dev/infra/packages/auth/internal/service")
+var tracer = otel.Tracer("github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/service")
 
 type authStoreImpl struct {
 	authDB *authdb.Client
diff --git a/packages/auth/internal/team/error.go b/packages/auth/pkg/auth/internal/team/error.go
similarity index 100%
rename from packages/auth/internal/team/error.go
rename to packages/auth/pkg/auth/internal/team/error.go
diff --git a/packages/auth/internal/team/middleware.go b/packages/auth/pkg/auth/internal/team/middleware.go
similarity index 96%
rename from packages/auth/internal/team/middleware.go
rename to packages/auth/pkg/auth/internal/team/middleware.go
index 1b31ea2828..1d7890ff12 100644
--- a/packages/auth/internal/team/middleware.go
+++ b/packages/auth/pkg/auth/internal/team/middleware.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	"github.com/e2b-dev/infra/packages/shared/pkg/apierrors"
 )
diff --git a/packages/auth/internal/team/middleware_test.go b/packages/auth/pkg/auth/internal/team/middleware_test.go
similarity index 99%
rename from packages/auth/internal/team/middleware_test.go
rename to packages/auth/pkg/auth/internal/team/middleware_test.go
index ed3c18f918..f90a37f9cf 100644
--- a/packages/auth/internal/team/middleware_test.go
+++ b/packages/auth/pkg/auth/internal/team/middleware_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	authqueries "github.com/e2b-dev/infra/packages/db/pkg/auth/queries"
 )
diff --git a/packages/auth/internal/team/state.go b/packages/auth/pkg/auth/internal/team/state.go
similarity index 100%
rename from packages/auth/internal/team/state.go
rename to packages/auth/pkg/auth/internal/team/state.go
diff --git a/packages/auth/internal/team/state_test.go b/packages/auth/pkg/auth/internal/team/state_test.go
similarity index 100%
rename from packages/auth/internal/team/state_test.go
rename to packages/auth/pkg/auth/internal/team/state_test.go
diff --git a/packages/auth/internal/token/admin.go b/packages/auth/pkg/auth/internal/token/admin.go
similarity index 96%
rename from packages/auth/internal/token/admin.go
rename to packages/auth/pkg/auth/internal/token/admin.go
index 04257aa13e..54352e5565 100644
--- a/packages/auth/internal/token/admin.go
+++ b/packages/auth/pkg/auth/internal/token/admin.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
 )
 
 // adminJWTClockSkew is the leeway applied to time-based claims of admin
diff --git a/packages/auth/internal/token/admin_test.go b/packages/auth/pkg/auth/internal/token/admin_test.go
similarity index 98%
rename from packages/auth/internal/token/admin_test.go
rename to packages/auth/pkg/auth/internal/token/admin_test.go
index 5de89b94ed..a4daf0e40e 100644
--- a/packages/auth/internal/token/admin_test.go
+++ b/packages/auth/pkg/auth/internal/token/admin_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/require"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
 )
 
 const (
diff --git a/packages/auth/internal/token/jwks/audience.go b/packages/auth/pkg/auth/internal/token/jwks/audience.go
similarity index 100%
rename from packages/auth/internal/token/jwks/audience.go
rename to packages/auth/pkg/auth/internal/token/jwks/audience.go
diff --git a/packages/auth/internal/token/jwks/audience_test.go b/packages/auth/pkg/auth/internal/token/jwks/audience_test.go
similarity index 100%
rename from packages/auth/internal/token/jwks/audience_test.go
rename to packages/auth/pkg/auth/internal/token/jwks/audience_test.go
diff --git a/packages/auth/internal/token/jwks/config.go b/packages/auth/pkg/auth/internal/token/jwks/config.go
similarity index 100%
rename from packages/auth/internal/token/jwks/config.go
rename to packages/auth/pkg/auth/internal/token/jwks/config.go
diff --git a/packages/auth/internal/token/jwks/config_test.go b/packages/auth/pkg/auth/internal/token/jwks/config_test.go
similarity index 100%
rename from packages/auth/internal/token/jwks/config_test.go
rename to packages/auth/pkg/auth/internal/token/jwks/config_test.go
diff --git a/packages/auth/internal/token/jwks/testserver.go b/packages/auth/pkg/auth/internal/token/jwks/testserver.go
similarity index 100%
rename from packages/auth/internal/token/jwks/testserver.go
rename to packages/auth/pkg/auth/internal/token/jwks/testserver.go
diff --git a/packages/auth/internal/token/jwks/verifier.go b/packages/auth/pkg/auth/internal/token/jwks/verifier.go
similarity index 100%
rename from packages/auth/internal/token/jwks/verifier.go
rename to packages/auth/pkg/auth/internal/token/jwks/verifier.go
diff --git a/packages/auth/internal/token/jwks/verifier_test.go b/packages/auth/pkg/auth/internal/token/jwks/verifier_test.go
similarity index 100%
rename from packages/auth/internal/token/jwks/verifier_test.go
rename to packages/auth/pkg/auth/internal/token/jwks/verifier_test.go
diff --git a/packages/auth/internal/token/oidc/oidc.go b/packages/auth/pkg/auth/internal/token/oidc/oidc.go
similarity index 97%
rename from packages/auth/internal/token/oidc/oidc.go
rename to packages/auth/pkg/auth/internal/token/oidc/oidc.go
index 0680ab574d..5d8cbaab2b 100644
--- a/packages/auth/internal/token/oidc/oidc.go
+++ b/packages/auth/pkg/auth/internal/token/oidc/oidc.go
@@ -9,7 +9,7 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/google/uuid"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
 )
 
 // ErrIdentityNotFound is returned by Verify when the token is valid but no
diff --git a/packages/auth/internal/token/oidc/oidc_test.go b/packages/auth/pkg/auth/internal/token/oidc/oidc_test.go
similarity index 98%
rename from packages/auth/internal/token/oidc/oidc_test.go
rename to packages/auth/pkg/auth/internal/token/oidc/oidc_test.go
index 23afa28755..bf5b03758f 100644
--- a/packages/auth/internal/token/oidc/oidc_test.go
+++ b/packages/auth/pkg/auth/internal/token/oidc/oidc_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
 )
 
 const testIssuerURL = "https://issuer.example.com"
diff --git a/packages/auth/internal/token/provider.go b/packages/auth/pkg/auth/internal/token/provider.go
similarity index 96%
rename from packages/auth/internal/token/provider.go
rename to packages/auth/pkg/auth/internal/token/provider.go
index e3d5873fd4..f48aafe720 100644
--- a/packages/auth/internal/token/provider.go
+++ b/packages/auth/pkg/auth/internal/token/provider.go
@@ -9,8 +9,8 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/google/uuid"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
-	"github.com/e2b-dev/infra/packages/auth/internal/token/oidc"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/oidc"
 )
 
 // ProviderConfig describes external auth provider verification.
diff --git a/packages/auth/internal/token/provider_config_parse.go b/packages/auth/pkg/auth/internal/token/provider_config_parse.go
similarity index 100%
rename from packages/auth/internal/token/provider_config_parse.go
rename to packages/auth/pkg/auth/internal/token/provider_config_parse.go
diff --git a/packages/auth/internal/token/provider_test.go b/packages/auth/pkg/auth/internal/token/provider_test.go
similarity index 97%
rename from packages/auth/internal/token/provider_test.go
rename to packages/auth/pkg/auth/internal/token/provider_test.go
index 3447a0e48a..8e78a47ced 100644
--- a/packages/auth/internal/token/provider_test.go
+++ b/packages/auth/pkg/auth/internal/token/provider_test.go
@@ -16,8 +16,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
-	"github.com/e2b-dev/infra/packages/auth/internal/token/oidc"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/oidc"
 )
 
 const testIssuerURL = "https://issuer.example.com"
diff --git a/packages/auth/pkg/auth/middleware.go b/packages/auth/pkg/auth/middleware.go
index 1ff351a742..3de8a220ee 100644
--- a/packages/auth/pkg/auth/middleware.go
+++ b/packages/auth/pkg/auth/middleware.go
@@ -7,7 +7,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 
-	internalauthmiddleware "github.com/e2b-dev/infra/packages/auth/internal/middleware"
+	internalauthmiddleware "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/middleware"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 )
 
diff --git a/packages/auth/pkg/auth/service.go b/packages/auth/pkg/auth/service.go
index e8cb8445b0..aa4e0ce9c3 100644
--- a/packages/auth/pkg/auth/service.go
+++ b/packages/auth/pkg/auth/service.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/redis/go-redis/v9"
 
-	internalauthservice "github.com/e2b-dev/infra/packages/auth/internal/service"
+	internalauthservice "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/service"
 	authdb "github.com/e2b-dev/infra/packages/db/pkg/auth"
 )
 
diff --git a/packages/auth/pkg/auth/team.go b/packages/auth/pkg/auth/team.go
index a7888e956f..d91c414ab9 100644
--- a/packages/auth/pkg/auth/team.go
+++ b/packages/auth/pkg/auth/team.go
@@ -3,7 +3,7 @@ package auth
 import (
 	"github.com/gin-gonic/gin"
 
-	internalauthteam "github.com/e2b-dev/infra/packages/auth/internal/team"
+	internalauthteam "github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/team"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 	authqueries "github.com/e2b-dev/infra/packages/db/pkg/auth/queries"
 )
diff --git a/packages/auth/pkg/auth/testing.go b/packages/auth/pkg/auth/testing.go
index 88241b5b70..1ed02b65b8 100644
--- a/packages/auth/pkg/auth/testing.go
+++ b/packages/auth/pkg/auth/testing.go
@@ -6,7 +6,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/authcontext"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/authcontext"
 	"github.com/e2b-dev/infra/packages/auth/pkg/types"
 )
 
diff --git a/packages/auth/pkg/auth/token.go b/packages/auth/pkg/auth/token.go
index c103e03efe..e18558c980 100644
--- a/packages/auth/pkg/auth/token.go
+++ b/packages/auth/pkg/auth/token.go
@@ -4,9 +4,9 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/e2b-dev/infra/packages/auth/internal/token"
-	"github.com/e2b-dev/infra/packages/auth/internal/token/jwks"
-	"github.com/e2b-dev/infra/packages/auth/internal/token/oidc"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/jwks"
+	"github.com/e2b-dev/infra/packages/auth/pkg/auth/internal/token/oidc"
 )
 
 type ProviderConfig = token.ProviderConfig
diff --git a/packages/dashboard-api/Dockerfile b/packages/dashboard-api/Dockerfile
index 366bb12ccb..fc66ec7cba 100644
--- a/packages/dashboard-api/Dockerfile
+++ b/packages/dashboard-api/Dockerfile
@@ -30,7 +30,6 @@ RUN go mod download
 WORKDIR /build
 
 COPY ./auth/pkg ./auth/pkg
-COPY ./auth/internal ./auth/internal
 COPY ./clickhouse/pkg ./clickhouse/pkg
 COPY ./shared/pkg ./shared/pkg
 COPY ./db/client ./db/client