OpenAgents

Reconcile route authority with enforced pipelines #7

Closed AtlantisPleb opened this 15h ago 1 comment

Outcome

Every /api/v3 route has one explicit principal and repository-scope classification that matches its enforcing pipeline.

Current behavior

Route authority metadata and router pipelines can drift, allowing new routes to inherit a broad default.

Contract

Reconcile route authority with the router and fail tests when a route is missing or disagrees with its enforcing plug.

Acceptance criteria

The route inventory covers every /api/v3 route.
Principal and scope classifications match runtime enforcement.
New unclassified routes fail CI.
Read and write policies remain distinct.

Verification

Add route-inventory and authorization tests, run mix precommit, and exercise public and bearer requests in staging.

Dependencies

Coordinate with the derived route inventory work.

AtlantisPleb opened this issue 15h ago
A AtlantisPleb Author 8h ago
Implemented and on main (45f6fff).
- OpenAgentsWeb.ApiRouteAuthority classifies every /api/v3 route as :anonymous, :optional_bearer, or :required_bearer.
- A two-way test compares the inventory against the router: an unclassified new route fails CI, as does a classified route that no longer exists.
- A second test dispatches anonymous requests at every classified route and asserts the enforcing plug behaves as classified — required-bearer routes refuse with 401 before controller code, the others never do.
- The sweep surfaced real 500s: five controllers crashed with ArgumentError on malformed numeric path segments. A shared integer_param! helper routes those through existing rescues into stable 404s.
Full mix precommit passes (2,058 tests). This completes the first delivery slice of #9.
closed this as completed 8h ago