---
id: review-001-extra-routes-auth
name: Mount extra_routes under the bearer-auth middleware (SRV-01)
status: pending
depends_on: []
scope: narrow
risk: medium
impact: component
level: implementation
tags: [server, review-001, security]
---

## Description

Review 001 finding SRV-01 (`docs/reviews/001-initial-implementation-review.md`,
empirically verified): `build_router`
(`src/server/adapter.rs:170-183`) applies `bearer_auth_middleware` via
`route_layer` **before** merging `extra_routes`, so assembly-layer custom
routes are mounted without auth — contradicting ADR-046 §4 ("custom routes
carry the same auth middleware by default"). Amplified by
`ResolvedIdentity` extraction being infallible: a custom handler silently
receives `None` on every request.

Fix: apply the auth layer **after** merging extra routes so the documented
default holds. Per-route opt-out remains the deployment's explicit choice
(extras may carry their own inner layers). Also decide and document the
SRV-06 interaction: a same-method collision on a reserved path panics in
axum's `merge` (sanctioned), but a different-method merge (e.g. custom
`POST /search`) silently serves on a reserved path — enforce
`RESERVED_PATHS` or document the behavior; the exported constant currently
has no reader.

## Acceptance Criteria

- [ ] A test mounts an extra route and asserts `ResolvedIdentity` is resolved from the bearer token (auth applies)
- [ ] A test shows an extra route carrying its own layer can still opt out (documented escape hatch)
- [ ] SRV-06 decision landed: per-method reserved-path merges rejected/documented; `RESERVED_PATHS` enforced or un-exported
- [ ] ADR-046 §4 language matches the implemented default after the fix
- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass

## References

- docs/reviews/001-initial-implementation-review.md (Part A, SRV-01, SRV-06)
- docs/architecture/decisions/046-assembly-layer-custom-http-routes.md

## Notes

> Agent fills during implementation.

## Summary

> Filled on completion.