---
id: gateway-routes
name: The 5 core gateway routes wired into the router
status: completed
depends_on: [gateway-dispatch, server-adapter]
scope: moderate
risk: medium
impact: component
level: implementation
tags: [gateway, phase-1]
---

## Description

Port `server/gateway_routes.rs` from
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/gateway_routes.rs`:
`GET /search` (AccessControl-filtered services/list), `GET /schema`,
`POST /call` (`{operation, input}`), `POST /batch`, and `POST /subscribe`
(SSE projection: `text/event-stream`, `call.responded` → `data:` frames,
terminal error event, abort on client disconnect). Auth middleware
applied to all five. The route set intentionally excludes `/publish`
(separate task). Integration tests over DuplexStream: search filtering
by identity scopes, call round-trip, subscribe stream of multiple
events, batch correlation.

## Acceptance Criteria

- [x] 5 routes ported and wired in server-adapter's router
- [x] SSE framing tests (multi-event, error-terminates, client-disconnect)
- [x] /search returns only ops the caller's identity can invoke
- [x] Full request→dispatch→response test over DuplexStream
- [x] `cargo test` passes

## References

- docs/architecture/http-server.md (§router list, §Streaming projection)
- docs/architecture/decisions/042-openapi-gateway-pattern.md, 047-remove-direct-call-http-surface.md

## Notes

> Agent fills during implementation.

## Summary

Ported `src/gateway/routes.rs`: GatewayState (FromRef<RouterState>),
`gateway_router()` with the 5 fixed endpoints, SSE subscription
projection (multi-event data frames, error-terminates,
internal/unknown → NOT_FOUND error event, query-op →
INVALID_OPERATION_TYPE), /search ACL-filtered discovery via
`services/list`, /schema access pre-check + `services/schema`, /batch
ordered per-item envelopes, /call with leading-slash tolerance.
Wired `gateway_router()` into HttpAdapter's build_router under the
shared bearer-auth route layer.

Adaptations for alkcall 0.1.1: `OperationType::Sub` (not
`Subscription`), `ResponseEnvelope::error(request_id, error)` by value,
`composition_authority.clone()` when re-registering discovery inner ops.

23 tests: full endpoint matrix over oneshot routers. 71 lib tests green.