alkhttp/tasks/server/review-001-extra-routes-auth.md at 12b35e2c5f8bb16217d937296ca6df9135318843

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

2.0 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 finding SRV-01 (docs/reviews/001-initial-implementation-review.md, empirically verified): build_router (src/server/adapter.rs:170-183) applies bearer_auth_middleware via route_layer before merging extra_routes, so assembly-layer custom routes are mounted without auth — contradicting ADR-046 §4 ("custom routes carry the same auth middleware by default"). Amplified by ResolvedIdentity extraction being infallible: a custom handler silently receives None on every request.

Fix: apply the auth layer after merging extra routes so the documented default holds. Per-route opt-out remains the deployment's explicit choice (extras may carry their own inner layers). Also decide and document the SRV-06 interaction: a same-method collision on a reserved path panics in axum's merge (sanctioned), but a different-method merge (e.g. custom POST /search) silently serves on a reserved path — enforce RESERVED_PATHS or document the behavior; the exported constant currently has no reader.

Acceptance Criteria

A test mounts an extra route and asserts ResolvedIdentity is resolved from the bearer token (auth applies)
A test shows an extra route carrying its own layer can still opt out (documented escape hatch)
SRV-06 decision landed: per-method reserved-path merges rejected/documented; RESERVED_PATHS enforced or un-exported
ADR-046 §4 language matches the implemented default after the fix
cargo test and cargo clippy --all-targets -- -D warnings pass

References

docs/reviews/001-initial-implementation-review.md (Part A, SRV-01, SRV-06)
docs/architecture/decisions/046-assembly-layer-custom-http-routes.md

Notes

Agent fills during implementation.

Summary

Filled on completion.

2.0 KiB Raw Blame History