Profile Gateway Adapter Task

Agent workflow: follow README.md for Audit -> Investigate -> Code -> Test -> Fix; keep this pack's writable scope and verification commands authoritative.

Dispatch type: orchestrator

Owner: profile-service; orchestrator owns gateway route examples.

Goal:

Move profile completion/read/update workflows behind gateway native route rehearsal without frontend calling profile-service directly.

Legacy source evidence:

• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/auth/**
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/prisma/schema.prisma
• frontend profile callers under /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/web.

Writable files:

• services/profile-service/**
• services/api-gateway/internal/gateway/**
• deploy/gateway/routes.profile-*.json
• scripts/test/profile-route-coverage.sh
• docs/agents/service-tasks/profile-gateway-adapter.md

Orchestrator-owned files:

• Default gateway route table, browser smoke artifacts, IAM claim contract changes, and final public route promotion.

Tasks:

• [x] Audit legacy /api/auth/me/profile and role-profile routes.
• [x] Map gateway routes to profile-service compatibility endpoints.
• [x] Add auth/header forwarding tests for current account profile updates.
• [x] Keep default routes legacy until browser parity is proven.

Current state:

• Added non-default gateway route tables:
  • deploy/gateway/routes.profile-native-example.json
  • deploy/gateway/routes.profile-native-localhost-example.json
• Gateway target_prefix supports current-user path templates such as /v1/users/{userId}/profile, with {userId} derived from the verified JWT principal. This is used only by routes that opt into gateway auth.
• Profile update routes covered:
  • PATCH /api/auth/me/profile
  • PATCH /api/auth/me/teacher-profile
  • PATCH /api/auth/me/student-profile
  • PATCH /api/auth/me/parent-profile
• Broad /api/auth remains legacy-proxied in default and rehearsal tables. /api/auth/me, KYC, forgot/reset password, Google auth, test-login, and email-change stay out of this profile adapter slice.

Acceptance:

• Frontend remains gateway-only.
• Profile-service does not verify passwords, issue JWTs, or own roles.
• Public profile routes redact private fields.
• Default route promotion requires browser parity and rollback route-table evidence.

Verification:

• GOTOOLCHAIN=go1.25.11 go test ./services/profile-service/... ./services/api-gateway/internal/gateway
• make test-profile-routes