Auth Route Live Smoke

Scope

This opt-in smoke proves selected /api/auth* gateway routes against the non-default auth-native route table. It does not create accounts, does not write auth state, and does not promote the default route table.

The smoke checks:

• GET /v1/routes exposes the expected native auth carve-outs.
• GET /api/auth/google/config reaches iam-service through auth-google-config.
• unauthenticated GET /api/auth/me reaches iam-service through auth-me and returns the IAM AUTH_UNAUTHORIZED envelope.
• sibling GET /api/auth/me/profile remains on the broad legacy auth route.

This HTTP smoke does not prove browser CORS behavior. Use docs/qa/auth-route-browser-smoke.md for login page preflight and browser-observed route headers.

Required Runtime

Start these processes before live mode:

• API gateway, default GATEWAY_BASE_URL=http://localhost:8085
• iam-service, default target from deploy/gateway/routes.auth-native-localhost-example.json
• gateway route table: GATEWAY_ROUTE_TABLE=deploy/gateway/routes.auth-native-localhost-example.json

Run

Static self-test:

cd go-platform
AUTH_ROUTE_LIVE_SELF_TEST=1 make test-auth-routes-live

Confirmed live run:

cd go-platform
AUTH_ROUTE_LIVE_CONFIRM=auth-native \
GATEWAY_BASE_URL=http://localhost:8085 \
make test-auth-routes-live

Useful optional variables:

• AUTH_ROUTE_LIVE_ARTIFACT_DIR=output/smoke/<name> to copy response headers and bodies.
• AUTH_ROUTE_LIVE_SKIP_ROUTE_ASSERT=1 when /v1/routes is intentionally disabled in a tightly scoped gateway environment.
• AUTH_ROUTE_LIVE_SKIP_LEGACY_GUARD=1 only when the broad legacy auth sibling is not reachable in the isolated smoke environment.

Latest Local Proof

On 2026-07-10, live mode passed against a real local iam-service and api-gateway:

HTTP_ADDR=:8081 \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
GOTOOLCHAIN=go1.25.11 \
go run ./services/iam-service/cmd/server

HTTP_ADDR=:18086 \
LEGACY_API_BASE_URL=http://127.0.0.1:9 \
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.auth-native-localhost-example.json \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
GOTOOLCHAIN=go1.25.11 \
go run ./services/api-gateway/cmd/server

Then:

AUTH_ROUTE_LIVE_CONFIRM=auth-native \
AUTH_ROUTE_LIVE_ARTIFACT_DIR=output/qa/auth-route-live-20260710-1543 \
GATEWAY_BASE_URL=http://localhost:18086 \
make test-auth-routes-live

Artifacts were written under:

output/qa/auth-route-live-20260710-1543/

Observed route evidence:

• /api/auth/google/config: status 200, route auth-google-config, state native_read, and IAM response success=true.
• /api/auth/me: status 401, route auth-me, state native_read, and IAM error code AUTH_UNAUTHORIZED.
• /api/auth/me/profile?source=auth-live-smoke: status 502, route auth, state legacy_proxy. The 502 is expected because the legacy target was a deliberate dummy endpoint.

Both local processes were stopped after the run.

The earlier local baseline remains under output/qa/auth-route-live-20260709-115133/. Both runs use a non-default route table and a dummy legacy target; neither is default-route promotion or production-like evidence.

Rollback

Switch GATEWAY_ROUTE_TABLE back to deploy/gateway/routes.json, remove the native auth route-table entries, or set the exact auth carve-outs back to legacy_proxy. This smoke is read-only and writes no IAM/Profile data.