IAM/Profile Route Rollback Rehearsal

Scope

This rehearsal proves the IAM/Profile native route examples can roll back to the default gateway route table without promoting public routes. It is static by default and does not call IAM, Profile, or the legacy API.

The script checks:

• auth-native cutover routes target iam-service on exact /api/auth* and /api/admin/auth-settings/google carve-outs
• profile-native cutover routes target profile-service on exact /api/auth/me/*profile carve-outs
• deploy/gateway/routes.json keeps broad auth, admin, and fallback routes on legacy_proxy
• exact IAM/Profile carve-out route names are absent, removed, or legacy_proxy in the rollback table

Run

Static self-test:

cd go-platform
IAM_PROFILE_ROUTE_ROLLBACK_SELF_TEST=1 make test-iam-profile-route-rollback

Static rehearsal against the checked-in route tables:

cd go-platform
make test-iam-profile-route-rollback

Write a rollback evidence artifact:

cd go-platform
IAM_PROFILE_ROUTE_ROLLBACK_ARTIFACT_DIR=output/qa/iam-profile-route-rollback-$(date +%Y%m%d-%H%M%S) \
make test-iam-profile-route-rollback

Optional live rollback check against a gateway already running on the default route table:

cd go-platform
IAM_PROFILE_ROUTE_ROLLBACK_LIVE=1 \
IAM_PROFILE_ROUTE_ROLLBACK_CONFIRM=default-legacy \
GATEWAY_BASE_URL=http://localhost:8085 \
make test-iam-profile-route-rollback

Live mode fetches /v1/routes, then checks that /api/auth/google/config, /api/auth/me/profile, and /api/admin/auth-settings/google route through the broad legacy auth or admin routes.

Latest Local Proof

On 2026-07-09, live rollback mode was refreshed against a standalone gateway on http://localhost:18085 with:

HTTP_ADDR=:18085 \
LEGACY_API_BASE_URL=http://127.0.0.1:9 \
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.json \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
GOTOOLCHAIN=go1.25.11 \
go run ./services/api-gateway/cmd/server

Then:

IAM_PROFILE_ROUTE_ROLLBACK_LIVE=1 \
IAM_PROFILE_ROUTE_ROLLBACK_CONFIRM=default-legacy \
IAM_PROFILE_ROUTE_ROLLBACK_ARTIFACT_DIR=output/qa/iam-profile-route-rollback-20260709-114911 \
GATEWAY_BASE_URL=http://localhost:18085 \
make test-iam-profile-route-rollback

Artifacts were written under:

output/qa/iam-profile-route-rollback-20260709-114911/

The artifact includes summary.json, live-routes.json, response headers, response bodies, and rollback-rehearsal.md. The gateway returned 502 because the legacy target was a deliberate dummy endpoint, but the relevant headers proved rollback routing:

• /api/auth/google/config: X-Hoctapaz-Gateway-Route: auth, X-Hoctapaz-Gateway-Route-State: legacy_proxy
• /api/auth/me/profile: X-Hoctapaz-Gateway-Route: auth, X-Hoctapaz-Gateway-Route-State: legacy_proxy
• /api/admin/auth-settings/google: X-Hoctapaz-Gateway-Route: admin, X-Hoctapaz-Gateway-Route-State: legacy_proxy

summary.json recorded status=passed and broad rollback routes auth, admin, and fallback all as legacy_proxy. The temporary gateway process was stopped after the run.

Rollback Rule

Use deploy/gateway/routes.json as GATEWAY_ROUTE_TABLE to roll back. The exact IAM/Profile native carve-outs must not remain active in the default table; broad auth, admin, and fallback stay legacy_proxy.

This rehearsal is not route promotion. Default public route promotion still requires approved gateway/browser proof for the candidate route set, real production-like populated database validation, and final text-id cleanup planning.

For the current read-only IAM default candidate set, use make test-iam-profile-default-candidate-rollback with the generated candidate-routes.json. The latest local candidate rollback proof is recorded under:

output/qa/iam-profile-default-candidate-rollback-20260709-095948/