Profile Route Browser Smoke

Scope

This opt-in browser smoke proves the current-user profile update compatibility routes from the real teacher frontend page through api-gateway with the non-default profile route table. It does not promote deploy/gateway/routes.json and does not replace populated-target cutover validation.

The smoke opens /teacher/profile in a browser context, seeds a disposable teacher profile directly in profile-service as owner-service setup, then sends browser-originated requests through api-gateway only:

• PATCH /api/auth/me/profile
• PATCH /api/auth/me/teacher-profile

It also verifies GET /api/auth/me remains on the broad legacy auth sibling route in the profile route table.

Required Runtime

Start these processes before live mode:

• profile-service, default PROFILE_SERVICE_BASE_URL=http://localhost:8082
• api-gateway, default GATEWAY_BASE_URL=http://localhost:8085
• teacher frontend, default WEB_BASE_URL=http://localhost:5202
• gateway route table: GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-native-localhost-example.json

The teacher frontend must point VITE_API_BASE_URL at the gateway URL used by the smoke. Use the same AUTH_JWT_SECRET for the gateway and the smoke when the smoke mints its local HS256 bearer token.

Run

Static self-test:

cd go-platform
PROFILE_ROUTE_BROWSER_SELF_TEST=1 make test-profile-routes-browser

Confirmed browser run:

cd go-platform
PROFILE_ROUTE_BROWSER_CONFIRM=profile-native \
PROFILE_ROUTE_BROWSER_SEED_CONFIRM=seed-profile \
WEB_BASE_URL=http://localhost:5202 \
GATEWAY_BASE_URL=http://localhost:8085 \
PROFILE_SERVICE_BASE_URL=http://localhost:8082 \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
make test-profile-routes-browser

Useful optional variables:

• PROFILE_ROUTE_BROWSER_AUTHORIZATION='Bearer <token>' to provide an existing gateway-valid teacher token instead of minting a local HS256 token.
• PROFILE_ROUTE_BROWSER_USER_ID=<account-id> to choose the disposable profile id.
• PROFILE_ROUTE_BROWSER_PATH=/teacher/profile to change the frontend route.
• PROFILE_ROUTE_BROWSER_ARTIFACT_DIR=output/playwright/<name> to control artifact output.
• PROFILE_ROUTE_BROWSER_HEADLESS=0 for headed local debugging.
• PROFILE_ROUTE_BROWSER_SKIP_LEGACY_GUARD=1 only when the isolated smoke environment cannot reach the broad legacy sibling route.

Latest Local Proof

On 2026-07-09, browser mode passed against local profile-service, api-gateway, and teacher-web:

HTTP_ADDR=:8082 ENV=local GOTOOLCHAIN=go1.25.11 \
go run ./services/profile-service/cmd/server

HTTP_ADDR=:18089 \
LEGACY_API_BASE_URL=http://127.0.0.1:9 \
GATEWAY_ROUTE_TABLE=deploy/gateway/routes.profile-native-localhost-example.json \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
GOTOOLCHAIN=go1.25.11 \
go run ./services/api-gateway/cmd/server

VITE_API_BASE_URL=http://localhost:18089 \
pnpm --filter @hoctapaz/teacher-web exec vite --host 127.0.0.1 --port 5212

Then:

PROFILE_ROUTE_BROWSER_CONFIRM=profile-native \
PROFILE_ROUTE_BROWSER_SEED_CONFIRM=seed-profile \
PROFILE_ROUTE_BROWSER_ARTIFACT_DIR=output/playwright/profile-route-browser-smoke-20260709-121825 \
PROFILE_ROUTE_BROWSER_HEADLESS=1 \
WEB_BASE_URL=http://localhost:5212 \
GATEWAY_BASE_URL=http://localhost:18089 \
PROFILE_SERVICE_BASE_URL=http://localhost:8082 \
AUTH_JWT_SECRET=local-hoctapaz-development-secret-change-before-deploy \
make test-profile-routes-browser

Artifacts were written under:

output/playwright/profile-route-browser-smoke-20260709-121825/

Observed route evidence:

• /teacher/profile: browser page stayed on the teacher profile route and wrote teacher-profile-page.png.
• /api/auth/me/profile: status 200, route profile-base-update, state native_write.
• /api/auth/me/teacher-profile: status 200, route profile-teacher-update, state native_write.
• /api/auth/me?source=profile-route-browser-smoke: status 502, route auth, state legacy_proxy. The 502 is expected because the legacy target was a deliberate dummy endpoint.

Rollback

Switch GATEWAY_ROUTE_TABLE back to deploy/gateway/routes.json; the default table still keeps the profile compatibility routes on the broad legacy auth route. This smoke writes only to the disposable local profile-service runtime used for the proof.