homelab-frontend/tasks/8.2-x-service-dispatcher.md

# 8.2 — `X-Service`/`X-Resource` dispatcher (GREEN)

Phase: 8 — ServiceAdapter CRD rollout
Stage: GREEN ✅
Depends on: 8.1 (CRD, in-memory registry)

Design contract: [API_ROUTING_HYBRID_DESIGN.md](../API_ROUTING_HYBRID_DESIGN.md) §2, §4.

- [x] `internal/server/router.go` X-Service branch before path routing
- [x] Path-based routes (`/v1/chat/completions`, etc.) unchanged
- [x] X-Service + X-Resource dispatch to adapter methods
- [x] 404 for unknown services/resources
- [x] Auth stub (SQS requires header, others pass-through)
- [x] HTTP proxying with path rewriting
- [x] gRPC detection (Temporal, Phase 9)
- [x] Real integration tests

**Future (not Phase 8.2):**
- [ ] Blind 5xx retry with backoff (scope: internal/resilience)
- [ ] {id} path parameter resolution (scope: API design)
- [ ] Phase 3: JWT signature validation vs Authentik JWKS

## Verification (Done)

```bash
# ✅ Unknown service → 404
curl -H 'X-Service: nonexistent' https://api.riotpiao.com/
# {"type":"about:blank#not-found","detail":"service 'nonexistent' not found"}

# ✅ Known service, unknown resource → 404
curl -H 'X-Service: sqs' -H 'X-Resource: invalid' https://api.riotpiao.com/
# {"type":"about:blank#not-found","detail":"resource 'invalid' not found"}

# ✅ Authorization header pass-through (MinIO, Temporal, Memory, IAM)
curl -H 'X-Service: s3' -H 'Authorization: Bearer token' https://api.riotpiao.com/
# Requests proxied with header intact

# ✅ SQS requires auth header
curl -H 'X-Service: sqs' https://api.riotpiao.com/
# {"type":"about:blank#forbidden","detail":"SQS requires Authorization header"}

# ✅ Real integration tests
GATEWAY_URL=https://api.riotpiao.com go test -tags integration -v ./internal/serviceadapter
```

## Notes

- Router moved to dumb pipe (Option B): services validate JWTs independently
- SQS special case: Gateway checks header (code unverified, Phase 3 will validate signature)
- MinIO, Temporal: Native JWT support (dumb pipe pass-through)
- ConfigMap-based config, Stakater Reloader auto-restarts on changes
- 5 adapters: sqs, workflow (gRPC), memory, s3, iam