homelab-frontend/tasks/8.4-workflow-adapter.md

8.4 — X-Service: workflow adapter, supersedes /workflow/* prefix (GREEN)

Phase: 8 — ServiceAdapter CRD rollout Stage: RED Depends on: 8.1, 8.2, 8.3

Design contract: API_ROUTING_HYBRID_DESIGN.md §2. Supersedes 7.3 — that task's prefix-based /workflow/* route was itself mocked/partial (see INDEX.md Progress note); this task replaces it with the header-based adapter rather than finishing it as originally specced. Do not also try to complete 7.3's checklist — its route is retired, not extended.

• k8s/serviceadapter-workflow.yaml CR: serviceName: workflow, upstream = the Temporal Service in the temporal namespace, auth.capability: workflow:access
• Resource workflow maps: POST → START_WORKFLOW, GET /workflow/{id} → QUERY_WORKFLOW, GET (list) → LIST_WORKFLOWS, DELETE /workflow/{id} → TERMINATE_WORKFLOW, GET /workflow/{id}/history → GET_WORKFLOW_HISTORY (§2's mapping table)
• requestSchema on START_WORKFLOW's POST method — fields for whatever the Temporal start-workflow call actually needs (namespace, workflow type, args); define against the real internal/temporal client code, not invented fields
• Long-poll/streaming semantics from the old /workflow handler are preserved unbuffered through the new dispatcher (G4 still applies)
• Nothing in this adapter registers a Temporal namespace — registration stays with queue-operator, same invariant as 7.3
• Old /workflow* path-mounted route is removed once this adapter is verified live
• Metrics/rejection counters cover this adapter with its own service label

Verify

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/ \
  -H 'X-Service: workflow' -H 'X-Resource: workflow'
# expected: 401 without a token

curl -s -X POST https://api.riotpiao.com/ \
  -H "Authorization: Bearer $WORKFLOW_TOKEN" \
  -H 'X-Service: workflow' -H 'X-Resource: workflow' \
  -d '{"namespace": "default", "workflowType": "smoke-test", "args": []}'
# expected: 200/202, Temporal's own start-workflow response, proxied unmodified

curl -s https://api.riotpiao.com/ \
  -H "Authorization: Bearer $WORKFLOW_TOKEN" \
  -H 'X-Service: workflow' -H 'X-Resource: workflow/<id>/history'
# expected: 200, workflow history payload

kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
diff /tmp/ns.before /tmp/ns.after
# expected: no diff