Task: Move the IAM collections to access and auth
Table of Contents
This page documents a task in the Move the IAM collections onto their areas story. It captures the goal, current status, acceptance, and any notes or results.
1. Goal
The IAM entity collections answer under the area they belong to, and no two routes want the same path for different reasons.
2. Status
| Field | Value |
|---|---|
| State | DONE |
| Parent story | Move the IAM collections onto their areas |
| Now | Nothing. |
| Waiting on | Nothing. |
| Next | Nothing. |
| Last touched | 2026-10-31 |
3. Acceptance
[X]Each IAM entity model declares the area the inventory decided for it.[X]The generated routes, tests, recipes and hurl scripts state the new paths.[X]The session door keeps its path and the generated session collection takes another, with the reason recorded.[X]The iam tests build and pass, and the gates are green.
4. Plan
One area declaration per model, then the generator writes the route unit, its tests, its recipe and its hurl scripts. The classification rules that decide the paths are repointed by hand, because the decisions live outside the generator.
The move exposed a collision worth finding before a bulk edit shipped it. The inventory had
classified the generated session collection into auth, where the session door already
answers: POST /api/v1/auth/sessions signs in and DELETE signs out. Two routes cannot own
one path for different reasons. The door keeps it because it mints the credential, and the
collection becomes /api/v1/access/sessions, the ledger an administrator reads.
Two models declare nothing. auth_event and role_permission_junction render no route unit,
so the declaration would have been inert; their only addresses come from operation routes.
5. Measurements
| What | Value | Command | Commit | |
|---|---|---|---|---|
| Models that declare an area | 6 | python3 build/scripts/check_http_areas.py (7 with the currency model) |
this branch | |
| Routes moved | 61 | =grep -c "api/v1/access\ | api/v1/auth/" projects/ores.http/iam/src/routes/iam/*_routes.cpp= | this branch |
| Generated tests and recipes | 73 files regenerated | git status --short before the commit |
this branch | |
ores.http.iam tests |
34 cases, 285 assertions, 1 skipped, all passing | ./ores.http.iam.tests |
this branch |
6. Notes
- The skipped case is the live sign-in from the session door's task. It skips because this checkout has no fleet running, not because of this move.
- The operation routes still answer under
/api/v1/iam/, and their areas are already decided as access, auth or tenancy. They are the next move, and they need a declaration per operation rather than per entity.
7. Result
The IAM collections answer on access and auth. The session collection is on
/api/v1/access/sessions and the door on /api/v1/auth/sessions, each for its own reason,
and the tests that the generator wrote pass against the built unit.