Local dev frontend cannot connect: all interactive /api routes 401 even with valid login token

[alexeygrigorev]

Raw intake from local dev session (2026-09-10).

Symptom: the Vite frontend on :3002 loads, but every data call fails. Backend log shows repeated 4xx on the operating_model route family; curl confirms GET /api/operating-model and /api/tasks return 401, with and without a valid Bearer token from POST /api/auth/login.

Suspected area: backend/src/router.ts session middleware is skipped whenever the docs-domain portal layer authorizes the request, but with browser auth unconfigured (local dev) the portal authorizes with no identity, so no x-user-id is ever set and bearer sessions are never validated downstream. resolveInteractiveActor then fails closed with 401.

Repro:

1. make dev (frontend :3002, backend :3001)
2. curl -X POST :3002/api/auth/login -d '{"email":"alexey@datatalks.club","password":"111"}' -> 200 + token
3. curl :3002/api/operating-model -H "Authorization: Bearer " -> 401 (expected 200)
4. curl ':3002/api/tasks?date=2026-09-10' -H "Authorization: Bearer " -> 401 (expected 200)

[alexeygrigorev]

Engineer findings (uncommitted WIP in main checkout):

Root cause: with the docs-domain portal on and browser auth unconfigured (local dev), handlePortal authorizes every request with no identity. The router session middleware skipped bearer validation whenever portalAuthorized was true, so no x-user-id was ever established and resolveInteractiveActor failed closed -> 401 on all interactive routes, even with a valid POST /api/auth/login token.

Fix (backend/src/router.ts): gate the session middleware on verifiedInteractiveUserId (browserUserId || portalUserId) instead of (!portalUserId && !portalAuthorized). Bearer sessions are now validated whenever no verified identity exists. Prod (Cognito cookie), portal-broker headers, test bypass, and docs-domain-off paths are unchanged.

Regression test: backend/tests/portal-auth.test.ts -> validates bearer sessions when the portal authorizes without an identity. Fails on pre-fix code (401), passes with fix.

Verification:

• typecheck clean (all 3 projects)
• auth surface: 178/178 pass
• full backend suite: 1108 pass, 0 fail, 1 skipped
• live dev server: login token -> /api/operating-model 200, /api/tasks 200, /api/cards 200; no token -> 401

Needs Tester + PM acceptance before commit (/part of normal pipeline).