feat: Fase 4 — Category Management: BROWSER-VERIFIED

config-service/src/main/resources/configurations/gateway-service.yml

@@ -221,7 +221,10 @@ spring:
         - id: product-service
           uri: lb://PRODUCT-SERVICE
           predicates:
-            - Path=/api/v1/products/**
+            # Fase 4: /categories is a new top-level resource also served by product-service
+            # (category admin CRUD). Same route/filters as products; write auth is enforced
+            # inside product-service (@PreAuthorize ADMIN), mirroring how products works.
+            - Path=/api/v1/products/**,/api/v1/categories/**
           filters:
             - AddResponseHeader=API-Version, v1
             - AddResponseHeader=Sunset, TBD
@@ -398,6 +401,9 @@ gateway:
   public-paths:
     - /api/v1/auth/**
     - /api/v1/products/**
+    # Fase 4: like products, the gateway lets categories through unauthenticated and
+    # product-service enforces write auth (GET public; POST/PUT/DELETE → ADMIN).
+    - /api/v1/categories/**
     - /actuator/**
     - /fallback/**
   load-shedding:

docker-compose.yml

@@ -451,7 +451,7 @@ services:
       JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
       GATEWAY_MAX_CONCURRENT: 5000
       GATEWAY_TENANT_SERVICE_BASE_URL: http://tenant-service:8095
-      GATEWAY_PUBLIC_PATHS: /api/v1/auth/**,/actuator/**,/fallback/**,/api/v1/products,/api/v1/products/**
+      GATEWAY_PUBLIC_PATHS: /api/v1/auth/**,/actuator/**,/fallback/**,/api/v1/products,/api/v1/products/**,/api/v1/categories,/api/v1/categories/**
       VAULT_ENABLED: ${VAULT_ENABLED:-false}
       VAULT_HOST: ${VAULT_HOST:-vault}
       VAULT_TOKEN: ${VAULT_TOKEN:-root-token}