Treat simulation gateway probe as public

Author: anth-volk

.github/scripts/deploy_cloud_run_candidate.sh

@@ -22,7 +22,6 @@ env_vars=(
   "GATEWAY_AUTH_AUDIENCE=${GATEWAY_AUTH_AUDIENCE}"
   "GATEWAY_AUTH_CLIENT_ID=${GATEWAY_AUTH_CLIENT_ID}"
   "GATEWAY_AUTH_CLIENT_SECRET_RESOURCE=${GATEWAY_AUTH_CLIENT_SECRET_RESOURCE}"
-  "CLOUD_RUN_INTERNAL_PROBES=1"
   "API_HOST_BACKEND=cloud_run"
   "SIM_FRONT_DOOR=old_gateway_direct"
   "SIM_COMPUTE_ECONOMY=old_gateway"

docs/migration-pr3-cloud-run-candidate-runbook.md

@@ -15,8 +15,8 @@ does not migrate the public App Engine/custom API URL.
   service account used to run `gcloud`.
 - The same live staging integration suite against both the App Engine staging
   URL and the tagged Cloud Run staging URL.
-- Production smoke tests against the tagged Cloud Run URL, including an
-  internal simulation-gateway health probe.
+- Production smoke tests against the tagged Cloud Run URL, including the public
+  simulation-gateway health probe.
 - Tier 1 Cloud Run startup supervision: the container still runs local Redis,
   but the bash startup script tracks Redis and Uvicorn child PIDs explicitly and
   exits if either process dies.

policyengine_api/asgi_factory.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import os
 import time
 import uuid
 from typing import Literal
@@ -32,14 +31,6 @@ class SimulationGatewayHealthResponse(BaseModel):
     simulation_gateway: Literal["healthy"]
 
 
-def _internal_probes_enabled() -> bool:
-    return os.environ.get("CLOUD_RUN_INTERNAL_PROBES", "").lower() in {
-        "1",
-        "true",
-        "yes",
-    }
-
-
 def _add_vary_origin(response) -> None:
     vary = response.headers.get("Vary")
     if vary is None:
@@ -92,9 +83,6 @@ def health() -> HealthResponse:
         include_in_schema=False,
     )
     def simulation_gateway_health() -> SimulationGatewayHealthResponse:
-        if not _internal_probes_enabled():
-            raise HTTPException(status_code=404, detail="Not found")
-
         from policyengine_api.libs.simulation_api_modal import SimulationAPIModal
 
         try:

tests/unit/test_asgi_factory.py

@@ -162,17 +162,7 @@ def test_health_route_uses_same_reflected_cors_policy():
     assert response.headers["vary"] == "Origin"
 
 
-def test_simulation_gateway_health_probe_is_disabled_by_default(monkeypatch):
-    monkeypatch.delenv("CLOUD_RUN_INTERNAL_PROBES", raising=False)
-    client = TestClient(create_asgi_app(create_test_wsgi_app()))
-
-    response = client.get("/health/simulation-gateway")
-
-    assert response.status_code == 404
-
-
-def test_simulation_gateway_health_probe_checks_gateway(monkeypatch):
-    monkeypatch.setenv("CLOUD_RUN_INTERNAL_PROBES", "1")
+def test_public_simulation_gateway_health_probe_checks_gateway():
     client = TestClient(create_asgi_app(create_test_wsgi_app()))
 
     with patch(
@@ -191,8 +181,7 @@ def test_simulation_gateway_health_probe_checks_gateway(monkeypatch):
     simulation_api.return_value.health_check.assert_called_once_with()
 
 
-def test_simulation_gateway_health_probe_reports_failure(monkeypatch):
-    monkeypatch.setenv("CLOUD_RUN_INTERNAL_PROBES", "1")
+def test_public_simulation_gateway_health_probe_reports_failure():
     client = TestClient(create_asgi_app(create_test_wsgi_app()))
 
     with patch(

tests/unit/test_cloud_run_deploy_scripts.py

@@ -168,7 +168,7 @@ def test_deploy_cloud_run_candidate_dry_run_never_shifts_traffic():
         f"POLICYENGINE_DB_INSTANCE_CONNECTION_NAME={PRODUCTION_CLOUD_SQL_INSTANCE}"
         in result.stdout
     )
-    assert "CLOUD_RUN_INTERNAL_PROBES=1" in result.stdout
+    assert "CLOUD_RUN_INTERNAL_PROBES" not in result.stdout
     assert "--to-latest" not in result.stdout
     assert "update-traffic" not in result.stdout