feat(gateway): compose authenticated Habit Today state

[seonghobae]

Outcome

Advance #163 from Planning-only Today composition to real Planning + Habit service composition without cross-service persistence reads or browser-selected tenant authority.

Product/security boundary

• Habit exposes a signed-workspace GET /v1/habits/today?date=YYYY-MM-DD application boundary backed by service-owned persistence/domain rules.
• Gateway derives workspace authority from Identity, mints separate short-lived signed contexts for Planning and Habit, and never forwards browser cookies downstream.
• Habit evidence is shape/media/size/identifier/date bounded before it enters the public Gateway response.
• Missing optional Habit configuration yields explicit habits_not_configured; dependency/configuration/representation failure yields explicit habits_unavailable with no fabricated habit content.
• Planning authentication/not-found/unavailable semantics remain fail-closed.
• .env.example now carries the Habit service origin and gateway-context secret required to activate the optional composition.

Test-first evidence

The branch first introduced a failing Habit Today domain contract and a failing Gateway Habit composition contract, then implemented the narrow service and Gateway paths. The existing Habit authority regression was extended from five to six workspace-scoped routes.

Canonical documentation

Whole-product PRD/TRD/Architecture/UML/API/operability/traceability authority remains the single canonical #145 line; this product PR does not create a competing documentation graph. #145 must reconcile this boundary after its writer lease is safe.

Closes the Habit-composition remainder of #163 only after unchanged-head CI/security/review and protected-main integration prove the complete boundary.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: eb3bfdc1-c2ca-4e05-842b-7bbfdf7dce57

📥 Commits

Reviewing files that changed from the base of the PR and between 6a9d104 and d8059e8.

📒 Files selected for processing (8)

• .env.example
• apps/gateway/src/app.module.ts
• apps/gateway/src/today-composition.ts
• apps/gateway/src/today-habit-composition.test.ts
• apps/habit-service/src/habit-controller-authority.test.ts
• apps/habit-service/src/habit-domain.ts
• apps/habit-service/src/habit-today.test.ts
• apps/habit-service/src/main.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.