[rdself]

Summary

• Fixes the authz gap where /v1beta/* Gemini-compatible aliases were rewritten to /api/v1beta/* without first entering the central proxy/authz pipeline.
• Classifies both /v1beta/* aliases and /api/v1beta/* routes as CLIENT_API, so the existing clientApiPolicy enforces Bearer auth when REQUIRE_API_KEY is enabled.
• Updates the authz inventory and guide so the security surface matches runtime behavior.

Root Cause

next.config.mjs already rewrote /v1beta/:path* to /api/v1beta/:path*, but src/proxy.ts did not match /v1beta before rewrite and classifyRoute() did not classify /api/v1beta/* as client API. As a result, unauthenticated /v1beta/models/...:generateContent traffic could reach the model-serving route without the central client API auth policy.

Validation

• node --import tsx/esm --test tests/unit/authz/classify.test.ts
• node --import tsx/esm --test tests/unit/authz/proxy-contract.test.ts
• node --import tsx/esm --test tests/unit/authz/pipeline.test.ts
• node --import tsx/esm --test tests/unit/api/authz-inventory.test.ts
• npm run check:fabricated-docs
• git diff --check
• Push hook: npm run check:any-budget:t11, npm run check:tracked-artifacts

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.