Topolo Roadmapper

Authority

Service IDs:

Repos: PlatformApplications/TopoloRoadmapper

Hosts:

Dependencies: topolo-auth, topolo-nexus, applications-packages

Depends on Topolo Auth: yes

Contract Source

Type: curated

Source: PlatformApplications/TopoloRoadmapper/package.json

Source exists: yes

Current contract coverage is curated rather than OpenAPI-backed, and the browser launcher lane now reads Auth-owned catalog data through same-origin /api/auth/* on the Roadmapper host using the current Auth organization and active context. The browser login handoff, embedded password-login surface, and Auth SSO one-time sso_code callback redemption delegate to the shared Topolo auth client, direct bearer-token callback URLs or /sso?token= bridge routes are not supported, Roadmapper keeps same-tab sessionStorage access-token restore enabled by default after login and refresh so normal reloads do not appear logged out before cookie refresh completes, Roadmapper's vendored @topolo/ui-kit snapshot must stay synchronized with the canonical platform package, the API worker now exposes authenticated `GET /api/widget` for TopoloOne live workspace, and protected API routes now require Topolo Auth validation plus a validated organization context with no Roadmapper-local JWT secret handoff or vendored local HS256 verifier.

API key scopes in Auth catalog: 9

Auth Requirements

No global OpenAPI security scheme is declared.

• api_keys.write
• projects.read
• projects.write
• reports.read
• reports.write
• roadmaps.read
• roadmaps.write
• settings.read
• settings.write

Runtime and Deployment

Wrangler surfaces: PlatformApplications/TopoloRoadmapper/apps/api/wrangler.toml, PlatformApplications/TopoloRoadmapper/apps/web/wrangler.toml

Environment variables: ENVIRONMENT, FRONTEND_URL, SERVICE_ID, TOPOLO_AUTH_API_URL, route

Routes: workers.dev or Pages-only delivery

Observability enabled: yes