Backend Route Ownership Inventory

Date: 2026-06-14. Scope: r-server/server.js and r-server/routes/*. Purpose: define target ownership before extracting platform code from the historical r-server tree.

Current Routing Context

Public nginx rewrites prefixes before they reach the Node process:

/api/platform/* -> ECS biof3-platform -> Node sees /api/*
/api/r/*        -> Dell biof3-r-server -> Node sees /api/*
/api/py/*       -> Dell biof3-py-server

So a local route like GET /api/admin/users is a platform route when reached through /api/platform/admin/users, but must stay blocked from /api/r/admin/* at nginx. Route ownership below describes the intended source-code owner, not only the local Express path.

Ownership Labels

Label	Meaning
platform	ECS platform should own the public behavior.
r-compute	Dell R compute should own the behavior.
dell-internal	Dell serves it only behind ECS internal-token proxy.
shared-compat	Temporarily shared for compatibility or health/status.
needs-decision	Ownership is plausible but should be confirmed before code extraction.

Platform-Owned Routes

These should eventually live under platform-server/ or platform route modules, not in the legacy r-server/server.js body.

Source	Routes	Notes
r-server/server.js	USE /api/data	Project/dataset/analysis CRUD; platform control plane.
r-server/routes/admin-ops.js	GET/POST /api/admin/backup/*	Extracted 2026-06-14. Current backup admin works against ECS Docker PostgreSQL/OSS.
r-server/routes/admin-ops.js	GET/POST /api/admin/oss/*	Extracted 2026-06-14. Platform admin route; uses OSS metadata/cleanup.
r-server/routes/admin-users.js	GET/PUT/POST/DELETE /api/admin/users*	Extracted 2026-06-14. User admin belongs to platform.
r-server/routes/admin-users.js	GET/PUT /api/admin/guest-permissions, GET /api/public/guest-permissions	Extracted 2026-06-14. Platform permissions surface.
r-server/routes/admin-users.js	GET /api/admin/invite-code, POST /api/admin/impersonate/:id	Extracted 2026-06-14. Platform admin/auth support.
r-server/routes/observability.js	GET /api/admin/errors	Extracted 2026-06-14. Platform observability; reads the shared error log helper.
r-server/routes/observability.js	POST /api/error-report, POST /api/pageview	Extracted 2026-06-14. Platform telemetry; duplicate legacy /api/error-report handlers were unified.
r-server/routes/files.js	POST /api/oss/sign, POST /api/upload, GET /api/proxy-file	Extracted 2026-06-14. Platform-owned upload/sign/proxy support; public /api/r/{upload,oss/sign,proxy-file} is blocked at nginx.
r-server/routes/tasks.js	POST /api/task, GET /api/task/:id, GET /api/tasks	Extracted 2026-06-14. Platform-owned R analysis enqueue/status API; writes/reads PostgreSQL queue while Dell R workers execute tasks.
r-server/routes/ai-legacy.js	POST /api/ai/interpret, POST /api/ai/act-ack/:token, POST/GET /api/ai/act-registry	Extracted 2026-06-14. Platform Copilot/AI support compatibility endpoints.
r-server/routes/ai-conversations.js	PATCH /api/ai/conversations/:id	Extracted 2026-06-14. Compatibility alias for conversation update.
r-server/routes/ai-*.js	all /api/ai/* routes	Platform Copilot/AI. Modular already, good extraction candidates.
r-server/routes/analytics.js	/api/analytics/*, /api/admin/realtime-stats, /api/admin/dau-trend, /api/admin/retention, /api/admin/content-popular, /api/admin/funnel, /api/admin/aggregate-daily, /api/admin/visitor-trend, /api/admin/top-ips, /api/admin/recent-visitors	Platform analytics/admin dashboards.
r-server/routes/feedback.js	/api/feedback, /api/feedback/admin, /api/feedback/admin/:id	Platform feedback surface.
r-server/routes/tools.js	/api/tools/history, /api/tools/status/:id, /api/tools/job/:id/name, /api/tools/job/:id/public	Tool metadata/admin routes; ECS platform reads/writes PostgreSQL metadata.

R Compute-Owned Routes

These should remain owned by Dell R compute. ECS platform may enqueue work or proxy files, but it must not run local R Docker execution.

Source	Routes	Notes
r-server/server.js	POST /api/run	Immediate R execution for FigCode/tutorials. Guarded by rComputeOnly in platform mode.
r-server/server.js	POST /api/replot/warmup, POST /api/replot/run, GET /api/replot/status	R Plumber/replot service behind Dell R container. Guarded by rComputeOnly.
r-server/routes/tools.js	POST /api/tools/run	In platform mode this proxies to Dell; in Dell mode it executes locally. Split into platform submit/proxy + Dell execution handler later.
r-server/routes/tools.js	file/demo/public-file routes under /api/tools/*	In platform mode these proxy to Dell local files; in Dell mode they serve local artifact storage. Split into platform authorization/proxy + Dell file service later.

Dell-Internal Routes

These should not be public platform routes. ECS platform may call them with BIOF3_INTERNAL_TOKEN or equivalent.

Source	Routes	Notes
r-server/server.js	GET /api/admin/cache/stats, POST /api/admin/cache/cleanup	Platform proxies to Dell in platform mode; Dell local cache ops must remain internal-only.
r-server/server.js	GET /api/admin/disk/stats, GET /api/admin/assets/inspect	Platform proxies to Dell in platform mode; Dell local disk/assets inspection.
r-server/routes/tools.js	/api/internal/tools/*	Internal Dell file/demo/run/cancel/delete/smoke routes.
r-server/server.js	GET /api/queue/status	Useful for compute/admin health; should stay non-public or internal/health scoped.

Shared Compatibility Routes

These are acceptable in both roles for now, but should stay small and boring.

Source	Routes	Notes
r-server/server.js	GET /api/health	Both ECS platform and Dell R compute need health.
r-server/server.js	middleware: CORS, JSON body parsing, request id, combined auth, module gate	Shared infrastructure now; later belongs in shared backend/bootstrap.
r-server/routes/tools.js	GET /api/tools/public-demo/:toolId, GET /api/tools/public-file/:jobId/:filename	Public demo is platform-facing but Dell-file-backed. Keep shared until file ownership is explicitly split.

Resolved Compatibility Decisions

Route	Decision
/api/r/tools/* legacy compatibility	Source docs/templates now point at /api/platform/tools/.... nginx keeps old public/demo asset paths compatible by terminating them at ECS platform, while old control-plane routes such as history, run, status, file, job, and cancel return 404 instead of reaching Dell.

Legacy server.js Extraction Candidates

Recommended order for Phase 3, low to higher risk:

1. Done 2026-06-14: admin-backup and admin-oss routes moved to r-server/routes/admin-ops.js.
2. Done 2026-06-14: admin-users, guest-permissions, public/guest-permissions, invite code, and impersonation routes moved to r-server/routes/admin-users.js.
3. Done 2026-06-14: /api/ai/interpret, /api/ai/act-ack, /api/ai/act-registry, and the remaining conversation PATCH compatibility route moved into route modules.
4. Done 2026-06-14: upload/sign/proxy-file routes moved into r-server/routes/files.js; frontend FigCode OSS signing now uses /api/platform/oss/sign.
5. Done 2026-06-14: observability routes moved into r-server/routes/observability.js; process-level logging helper moved into r-server/helpers/error-log.js; smoke now checks platform telemetry and admin error viewing.
6. Done 2026-06-14: R task enqueue/status/list routes moved into r-server/routes/tasks.js; public traffic should use /api/platform/task*, while /api/r/task* remains blocked at nginx and Dell workers execute the PostgreSQL queue.
7. Done 2026-06-24: tools.js split complete — platform public routes moved to r-server/routes/tools-platform.js; metadata routes already in tools-metadata.js; Dell internal routes already in tools-internal.js. tools.js is now a registration shell + shared helpers.
8. Done 2026-06-24: compute infrastructure admin routes (compute/health, cache/stats, disk/stats, assets/inspect, cache/cleanup, queue/status) moved to r-server/routes/admin-compute.js.
9. Done 2026-06-24: /api/data router moved from server.js into r-server/routes/index.js registry.

Remaining server.js endpoints

After the Phase 3 extractions above, r-server/server.js (970 lines) keeps only:

• shared middleware: CORS, JSON body, request-id, combinedAuth, moduleGate
• GET /api/health — shared compatibility
• R compute routes (Dell-only, guarded by rComputeOnly): POST /api/run, POST /api/replot/warmup, POST /api/replot/run, GET /api/replot/status
• startup wiring: rate limiters, OSS client, cache/backup schedulers, AI helper globals, event-loop monitor, app.listen

These are intentionally left in server.js per the no-go list: /api/run and /api/replot/* are R compute routes and must stay with Dell R compute. The shared middleware will move in Phase 4/5 when a shared backend module exists.

See docs/ops/TOOLS_INTERNAL_MAP_2026-06-14.md for the route-by-route split map and safe extraction order.

Do not extract /api/run or /api/replot/* into platform. They are R compute routes and should stay with Dell R compute.

Route Registry Risk

r-server/routes/index.js registers modular routes before legacy server.js routes. Express is first-match-wins. If any require() in the registry throws, the whole modular registry fails and legacy routes may still make /api/health pass.

For every route extraction:

• run node --check on changed files
• curl one anonymous or authenticated route from the moved module
• run npm run ops:smoke-platform

Health alone is not a sufficient route-registry test.