refactor(users): declarative route table [2/8]

[nourshoreibah]

Stack 2/8. Base is #341, not main — review that first. Pure reorganization of the users lambda; no behaviour change.

Before / after

handler.ts went from 308 lines to 4:

import { dispatch } from '@branch/lambda-http';
import { routes } from './routes';

export const handler = (event: any) => dispatch(event, { prefix: 'users', routes });

The five routes now live in a table, in the same order the if chain tested them:

Method	Pattern	Controller
GET	/users	listUsers
GET	/users/:userId	getUser
PATCH	/users/:userId	patchUser
DELETE	/users/:userId	deleteUser
POST	/users	createUser

Each pattern replaces a hand-rolled test — (normalizedPath === '/users' || normalizedPath === '' || normalizedPath === '/') for the list route, normalizedPath.startsWith('/') && normalizedPath.split('/').length === 2 plus split('/')[1] for the :userId ones.

Layout

• routes.ts — the ordered Route[], with the ROUTES-START/ROUTES-END markers moved here so lambda-cli still has an injection point (PR 8/8 teaches it to use them).
• controllers/users.ts — one RouteHandler per route, calling Kysely directly. No services/ layer: this lambda is thin and one would be ceremony.
• The local json() and requireAuth() are deleted in favour of the shared ones.
• db.ts, auth.ts, validation-utils.ts, swagger-utils.ts, dev-server.ts untouched.
• tsconfig.json's include widened to ["*.ts", "controllers/**/*.ts"] so the new subdirectory typechecks.

Tests

53/53 passing, tsc --noEmit clean. Adds a route-precedence test asserting first-match-wins: a literal route ahead of /users/:userId wins for its own path while /users/42 still falls through to the param route.

Two review notes

Authz tests now hit the real checkAuthorization. The suites jest.mock('../auth'), and the old local requireAuth called the mocked checkAuthorization through that module. The shared requireAuth imports it directly from @branch/lambda-auth, which the mock does not intercept. The real implementation was checked against every test's mock for all levels used here (PUBLIC, AUTHENTICATED, ADMIN, ADMIN_OR_SELF) and is logically identical, so outcomes are unchanged — but the tests now exercise the real code path, which is arguably what you want and is worth knowing.

Stack-wide: unmatched paths now 404 instead of 401. Previously the top-level auth check ran before route matching, so an unauthenticated request to a nonexistent path got 401. dispatch returns 404 centrally without running auth, so an unauthenticated caller can now tell "route exists" (401) from "route doesn't" (404). Accepted deliberately: the route inventory is already in the repo's openapi.yaml, and auth-before-routing is exactly what forces each lambda to hand-roll public-route exemptions. Flagging it in every stack PR so it is a decision, not an accident.

🤖 Generated with Claude Code