fix(authz): classify /dashboard/onboarding as PUBLIC to unblock setup wizard (#2127)

- Add exact-match guard for /dashboard/onboarding before the broad /dashboard prefix
- Add setup_wizard and client_api_mcp to ClassificationReason union type
- Update test to verify PUBLIC classification

Co-authored-by: HomerOff <homeroff76@gmail.com>

src/server/authz/classify.ts

@@ -53,6 +53,14 @@ export function classifyRoute(rawPath: string, method: string = "GET"): RouteCla
     };
   }
 
+  if (normalizedPath === "/dashboard/onboarding") {
+    return {
+      routeClass: "PUBLIC",
+      reason: "setup_wizard",
+      normalizedPath,
+    };
+  }
+
   if (normalizedPath.startsWith("/dashboard")) {
     return {
       routeClass: "MANAGEMENT",

src/server/authz/types.ts

@@ -28,7 +28,9 @@ export type ClassificationReason =
   | "public_prefix"
   | "public_readonly_prefix"
   | "dashboard_prefix"
+  | "setup_wizard"
   | "client_api_v1"
+  | "client_api_mcp"
   | "client_api_alias"
   | "client_api_codex_alias"
   | "client_api_double_prefix"

tests/unit/authz/classify.test.ts

@@ -16,7 +16,7 @@ const cases: Case[] = [
   { name: "root /", path: "/", expectedClass: "MANAGEMENT", expectedNormalized: "/" },
   { name: "dashboard root", path: "/dashboard", expectedClass: "MANAGEMENT" },
   { name: "dashboard nested", path: "/dashboard/settings", expectedClass: "MANAGEMENT" },
-  { name: "dashboard onboarding", path: "/dashboard/onboarding", expectedClass: "MANAGEMENT" },
+  { name: "dashboard onboarding", path: "/dashboard/onboarding", expectedClass: "PUBLIC" },
 
   {
     name: "/api/v1 base",