feat(managed): the managed attachment point declares the routes it serves without a session, and the boot gate allows exactly those

Empty in this repository, as the module itself. An install that replaces the
module adds its anonymous routes in the same file, and the gate still fails on a
route missing there or an entry that went stale.

server/src/nest/common/validate-route-guards.ts

@@ -2,6 +2,7 @@ import { CookieAuthGuard } from '../auth-core/cookie-auth.guard';
 import { JwtAuthGuard } from '../auth-core/jwt-auth.guard';
 import { OptionalJwtGuard } from '../auth-core/optional-jwt.guard';
 import { IS_PUBLIC, OPTIONAL_AUTH } from '../auth-core/public.decorator';
+import { MANAGED_PUBLIC_ROUTES } from '../managed/managed-ext.module';
 import { ApiTokenGuard } from '../public-api/api-token.guard';
 import type { INestApplication } from '@nestjs/common';
 import { METHOD_METADATA, PATH_METADATA, GUARDS_METADATA } from '@nestjs/common/constants';
@@ -181,7 +182,7 @@ export const ANONYMOUS_GUARDED_ROUTE_ALLOW_LIST: string[] = [
  */
 export function validateRouteGuards(
   app: INestApplication,
-  allowList: string[] = PUBLIC_ROUTE_ALLOW_LIST,
+  allowList: string[] = [...PUBLIC_ROUTE_ALLOW_LIST, ...MANAGED_PUBLIC_ROUTES],
   anonymousGuardedAllowList: string[] = ANONYMOUS_GUARDED_ROUTE_ALLOW_LIST,
 ): void {
   const entries = collectRouteGuards(app);

server/src/nest/managed/managed-ext.module.ts

@@ -22,3 +22,13 @@ import { Module } from '@nestjs/common';
  */
 @Module({})
 export class ManagedExtModule {}
+
+/**
+ * Routes of this module that answer without a session, as `Controller.handler`.
+ *
+ * Empty here, like the module. The boot gate (validate-route-guards.ts) adds
+ * them to its allow-list, so an install that replaces this file declares its
+ * anonymous surface in the same place it adds it, and the gate still fails on a
+ * route that is missing here or an entry that is stale.
+ */
+export const MANAGED_PUBLIC_ROUTES: readonly string[] = [];