From d34ab15f921443bdf394b2b6cc97a36a54be3c8c Mon Sep 17 00:00:00 2001
From: chrischristiansen-glitch <chris.christiansen@vauco.no>
Date: Wed, 10 Jun 2026 19:52:31 +0200
Subject: [PATCH] =?UTF-8?q?docs:=20fix=20AUTH-L=C3=98SNING=20section=20?=
 =?UTF-8?q?=E2=80=94=20correct=20Cloud=20Run=20URL=20and=20token=20method?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/ROADMAP.md | 46 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 40 insertions(+), 6 deletions(-)

diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 91337e4..6430732 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -100,27 +100,61 @@
 - [x] **Emma Vauger** — Registrert som agent `emma.vauger@vauco.no` · 2026-06-10
 - [x] **CI5** — OPAX-MCP build + deploy SUCCESS · 2026-06-10 ✅
 - [x] **CI6** — Jason kaller OPAX-MCP live, returnerer faktisk build-ID · 2026-06-10 ✅
+- [x] **CI/CD smoke-test pipeline** — BASE_URL hardkodet, IAM run.invoker fikset, --audiences bug løst · 2026-06-10 ✅
 
 ---
 
-## AUTH-LØSNING (autoritativ) — Cloud Run / IAP fra VM
+## AUTH-LØSNING (autoritativ) — Cloud Run / IAP
 
-> Bruk alltid denne metoden for curl-kall mot `osvauco-agent` fra dev-VM:
+> Oppdatert 2026-06-10 etter smoke-test debugging. Tidligere versjon var feil.
+
+### Kanoniske URL-er
+
+```
+Kanonisk URL:  https://osvauco-agent-357036551735.us-central1.run.app  ← bruk ALLTID denne
+IAP/public URL: https://opax.vauco.no
+Cloud Build SA: 357036551735@cloudbuild.gserviceaccount.com
+```
+
+> ⚠️ `zjbqp3prqq`-URL er den interne Cloud Run URL — den fungerer IKKE som `--audiences` target for identity tokens. Bruk alltid `357036551735`-URL (kanonisk) eller `opax.vauco.no` (public).
+
+### Fra dev-VM (metadata token)
 
 ```bash
+# Hent token via GCE metadata (riktig audience = kanonisk URL):
 TOKEN=$(curl -s -H "Metadata-Flavor: Google" \
-  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://osvauco-agent-zjbqp3prqq-uc.a.run.app&format=full")
+  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://osvauco-agent-357036551735.us-central1.run.app&format=full")
 
 curl -s \
   -H "Authorization: Bearer $TOKEN" \
   -H "x-goog-authenticated-user-email: accounts.google.com:chris.christiansen@vauco.no" \
   -H "Content-Type: application/json" \
   -d '{"user_id": "chris", "session_id": "<session-id>", "message": "<melding>"}' \
-  https://osvauco-agent-zjbqp3prqq-uc.a.run.app/run
+  https://osvauco-agent-357036551735.us-central1.run.app/run
 ```
 
-**Viktig:** Bruk `zjbqp3prqq`-URL (ikke `357036551735`-URL) som audience og endepunkt.
-**Aldri** bruk `gcloud auth print-identity-token` uten `--audiences` — gir feil audience.
+### Fra Cloud Build smoke-test
+
+```bash
+# ALDRI --audiences flagg — returnerer tomt token:
+# TOKEN=$(gcloud auth print-identity-token --audiences="$URL")  ← FEIL
+
+# RIKTIG:
+BASE_URL="https://osvauco-agent-357036551735.us-central1.run.app"
+TOKEN=$(gcloud auth print-identity-token)
+
+curl -s -o /dev/null -w "%{http_code}" \
+  -H "Authorization: Bearer $TOKEN" \
+  "$BASE_URL/health"
+```
+
+### Fra gcloud CLI (lokal maskin)
+
+```bash
+TOKEN=$(gcloud auth print-identity-token)
+curl -H "Authorization: Bearer $TOKEN" \
+  https://osvauco-agent-357036551735.us-central1.run.app/health
+```
 
 ---