fix(auth): allow-list the real profile/* public routes (were people/*)

[LilianaTS]

Problem

The public allow-list in server/core/_service_config.js references routes that do not exist:

if (_service.path === 'people/avatar/get'
  || _service.path === 'people/post'
  || _service.path === 'people/options'
  ...

There is no people/ service directory. The real public routes live under profile/:

• server/services/profile/avatar/get.js
• server/services/profile/post.js

The website confirms this — it calls /profile/avatar (multiple call sites) and POST profile (the Register page uses url: 'profile'). Nothing calls people/*.

In development, _service.allow() is called unconditionally, so this is masked. In production, where that blanket allow is gone, public registration and avatar are never allow-listed under their real paths and would be denied.

Fix

Point the allow-list entries at the real routes: profile/avatar/get, profile/post, profile/options.

[Copilot]

🟢 Approval recommended

The change is a small, low-risk correction that aligns the production allow-list with existing, actively-used service routes.

Pull request overview

Updates the public service allow-list to match the actual profile/* service routes used by the website and present in server/services/profile/**, preventing registration and avatar fetching from being denied in production.

Changes:

• Replace non-existent people/* allow-list entries with the real profile/avatar/get, profile/post, and profile/options routes in the public allow-list.

File summaries

File	Description
server/core/_service_config.js	Fixes public allow-list route strings to align with existing profile/* services used for registration and avatar retrieval.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.