From d3aec0da0bb893784f0628c6b76ab1c2b8482457 Mon Sep 17 00:00:00 2001
From: zouantchaw <44246692+zouantchaw@users.noreply.github.com>
Date: Tue, 24 Feb 2026 09:09:08 -0500
Subject: [PATCH] chore(backend): make dev deploy frontend-callable

---
 CHANGELOG.md         | 1 +
 makefiles/backend.mk | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8a953d7..82bec66f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,3 +10,4 @@
 | 2026-02-24 | 0.1.5 | Added backend makefile module and CI workflow for backend target validation. |
 | 2026-02-24 | 0.1.6 | Added Cloud SQL-backed idempotency storage, migration script, and command API test coverage. |
 | 2026-02-24 | 0.1.7 | Added `/health` endpoints and switched smoke checks to `/health` for Cloud Run compatibility. |
+| 2026-02-24 | 0.1.8 | Enabled dev frontend reachability and made deploy auth mode environment-aware (`dev` public, `staging` private). |
diff --git a/makefiles/backend.mk b/makefiles/backend.mk
index 356bbee3..6706b224 100644
--- a/makefiles/backend.mk
+++ b/makefiles/backend.mk
@@ -20,9 +20,11 @@ BACKEND_STAGING_PRIVATE_BUCKET ?= krow-workforce-staging-private
 ifeq ($(ENV),staging)
 	BACKEND_PUBLIC_BUCKET := $(BACKEND_STAGING_PUBLIC_BUCKET)
 	BACKEND_PRIVATE_BUCKET := $(BACKEND_STAGING_PRIVATE_BUCKET)
+	BACKEND_RUN_AUTH_FLAG := --no-allow-unauthenticated
 else
 	BACKEND_PUBLIC_BUCKET := $(BACKEND_DEV_PUBLIC_BUCKET)
 	BACKEND_PRIVATE_BUCKET := $(BACKEND_DEV_PRIVATE_BUCKET)
+	BACKEND_RUN_AUTH_FLAG := --allow-unauthenticated
 endif
 
 BACKEND_CORE_IMAGE ?= $(BACKEND_REGION)-docker.pkg.dev/$(GCP_PROJECT_ID)/$(BACKEND_ARTIFACT_REPO)/core-api:latest
@@ -111,7 +113,7 @@ backend-deploy-core:
 		--project=$(GCP_PROJECT_ID) \
 		--service-account=$(BACKEND_RUNTIME_SA_EMAIL) \
 		--set-env-vars=APP_ENV=$(ENV),GCP_PROJECT_ID=$(GCP_PROJECT_ID),PUBLIC_BUCKET=$(BACKEND_PUBLIC_BUCKET),PRIVATE_BUCKET=$(BACKEND_PRIVATE_BUCKET) \
-		--no-allow-unauthenticated
+		$(BACKEND_RUN_AUTH_FLAG)
 	@echo "✅ Core backend service deployed."
 
 backend-deploy-commands:
@@ -125,7 +127,7 @@ backend-deploy-commands:
 		--project=$(GCP_PROJECT_ID) \
 		--service-account=$(BACKEND_RUNTIME_SA_EMAIL) \
 		--set-env-vars=APP_ENV=$(ENV),GCP_PROJECT_ID=$(GCP_PROJECT_ID),PUBLIC_BUCKET=$(BACKEND_PUBLIC_BUCKET),PRIVATE_BUCKET=$(BACKEND_PRIVATE_BUCKET) \
-		--no-allow-unauthenticated
+		$(BACKEND_RUN_AUTH_FLAG)
 	@echo "✅ Command backend service deployed."
 
 backend-deploy-workers: