refactor(server)!: remove legacy URL redirect subsystem (Phase-3 cutover done)

The /p/, /__zp/, /sw.js -> /zp/ compatibility redirects existed only to keep
pre-cutover URLs working during the Phase-3 migration (PHASE3_PLAN.md:66 --
"may exist during migration only to redirect... not accepted steady-state
surfaces"). No instance was deployed under the old scheme (confirmed by the
operator), and no live code generates those spellings: the SW registers
/zp/sw.js and shareurl emits /zp/p/. The redirects served no real consumers.

Removed the 3 route entries, the redirectLegacyPage/redirectLegacySW/
redirectLegacy/legacyZP handlers, and the legacyControlRedirects/
legacyAssetNames allowlists. Legacy paths now fail closed (POLICY_BLOCKED 403)
through the existing handle() default-deny -- a STRONGER posture than the prior
redirect, with the security boundary fully preserved. routing_test now pins the
new contract (legacy paths denied, not redirected). Build + go test ./... +
golangci native+wasm all clean; no orphaned symbols, imports, or generators.

BREAKING CHANGE: /p/*, /__zp/*, and root /sw.js now return 403 instead of a
307 redirect to the canonical /zp/ path.

Op: compress

Author: metaphorics

cmd/zeroproxy-server/main.go

@@ -93,9 +93,6 @@ var routes = []route{
 	{pat: controlPrefix + "error/", prefix: true, handler: serveControlError},
 	{pat: assetPrefix, prefix: true, handler: serveAssetRoute},
 	{pat: controlPrefix + "worker-bootstrap.js", handler: (*server).workerBootstrap},
-	{pat: "/p/", prefix: true, handler: redirectLegacyPage},
-	{pat: "/__zp/", prefix: true, handler: (*server).legacyZP},
-	{pat: "/sw.js", handler: redirectLegacySW},
 }
 
 func (s *server) handle(w http.ResponseWriter, r *http.Request) {
@@ -129,56 +126,6 @@ func serveAssetRoute(s *server, w http.ResponseWriter, r *http.Request) {
 	s.serveAsset(w, r, strings.TrimPrefix(r.URL.Path, assetPrefix))
 }
 
-func redirectLegacyPage(_ *server, w http.ResponseWriter, r *http.Request) {
-	redirectLegacy(w, r, controlPrefix+"p/"+strings.TrimPrefix(r.URL.Path, "/p/"))
-}
-
-func redirectLegacySW(_ *server, w http.ResponseWriter, r *http.Request) {
-	redirectLegacy(w, r, controlPrefix+"sw.js")
-}
-
-func redirectLegacy(w http.ResponseWriter, r *http.Request, nextPath string) {
-	u := *r.URL
-	u.Path = nextPath
-	http.Redirect(w, r, u.String(), http.StatusTemporaryRedirect)
-}
-
-// legacyControlRedirects maps legacy /__zp/ control paths to their canonical
-// /zp/ targets.
-var legacyControlRedirects = map[string]string{
-	"/__zp/ws-pipe":             controlPrefix + "ws-pipe",
-	"/__zp/kernel.wasm":         controlPrefix + "kernel.wasm",
-	"/__zp/worker-bootstrap.js": controlPrefix + "worker-bootstrap.js",
-}
-
-// legacyAssetNames is the allowlist of legacy /__zp/<name> asset paths that map
-// to the canonical /zp/assets/ prefix. Anything else is default-denied.
-var legacyAssetNames = map[string]struct{}{
-	"zp-core.js":         {},
-	"runtime-prelude.js": {},
-	"rust-rewriter.js":   {},
-	"wasm_exec.js":       {},
-	"worker-prelude.js":  {},
-}
-
-func (s *server) legacyZP(w http.ResponseWriter, r *http.Request) {
-	path := r.URL.Path
-	if next, ok := legacyControlRedirects[path]; ok {
-		redirectLegacy(w, r, next)
-		return
-	}
-	if strings.HasPrefix(path, "/__zp/error/") {
-		redirectLegacy(w, r, controlPrefix+"error/"+strings.TrimPrefix(path, "/__zp/error/"))
-		return
-	}
-	name := strings.TrimPrefix(path, "/__zp/")
-	if _, ok := legacyAssetNames[name]; ok {
-		redirectLegacy(w, r, assetPrefix+name)
-		return
-	}
-	s.safeError(w, r, "POLICY_BLOCKED", http.StatusForbidden)
-}
-
 func (s *server) serveWeb(w http.ResponseWriter, r *http.Request, name string) {
 	s.serveFile(w, r, filepath.Join(s.webDir, name), mime.TypeByExtension(filepath.Ext(name)))
 }

cmd/zeroproxy-server/routing_test.go

@@ -22,11 +22,13 @@ var routeCases = []routeCase{
 	// Redirects to the canonical control prefix.
 	{"root redirects to control", "/", http.StatusFound, controlPrefix, ""},
 	{"index.html redirects to control", "/index.html", http.StatusFound, controlPrefix, ""},
-	{"legacy sw redirects", "/sw.js", http.StatusTemporaryRedirect, controlPrefix + "sw.js", ""},
-	{"legacy page redirects", "/p/abc", http.StatusTemporaryRedirect, controlPrefix + "p/abc", ""},
-	{"legacy zp ws-pipe redirects", "/__zp/ws-pipe", http.StatusTemporaryRedirect, controlPrefix + "ws-pipe", ""},
-	{"legacy zp asset redirects", "/__zp/zp-core.js", http.StatusTemporaryRedirect, assetPrefix + "zp-core.js", ""},
-	{"legacy zp error redirects", "/__zp/error/BAD_HMAC", http.StatusTemporaryRedirect, controlPrefix + "error/BAD_HMAC", ""},
+	// Legacy /p/, /__zp/, /sw.js spellings were removed at the Phase-3 cutover;
+	// they now fail closed (default-deny) instead of redirecting to controlPrefix.
+	{"legacy root sw is denied", "/sw.js", http.StatusForbidden, "", "POLICY_BLOCKED"},
+	{"legacy page path is denied", "/p/abc", http.StatusForbidden, "", "POLICY_BLOCKED"},
+	{"legacy zp control path is denied", "/__zp/ws-pipe", http.StatusForbidden, "", "POLICY_BLOCKED"},
+	{"legacy zp asset path is denied", "/__zp/zp-core.js", http.StatusForbidden, "", "POLICY_BLOCKED"},
+	{"legacy zp error path is denied", "/__zp/error/BAD_HMAC", http.StatusForbidden, "", "POLICY_BLOCKED"},
 
 	// Serve handlers fail closed (503) because the asset tree is absent, but
 	// the key point is they routed to a serve path rather than default-deny.