Remove internal notification caller tokens

docs/auth-notifications.md

@@ -16,23 +16,21 @@ changes under a new revision rather than mutating deployed content.
 Configure `api.notifications` in the product YAML:
 
 - `address`: internal notifications gRPC address.
-- `token_env`: environment variable containing the configured caller's token
-  (at least 32 bytes); example `SXCHNGE_NOTIFICATIONS_TOKEN`.
-- `ca_file`: trusted PEM CA bundle; omit to use system roots.
+- `ca_file`: optional trusted PEM CA bundle for explicit TLS. Omit both TLS settings for plaintext.
 - `server_name`: optional TLS certificate hostname override, never a TLS bypass.
 - `activation_url`: absolute frontend `/verify-email` URL. HTTPS is required,
   except HTTP on localhost/127.0.0.1 for development. No user-supplied redirect is
   accepted. The token is appended as a query parameter.
 
-The caller token must map to the product caller in the notification service's
-configuration. Keep Mongo, notification caller, TLS and provider credentials out
+The private notifications endpoint uses the existing product storage namespace
+without caller authentication. Keep Mongo, TLS and provider credentials out
 of Git. JWT signing configuration must contain at least 32 bytes of private key
 material; HMAC-derived issuance keys depend on this key. Rotation changes replay
 keys and existing pending JWT validity. Omission of `api.notifications` preserves
 the bootstrap-only legacy routes; it does not enable signup or code completion.
-The example config enables the integration and therefore requires credentials.
+The example config enables the integration; configure Mongo, NATS and email credentials separately.
 
-The notification service must be reachable over TLS, with its Mongo/NATS/email
+The notification service must be reachable on the private network, with its Mongo/NATS/email
 provider configured. Product startup creates a lazy gRPC channel; dependency
 outages appear as HTTP 503 when attempting delivery. A successful Send means
 persisted queue acceptance, not inbox delivery or a provider receipt.

docs/implementation.md

@@ -766,3 +766,25 @@ Validation passed: image build, shell/migration tests, live infrastructure check
 `make up` intentionally fails for the still-missing API key. Verified sender must
 also be configured in runtime YAML before rebuilding and starting notifications.
 No backend source changed and no email was sent.
+
+### Task #42: remove internal notification caller authentication
+
+Removed BFF bearer metadata, token configuration/validation, and the notifications
+authentication interceptor. The private gRPC endpoint uses the existing `product`
+storage namespace, preserving notification receipts and idempotency without a
+database migration. NATS authentication and application/user authentication remain.
+
+Removed the caller secret from bootstrap, Vault Agent templates and policies.
+Bootstrap archives and retires both `caller` and
+`services/notifications/callers/bff`; live Vault no longer contains either path.
+Service policies deny both paths. The retirement regression fixture verifies
+repeatability and preservation of the NATS authentication secret.
+
+Validation: `make build`, `make test`, `make lint-backend`,
+`make test-dev-tooling`, `make test-dev-infra`, and `git diff --check`.
+Tests cover credential-free Send/Get, idempotent replay through the real service,
+and absence of outgoing bearer metadata over plaintext and optional TLS.
+`make up` applied the live migration and intentionally stopped at the missing
+Resend API key. No email was sent; full product deployment still awaits the API
+key and configured sender. Delivery continues on `dev-env-42` in
+[PR #43](https://git.sendico.io/tech/sxchnge/pulls/43).

docs/local-development.md

@@ -39,7 +39,6 @@ kv/
 ├── services/
 │   ├── bff/jwt                         # jwt
 │   └── notifications/
-│       ├── callers/bff                 # token; read by BFF and notifications
 │       └── email/resend                # api_key only
 └── infrastructure/
     ├── nats/auth                       # token; read by NATS and notifications
@@ -56,7 +55,7 @@ password is rotated immediately after initial configuration.
 
 There are no frontend certificates, notification certificates or generic `tls`
 entries in KV. Browser certificates belong to Caddy; internal gRPC is plaintext
-on the private Docker network and retains caller-token authentication.
+on the trusted private Docker network without caller authentication.
 
 ## Resend
 
@@ -114,7 +113,7 @@ Trust installation is not automated. A CLI check can use:
 curl --cacert .local/dev/ca.pem https://localhost:5126/api/v1/health
 ```
 
-BFF calls notifications over plaintext gRPC with its caller token. Mongo and NATS
+BFF calls notifications over plaintext gRPC without caller authentication. Mongo and NATS
 also stay within the private Compose network; no internal service publishes a host
 port. Only frontend and Vault bind host loopback ports. TLS remains optional in
 the reusable notification client/server for deployments that explicitly configure
@@ -143,7 +142,7 @@ still interrupt work. Repository consumers use `source.Source` operation scopes;
 
 ## Migration and persistence
 
-Bootstrap migrates the old flat `bff`, `caller`, `email` and `nats` paths into the
+Bootstrap migrates the old flat `bff`, `email` and `nats` paths into the
 hierarchy above, and moves `bootstrap/mongo` to `infrastructure/mongo/bootstrap`.
 It copies with CAS protection, compares values, and refuses to
 overwrite conflicting destinations. After consumers use the new paths, it removes
@@ -178,3 +177,6 @@ and requires three replacements with unchanged BFF PID and zero unexpected
 transaction-backed HTTP responses. It restores TTLs and removes services it
 started. No verification command sends email. Backend validation remains
 `make test` and `make lint-backend`, using the host SDKs documented in module guides.
+
+Bootstrap archives and removes obsolete `caller` and `services/notifications/callers/bff`
+KV entries after updating Agent policies/templates. NATS authentication remains enabled.