pal-e-docs

Phase F14: Public Readiness — Auth Filtering + Privacy Enforcement

phase-pal-e-docs-f14-public-readiness Phase

active phase
Project
Goal: pal-e-docs and pal-e-app are safe for public internet traffic — anonymous visitors see only public content, private projects/notes/boards are invisible.
Owner: Dev agent
Repo: forgejo_admin/pal-e-docs + forgejo_admin/pal-e-app
Depends on: phase-pal-e-docs-private-notes (F6, completed)
Forgejo Issues: pal-e-docs #184 (API filtering) + pal-e-app #38 (frontend SSR fix)

Why

Phase F6 implemented is_public filtering on note endpoints and added X-PaleDocs-Token auth. Two gaps remained: (1) the frontend sent the admin token on ALL SSR requests regardless of Keycloak session state; (2) the /projects and /boards API endpoints had no is_public filtering.

Scope

See original scope above. Both issues addressed.

Deliverables

  • PR #185 (pal-e-docs) — is_public filtering on /projects and /boards endpoints using get_is_authenticated(). 7 endpoints updated, 22 new tests, 606 total passing. QA approved.
  • PR #39 (pal-e-app) — ApiFetchOptions.authenticated flag threaded through all 18 API functions and every +page.server.ts loader. Token only sent when Keycloak session active. Sign-in page replaced with "Contact Lucas for access" + admin login via ?admin=true. 11 new E2E tests. QA approved.
  • Data fixes — sop-secrets-management set to is_public=false. Private/Remember project page notes set to is_public=false. private-2026-03-16-chinese-room-devops journal set to is_public=false.
  • SOP audit — 5 infrastructure SOPs audited. 1 made private, 3 flagged for Tailscale URL redaction (deferred), 1 safe.
  • plan-pal-e-docs — parent plan
  • phase-pal-e-docs-private-notes — Phase F6, the foundation this builds on
  • phase-pal-e-docs-frontend-auth — Phase F5, Keycloak OIDC integration
  • phase-pal-e-docs-validation-hardening — Phase F10, prior auth hardening