Phase F6: Private Notes Enforcement

phase-pal-e-docs-private-notes Phase

Project

Phase F6: Private Notes Enforcement

Status: COMPLETED

Priority: HIGHEST — security gap (now closed)

Backend (pal-e-docs) — PR #179 MERGED

Issue #178 closed
New file: src/pal_e_docs/auth.py — reusable get_is_authenticated() FastAPI dependency
Filtering on: list_notes, get_note, search_notes, semantic_search, all sub-resource endpoints (toc, blocks, revisions, compiled, links)
Write protection: PUT and DELETE require auth when API key configured
is_public added to NoteSearchResult and SemanticSearchResult schemas
30 new tests (554 total passing)

Frontend (pal-e-app) — PR #29 MERGED

Issue #26 closed
X-PaleDocs-Token header in apiFetch() via PAL_E_DOCS_API_KEY env var
Private toggle in QuickJot modal (sets is_public=false)
Lock icon on private notes in note lists and search results
is_public forwarded through note creation proxy
k8s/deployment.yaml updated with PAL_E_DOCS_API_KEY secret ref

Deployment Note

PAL_E_DOCS_API_KEY env var must be set on both pal-e-docs and pal-e-app. SOPS secret k8s/pal-e-auth-secrets.enc.yaml needs the actual key value added.