docs(website): record PR 5 — public, player and auth capability split #60

wtclaude · 2026-07-28T01:55:01Z

wtclaude commented

2026-07-28 01:55:01 +00:00

What & why

Documentation for RunicGateway/website#106 (PR 5 of § Phase 2). The domain split is complete.

website/API_V2_PLAN.md

New "PR 5 — as landed" section: the route table for all three groups, the four zero-diff gates, and the findings worth carrying forward.
Status line and sequencing list updated — PR 5 ✅, and the only remaining item in the plan is the CSP enforce PR, which is blocked on soak data rather than on code.

website/BACKEND_DESIGN.md

§2 folder structure: the auth.routes.js / public.routes.js placeholders are replaced with the full per-capability tree for auth/, public/ and player/, matching the admin/ block already there. The in-progress banner becomes a completion note.
§4: the /auth and /public group headings now point at their index.js files, each with a short note on why the group carries no gate. The /player prose names the three routers behind the shared noindex, requireAuth gate.

Findings recorded here rather than left in the code alone:

public/ and auth/ deliberately have no group gate. The obvious "hardening" edit to either one is an outage — logged-out SPA, Discord bot and the Android ShardStreamClient all read /public/* anonymously, and /auth is where a caller becomes authenticated.
GET /auth/me depends on session.router.js being mounted last, because use('/me', meRouter) matches the bare /me and is what supplies its noindex header. Neither manifest can see that.
Two root-mounted routers (public/site, auth/session) on the PR 4 dashboard.router.js precedent, safe only because neither declares router-level middleware.
loginGuards is the PR's shared module, the counterpart to PR 3's imageUpload.js.
Filename deviations from the target tree (posts not news, session.router.js added) and why public.controller.js was not split.

api-route-inventory.json needed no change — it was already byte-identical to the regenerated server/routes.manifest.json (200 public + 2 internal). PROJECT_TREE.md is left alone: since website#98 it is auto-generated by the sync-project-tree workflow.

How it was tested

Markdown-only. Verified against the merged website branch: every router filename, route count and prefix in the new §2 tree matches the built Express stack, and the 24 / 20 / 10 route counts match the manifest.

Checklist

I have read CONTRIBUTING.md.
The change builds and existing tests/checks pass locally.
I have added or updated tests/docs where it makes sense.
My commits are reasonably scoped with clear messages.

AI-assisted contributions (required)

No AI tools were used to produce this contribution.
AI tools were used. Tool(s): Claude Code (Opus 5). I have reviewed and understand
every change, and take responsibility for it. AI-authored commits are
marked with a Co-Authored-By / Assisted-By trailer.

License

I agree that my contribution is licensed under this project's license
(GNU GPL v3.0 or later), and I have the right to contribute it.

## What & why Documentation for RunicGateway/website#106 (PR 5 of § Phase 2). **The domain split is complete.** **`website/API_V2_PLAN.md`** - New **"PR 5 — as landed"** section: the route table for all three groups, the four zero-diff gates, and the findings worth carrying forward. - Status line and sequencing list updated — PR 5 ✅, and the only remaining item in the plan is the CSP enforce PR, which is blocked on soak data rather than on code. **`website/BACKEND_DESIGN.md`** - §2 folder structure: the `auth.routes.js` / `public.routes.js` placeholders are replaced with the full per-capability tree for `auth/`, `public/` and `player/`, matching the `admin/` block already there. The in-progress banner becomes a completion note. - §4: the `/auth` and `/public` group headings now point at their `index.js` files, each with a short note on why the group carries no gate. The `/player` prose names the three routers behind the shared `noindex, requireAuth` gate. Findings recorded here rather than left in the code alone: - **`public/` and `auth/` deliberately have no group gate.** The obvious "hardening" edit to either one is an outage — logged-out SPA, Discord bot and the Android `ShardStreamClient` all read `/public/*` anonymously, and `/auth` is where a caller *becomes* authenticated. - **`GET /auth/me` depends on `session.router.js` being mounted last**, because `use('/me', meRouter)` matches the bare `/me` and is what supplies its `noindex` header. Neither manifest can see that. - **Two root-mounted routers** (`public/site`, `auth/session`) on the PR 4 `dashboard.router.js` precedent, safe only because neither declares router-level middleware. - **`loginGuards`** is the PR's shared module, the counterpart to PR 3's `imageUpload.js`. - Filename deviations from the target tree (`posts` not `news`, `session.router.js` added) and why `public.controller.js` was not split. `api-route-inventory.json` needed no change — it was already byte-identical to the regenerated `server/routes.manifest.json` (200 public + 2 internal). `PROJECT_TREE.md` is left alone: since website#98 it is auto-generated by the `sync-project-tree` workflow. ## How it was tested Markdown-only. Verified against the merged website branch: every router filename, route count and prefix in the new §2 tree matches the built Express stack, and the 24 / 20 / 10 route counts match the manifest. ## Checklist - [x] I have read [CONTRIBUTING.md](CONTRIBUTING.md). - [x] The change builds and existing tests/checks pass locally. - [x] I have added or updated tests/docs where it makes sense. - [x] My commits are reasonably scoped with clear messages. ## AI-assisted contributions (required) - [ ] No AI tools were used to produce this contribution. - [x] AI tools were used. Tool(s): `Claude Code (Opus 5)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a `Co-Authored-By` / `Assisted-By` trailer. ## License - [x] I agree that my contribution is licensed under this project's license (**GNU GPL v3.0 or later**), and I have the right to contribute it.

wtclaude added 1 commit 2026-07-28 01:55:03 +00:00

docs(website): record PR 5 — public, player and auth capability split 257ed2166c

The domain split is complete. API_V2_PLAN.md gains a "PR 5 — as landed"
section (route table, the four zero-diff gates, and the findings worth
carrying forward) and its status line and sequencing list are updated: only
the CSP enforce PR remains, blocked on soak data rather than on code.

BACKEND_DESIGN.md §2 replaces the auth.routes.js / public.routes.js entries
with the full per-capability tree for auth/, public/ and player/, and §4's
group headings now point at the index.js files. The /player prose names the
three routers behind the shared gate.

Findings recorded rather than left in the code alone:

- public/ and auth/ deliberately have no group gate — the obvious hardening
  edit to either is an outage.
- GET /auth/me depends on session.router.js being mounted last, because
  use('/me', meRouter) matches the bare /me and supplies its noindex header.
- Two root-mounted routers (public/site, auth/session) on the PR 4 dashboard
  precedent, safe only because neither declares router-level middleware.
- loginGuards is the PR's shared module, the counterpart to PR 3's
  imageUpload.js.
- Filename deviations from the target tree (posts not news, session.router.js
  added) and why public.controller.js was not split.

Co-Authored-By: Claude <noreply@anthropic.com>

wtclaude referenced this pull request from RunicGateway/website

2026-07-28 01:55:20 +00:00

refactor(server): split public, player and residual auth into capability routers (PR 5) #106

whitlocktech approved these changes 2026-07-28 01:56:18 +00:00

whitlocktech merged commit 9f3f014f34 into main

2026-07-28 01:56:24 +00:00

whitlocktech referenced this issue from a commit

2026-07-28 01:56:25 +00:00

Merge pull request 'docs(website): record PR 5 — public, player and auth capability split' (#60) from docs/router-split-5 into main

whitlocktech deleted branch docs/router-split-5

2026-07-28 01:56:25 +00:00

Sign in to join this conversation.