zenmemes

New post

Chouse Approved-Members-Only Access — Step 4: Implementation Summary

Stage 1 - Register access feature flag

  • Changes:

    • Registered FORUM_APPROVED_MEMBERS_ONLY with a safe default of false.

    • Enabled the existing environment/site-record precedence and feature-flag listing for the new flag.

    • Added default, environment-override, and registry-list coverage.

  • Verification:

    • php tests/run.php FeatureFlagEvaluatorTest — all tests passed.

  • Notes:

    • Route behavior is not changed yet; later stages consume this flag.

Stage 2 - Authenticate browser identity

  • Changes:

    • Added a short-lived server challenge endpoint and detached OpenPGP signature verification endpoint.

    • Added browser-side authentication using the existing local browser keypair.

    • Added the authentication endpoints to the API index.

  • Verification:

    • php -l src/ForumRewrite/Application.php — passed.

    • node --check public/assets/private_site_auth.js — passed.

    • Existing OpenPGP signature tests — passed.

  • Notes:

    • The access gate is not enabled yet; Stage 3 will consume the authenticated session and enforce the lobby allowlist.

Stage 3 - Enforce lobby allowlist

  • Changes:

    • Added the shared FORUM_APPROVED_MEMBERS_ONLY access decision.

    • Added the /lobby/ page.

    • Allowed lobby users only Lobby, Account, and their authenticated own profile; protected other dynamic routes return 404.

    • Approved users retain the existing full-site route access.

  • Verification:

    • PHP/template lint passed.

    • Flagged direct thread request returned 404.

    • Flagged Lobby request rendered successfully.

    • php tests/run.php FeatureFlagEvaluatorTest — all tests passed.

  • Notes:

    • Static artifact serving is addressed in Stage 4.

Stage 4 - Close static and Apache bypasses

  • Changes:

    • Disabled application static-artifact reads/builds while the private-site flag is enabled.

    • Added root/board redirection to the Lobby for unidentified visitors; direct protected content remains 404.

    • Added Apache rewrite protection for private instances while preserving direct asset delivery.

    • Documented FORUM_APPROVED_MEMBERS_ONLY in the production runbook, Apache vhost example, environment example, and README.

  • Verification:

    • Flagged direct thread request returned 404 and root request redirected to /lobby/.

    • PHP lint passed.

    • Full suite attempted; existing repository baseline has unrelated failures in legacy smoke/write cases and requires separate cleanup.

  • Notes:

    • Production must set the flag in Apache and ensure generated HTML is not directly exposed outside the protected rewrite path.

    • Follow-up hardening prevents the Account page from using an identity-hint cookie as the own-profile source while the private flag is enabled.

    • Existing unrelated worktree changes remain untouched.