Forte Session-Recovery Routes: Step 2 Feature Description

Problem

Valid Forte URLs can be classified as nonexistent when the member session is absent, preventing the existing reauthentication-recovery experience. After another page restores authentication, the same Forte URL works normally.

User stories

• As an approved member, I want a dormant Forte link to recover my session so that I can continue where I intended without seeing a false missing-route page.

• As a Forte user, I want board, directory, activity, profile, and username links to behave consistently so that authentication state does not change navigation results.

• As a site operator, I want Forte API requests to receive an authorization outcome rather than a false 404 so that clients can recover predictably.

Core requirements

• Treat every /forte path and Forte API path as an application route during members-only access checks.

• Route expired-session Forte HTML navigation through the existing authentication-resume experience with its original path and query retained.

• Give expired-session Forte API requests the existing explicit authorization outcome; do not replay them automatically.

• Preserve normal authenticated Forte routing and normal post-authentication 404 behavior for genuinely invalid URLs.

• Do not alter Forte content, approval policy, or browser-key authentication.

Shared component inventory

• Members-only route gate (Application application-route classification): extend the canonical classifier with the approved Forte-prefix rule.

• Authentication-resume page and private-site auth: reuse unchanged for Forte HTML GET recovery.

• Forte HTML handlers (board, users, activity, profiles, usernames): reuse unchanged once the gate recognizes their URL space.

• Forte JSON APIs (activity pagination, commit detail, content summary): reuse unchanged; extend only their access classification so they retain the canonical API authorization response.

User flow

1. A member opens a Forte URL after their server session is unavailable.

2. The access gate recognizes it as a Forte application route.

3. A safe Forte HTML request uses existing reauthentication recovery and returns to the same URL.

4. A Forte API request reports its normal authorization outcome for the caller to handle.

5. Once authenticated, a valid URL renders normally; an invalid URL remains a normal 404.

Success criteria

• Expired-session Forte board, directory, activity, profile, and username URLs no longer show the false missing-route page.

• Their original path and query are retained through recovery.

• Forte API calls no longer return false 404s solely because the session is absent.

• Authenticated valid and invalid Forte URLs retain their current outcomes.