Forte Session-Recovery Routes: Step 4 Implementation Summary

Stage 1 - Forte route classification

• Changes:

  • Added the approved Option C Forte-prefix classifier to the canonical application-route check.

  • Covered Forte descendants and both existing Forte API naming families.

• Verification:

  • Local HTTP smoke: an unauthenticated GET /forte/users/?page=2 returned 401 Reconnecting with data-auth-return-to="/forte/users/?page=2".

  • Local HTTP smoke: an unauthenticated GET /api/forte_activity_page?view=all returned the existing 403 Approval required response rather than a false 404.

• Notes:

  • As approved in Option C, invalid Forte descendants may now enter recovery before normal routing returns 404.

Stage 2 - Forte recovery regression coverage

• Changes:

  • Added expired-session coverage for Forte board, users, activity, profile, username, and every existing Forte API family.

  • Verified an authenticated Forte route still renders and an authenticated invalid Forte URL still returns normal 404.

• Verification:

  • php tests/run.php LocalAppSmokeTest::testPrivateForteRoutesRecoverExpiredSessionsInsteadOfReturningFalseNotFound LocalAppSmokeTest::testPrivateLobbyOnlyExposesLobbyAccountAndAuthenticationSurfaces PrivateSiteAuthTest AuthNavigationTest — passed (10 tests).

• Notes:

  • Forte APIs retain their existing explicit access-required response; the browser does not automatically replay those requests.