Invite Session Authentication: Step 4 Implementation Summary

Stage 1 - Resume existing public sessions

• Changes:

  • Resumed an already-present viewer session for safe public HTML application requests without starting a session for anonymous reads.

  • Passed the authenticated viewer into shared public page and template rendering so approved-session navigation includes Invite.

  • Cleared a rejected strict-mode session cookie instead of retaining a replacement anonymous session.

  • Added public-session and anonymous-session smoke coverage.

• Verification:

  • php -l src/ForumRewrite/Application.php

  • php -l tests/LocalAppSmokeTest.php

  • ./v3 test LocalAppSmokeTest::testApprovedPrivateSessionCanViewOwnProfileAndBoard LocalAppSmokeTest::testApprovedPublicSessionIsResumedForBoardAndInvite LocalAppSmokeTest::testAnonymousPublicBoardDoesNotStartViewerSession LocalAppSmokeTest::testPrivateViewerSessionCookiePersistsAcrossBrowserRestart

  • ./v3 test LocalAppSmokeTest passed the new and existing session tests; it retained five unrelated pre-existing activity/signature failures.

• Notes:

  • The CLI smoke test uses a clean child PHP process to model web-SAPI session-cookie initialization without test-runner output affecting PHP headers.

Stage 2 - Restore public authentication from a saved browser key

• Changes:

  • Added a shared public-page authentication-resume marker and reused the existing browser-key challenge/signature flow when no viewer session is present.

  • Loaded the existing key-authentication assets for public unauthenticated pages; browsers without a saved key make no authentication request or server session.

  • Restored the current page with history replacement after successful public authentication.

• Verification:

  • php -l src/ForumRewrite/Application.php

  • php -l src/ForumRewrite/View/TemplateRenderer.php

  • php -l tests/LocalAppSmokeTest.php

  • ./v3 test LocalAppSmokeTest::testApprovedPublicSessionIsResumedForBoardAndInvite LocalAppSmokeTest::testAnonymousPublicBoardDoesNotStartViewerSession PrivateSiteAuthTest

• Notes:

  • Existing Account and members-only resume behavior retains its prior authentication path; the public marker only changes automatic restoration after a missing session.

Stage 3 - Integrate Invite with restored authentication

• Changes:

  • Resumed an existing session for the intentional invitation-preparation request without automatically replaying any write.

  • Marked identity-hint profile resolution as unauthenticated and marked session-derived profiles as authenticated, so Account and Lobby no longer mistake a hint for a completed sign-in.

  • Extended the public-session smoke flow to prove that invitation preparation passes authentication before its normal validation/write checks.

• Verification:

  • php -l src/ForumRewrite/Application.php

  • php -l tests/LocalAppSmokeTest.php

  • ./v3 test LocalAppSmokeTest::testApprovedPublicSessionIsResumedForBoardAndInvite LocalAppSmokeTest::testAnonymousPublicBoardDoesNotStartViewerSession PrivateSiteAuthTest

• Notes:

  • Final invitation publication remains protected by its existing browser detached-signature and server verification checks.

Stage 4 - Verify the public-session boundary

• Changes:

  • Documented public session restoration, anonymous browsing, non-replay of writes, and invitation authorization in the production runbook.

• Verification:

  • ./v3 test completed with all invite-session, browser-authentication, and existing session coverage passing.

  • The suite retains unrelated failures in invitation styling and activity/signature expectations, including an existing fetchActivity() call-signature mismatch; none are in files changed by this feature.

  • git diff --check passes for the Stage 4 documentation files.

• Notes:

  • The feature has four stage-scoped commits following the planning-doc commit, as required by the FDP process.