Lock the site down to authenticated users only

All the ledger data is confidential (real client names, amounts,
associate balances) -- revoke 'access content' from the anonymous
role so nodes, taxonomy terms, and JSON:API all deny anonymous reads
(verified: JSON:API returns an empty data[] + "omitted" notice instead
of the records, /lignes and /dashboard 403).

Set the site's 403 page to /user/login: anonymous visitors hitting "/"
(the front page is /lignes) land on the login form instead of an
access-denied page; authenticated users still land on /lignes as
before since they still hold 'access content' via the authenticated
role.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
2026-09-04 10:57:18 +02:00
co-authored by Claude Sonnet 5
parent 8c63c19619
commit f8ae2d6a9e
2 changed files with 1 additions and 3 deletions
+1 -1
View File
@@ -6,7 +6,7 @@ name: 'Figures Libres - Compta'
mail: admin@example.com
slogan: ''
page:
403: ''
403: /user/login
404: ''
front: /lignes
admin_compact_mode: false
-2
View File
@@ -6,7 +6,6 @@ dependencies:
- filter.format.restricted_html
module:
- filter
- system
_core:
default_config_hash: Tus1ZTNXKIOnrennR1hnTbc7wUPBXHTUm5UdCpEhJSk
id: anonymous
@@ -14,5 +13,4 @@ label: 'Anonymous user'
weight: 0
is_admin: false
permissions:
- 'access content'
- 'use text format restricted_html'