Lock the site down to authenticated users only

All the ledger data is confidential (real client names, amounts,
associate balances) -- revoke 'access content' from the anonymous
role so nodes, taxonomy terms, and JSON:API all deny anonymous reads
(verified: JSON:API returns an empty data[] + "omitted" notice instead
of the records, /lignes and /dashboard 403).

Set the site's 403 page to /user/login: anonymous visitors hitting "/"
(the front page is /lignes) land on the login form instead of an
access-denied page; authenticated users still land on /lignes as
before since they still hold 'access content' via the authenticated
role.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

bachir

2026-09-04 10:57:18 +02:00

co-authored by

Claude Sonnet 5

parent 8c63c19619

commit f8ae2d6a9e

2 changed files with 1 additions and 3 deletions

									
										config/sync/system.site.yml
									
		+1
		-1
	
												View File
												
				@@ -6,7 +6,7 @@ name: 'Figures Libres - Compta'

				mail: admin@example.com

				slogan: ''

				page:

				  403: ''

				  403: /user/login

				  404: ''

				  front: /lignes

				admin_compact_mode: false