bachirandClaude Sonnet 5 f8ae2d6a9e Lock the site down to authenticated users only
All the ledger data is confidential (real client names, amounts,
associate balances) -- revoke 'access content' from the anonymous
role so nodes, taxonomy terms, and JSON:API all deny anonymous reads
(verified: JSON:API returns an empty data[] + "omitted" notice instead
of the records, /lignes and /dashboard 403).

Set the site's 403 page to /user/login: anonymous visitors hitting "/"
(the front page is /lignes) land on the login form instead of an
access-denied page; authenticated users still land on /lignes as
before since they still hold 'access content' via the authenticated
role.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-04 10:57:18 +02:00
S
Description
No description provided
1.2 MiB
Languages
php 44.6%
JavaScript 32.8%
CSS 13.4%
Twig 9.2%