# ADR-005: Public Read-Only H5 Dashboard

## Status

Accepted — 2026-08-03

## Context

ARR Web login protects Finance operations, but the mobile H5 dashboard is a read-only aggregate view intended for
broader viewing. Making only the HTML page public would leave its data requests behind the login gate. Making generic
desktop APIs public would widen access to jobs, traces, operational health, filenames and other operator data.

## Decision

1. Publish the H5 page/assets anonymously.
2. Add purpose-built anonymous `GET /api/public/h5/months` and `GET /api/public/h5/analytics` routes.
3. Return only aggregate dashboard data and month/date coverage from those routes; omit source hashes, filenames,
   traces, detailed health, source coordinates, guest/detail rows and operational metadata.
4. Keep desktop pages, generic and legacy APIs, jobs/traces, downloads, uploads, Booking/company/report operations and
   mutations behind the existing server-side session/CSRF boundary.
5. Keep `/healthz` as the only public readiness signal; public JSON responses remain `no-store`.

## Consequences

- Anyone with the H5 URL can view the aggregate channel/room dashboard and all month options returned by the public H5
  month index.
- Finance/operator workflows remain authenticated and the public H5 surface has no write capability.
- Deployment must treat the aggregate metrics, channel names and financial totals as intentionally public data and should
  apply normal HTTPS, access logging and rate/abuse controls at the edge.