shiyuyun/wyndham-ARR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
727643f1f2acb3af62edc42a296753de0cf48eb3
wyndham-ARR/.project-docs/10-decisions/ADR-005-public-read-only-h5-dashboard.md

1.5 KiB
Raw Blame History

ADR-005: Public Read-Only H5 Dashboard

Status

Accepted — 2026-08-03

Context

ARR Web login protects Finance operations, but the mobile H5 dashboard is a read-only aggregate view intended for broader viewing. Making only the HTML page public would leave its data requests behind the login gate. Making generic desktop APIs public would widen access to jobs, traces, operational health, filenames and other operator data.

Decision

  1. Publish the H5 page/assets anonymously.
  2. Add purpose-built anonymous GET /api/public/h5/months and GET /api/public/h5/analytics routes.
  3. Return only aggregate dashboard data and month/date coverage from those routes; omit source hashes, filenames, traces, detailed health, source coordinates, guest/detail rows and operational metadata.
  4. Keep desktop pages, generic and legacy APIs, jobs/traces, downloads, uploads, Booking/company/report operations and mutations behind the existing server-side session/CSRF boundary.
  5. Keep /healthz as the only public readiness signal; public JSON responses remain no-store.

Consequences

  • Anyone with the H5 URL can view the aggregate channel/room dashboard and all month options returned by the public H5 month index.
  • Finance/operator workflows remain authenticated and the public H5 surface has no write capability.
  • Deployment must treat the aggregate metrics, channel names and financial totals as intentionally public data and should apply normal HTTPS, access logging and rate/abuse controls at the edge.