30 lines
1.5 KiB
Markdown
30 lines
1.5 KiB
Markdown
# ADR-005: Public Read-Only H5 Dashboard
|
|
|
|
## Status
|
|
|
|
Accepted — 2026-08-03
|
|
|
|
## Context
|
|
|
|
ARR Web login protects Finance operations, but the mobile H5 dashboard is a read-only aggregate view intended for
|
|
broader viewing. Making only the HTML page public would leave its data requests behind the login gate. Making generic
|
|
desktop APIs public would widen access to jobs, traces, operational health, filenames and other operator data.
|
|
|
|
## Decision
|
|
|
|
1. Publish the H5 page/assets anonymously.
|
|
2. Add purpose-built anonymous `GET /api/public/h5/months` and `GET /api/public/h5/analytics` routes.
|
|
3. Return only aggregate dashboard data and month/date coverage from those routes; omit source hashes, filenames,
|
|
traces, detailed health, source coordinates, guest/detail rows and operational metadata.
|
|
4. Keep desktop pages, generic and legacy APIs, jobs/traces, downloads, uploads, Booking/company/report operations and
|
|
mutations behind the existing server-side session/CSRF boundary.
|
|
5. Keep `/healthz` as the only public readiness signal; public JSON responses remain `no-store`.
|
|
|
|
## Consequences
|
|
|
|
- Anyone with the H5 URL can view the aggregate channel/room dashboard and all month options returned by the public H5
|
|
month index.
|
|
- Finance/operator workflows remain authenticated and the public H5 surface has no write capability.
|
|
- Deployment must treat the aggregate metrics, channel names and financial totals as intentionally public data and should
|
|
apply normal HTTPS, access logging and rate/abuse controls at the edge.
|