Page Protection Audit

Login coverage for every page reachable from the home menu & widgets. Each URL was fetched anonymously (no session) against the live site — a page is Open if it returns full content to a signed-out visitor.

Snapshot: 7/6/26 · 110 nav routes tested · gate armed

Login gate is armed — all app pages now require a session.

As of 7/6/26 the site gate is live in pure-auth.js and pure-appshell.js (dual-layer, so any page loading either is covered): any page that isn't on the public allow-list redirects a signed-out visitor to sign-in.html?next=…. 104 menu pages are protected here, plus every other shell page site-wide (e.g. pure-avm, pure-myday, the social studios). The only open routes are the intended public ones (the root directory) plus 5 retired stubs. Public allow-list: index, sign-in, landing, onboarding, auth, pure-authenticator, 404, and the auth plumbing (callback, reset, forgot, confirm, invite).

Reminder: this is a UX gate (client-side) — it hides pages and is right for now, but the durable boundary is server-side RLS + MFA at the auth window. A client gate can be bypassed; pair it with RLS for real protection.

104Login-protected

—Open (public)

—Parked stubs

—Total routes

Every nav route

Sorted open-first. “Parked stub” = a retired page that redirects elsewhere (Boneyard), not a login gate. “Loads auth” shows whether the page even includes pure-auth.js — informational only, since the gate is disabled.

Page	Route	Status	Loads auth

What “protected” would require

To actually gate these pages behind login, one of the following must be turned back on — ideally in the global layer so it applies everywhere at once:

Re-arm pure-gate.js (or PureAuth.require()) site-wide: redirect signed-out visitors to sign-in.html?next=… on load. Fastest; reversible. Keep auth pages (sign-in, reset, callback) self-skipping.
Server-side RLS + AAL2 (the auth-window plan): the durable boundary — data is denied without a valid JWT even if the HTML loads. Page gate + RLS together is the correct end state.
Per-page allow-list for genuinely public pages (landing, onboarding, sign-in) so only those stay open when the gate is re-armed.

This report is a live tool: it re-tests the current site each time you open it, so it stays accurate as protection is added.

Page Protection Audit · live anonymous fetch of nav routes · PURE merged workspace