Root Cause

Two separate gaps:

1. Frontend: unconditionally calls /api/users/me on application load and redirects to /login on 403, with no anonymous browsing path.
2. Backend: /api/projects is protected by session authentication with no carve-out for unauthenticated access to PUBLIC projects.

Current Effective Semantics

PUBLIC visibility currently means "visible to all authenticated users" rather than "visible to everyone including anonymous." This is an incomplete implementation of the visibility contract.

Known Limitation for 1.10.0

Anonymous access to PUBLIC projects is out of scope for this release. The limitation is accepted and documented here.

Proposed Fix (backlog)

Frontend:

• On 403 from /api/users/me, do not redirect to login — instead render in anonymous mode showing only PUBLIC content
• Protect write actions and non-PUBLIC routes with login redirect

Backend:

• Permit unauthenticated GET /api/projects in SecurityConfig, returning only PUBLIC projects when no session is present
• Permit unauthenticated GET /api/projects/{id} for PUBLIC projects only

Affected Components

• Frontend app bootstrap / auth guard
• SessionAuthSecurityConfig (permitAll rules)
• ProjectController (anonymous project list)
• ProjectServiceImpl (anonymous project query)

Severity

Medium — PUBLIC visibility is partially implemented. Authenticated external users are also affected (separate defect logged). Anonymous access is a known gap.

Time Estimate

3–5 days (frontend anonymous mode + backend permitAll + testing)