Allow public leaderboard API reads

2026-10-05 16:46:44 -04:00
parent bd10c1c5d2
commit 083d29323f
5 changed files with 83 additions and 37 deletions
@@ -4,6 +4,12 @@ Electric Cherry requires a user session for operator pages and management APIs.
 HTTPS protects the connection; server-side role checks protect each operation.
 There is no anonymous management mode or public registration.

+Leaderboard API reads (`GET` and `HEAD /api/leaderboard`) are public and need no
+session or credentials. This exception covers only that exact API route;
+leaderboard/profile pages, match-history routes and management operations retain
+their access checks. HTTPS requirements still apply. See the
+[leaderboard API reference](leaderboard.md#read-api) for requests and response fields.
+
 ## First administrator and upgrades

 1. Generate a setup secret: `openssl rand -hex 32`.