Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api_admin.py

@@ -50,6 +50,11 @@ class MuteBody(BaseModel):
     muted: bool
 
 
+class AllowlistAddBody(BaseModel):
+    email: str = Field(min_length=3, max_length=320)
+    note: str | None = Field(default=None, max_length=200)
+
+
 # ---------------------------------------------------------------------------
 # Router
 # ---------------------------------------------------------------------------
@@ -385,6 +390,103 @@ def make_router(config: Config) -> APIRouter:
             ]
         }
 
+    # ----- Private-beta allowlist (`migrations/011_allowlist.sql`) -----
+
+    @router.get("/api/admin/allowlist")
+    async def list_allowlist(request: Request) -> dict[str, Any]:
+        auth.require_admin(request)
+        rows = db.conn().execute(
+            """
+            SELECT a.email, a.note, a.created_at,
+                   u.gitea_login AS added_by_login,
+                   u.display_name AS added_by_display
+              FROM allowed_emails a
+         LEFT JOIN users u ON u.id = a.added_by_user_id
+             ORDER BY a.created_at DESC
+            """
+        ).fetchall()
+        return {
+            "active": len(rows) > 0,
+            "items": [
+                {
+                    "email": r["email"],
+                    "note": r["note"] or "",
+                    "added_by_login": r["added_by_login"],
+                    "added_by_display": r["added_by_display"],
+                    "created_at": r["created_at"],
+                }
+                for r in rows
+            ],
+        }
+
+    @router.post("/api/admin/allowlist")
+    async def add_allowlist(body: AllowlistAddBody, request: Request) -> dict[str, Any]:
+        viewer = auth.require_admin(request)
+        email = body.email.strip()
+        if "@" not in email or len(email.split("@")[-1]) < 2:
+            raise HTTPException(422, "Email looks malformed")
+        existing = db.conn().execute(
+            "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+        ).fetchone()
+        if existing is not None:
+            raise HTTPException(409, "Email already on the allowlist")
+        db.conn().execute(
+            """
+            INSERT INTO allowed_emails (email, added_by_user_id, note)
+            VALUES (?, ?, ?)
+            """,
+            (email, viewer.user_id, body.note),
+        )
+        # Audit trail: when the email already maps to a known user, emit a
+        # permission_events row so §6.5's log stays the single place to
+        # look for "who let this person in." For brand-new emails the
+        # allowed_emails row itself carries (added_by_user_id, created_at)
+        # which is sufficient until the user actually signs in.
+        subject = db.conn().execute(
+            "SELECT id FROM users WHERE email = ? COLLATE NOCASE LIMIT 1", (email,)
+        ).fetchone()
+        if subject is not None:
+            db.conn().execute(
+                """
+                INSERT INTO permission_events
+                    (actor_user_id, subject_user_id, event_kind, details)
+                VALUES (?, ?, 'allowlist_added', ?)
+                """,
+                (
+                    viewer.user_id,
+                    subject["id"],
+                    json.dumps({"email": email, "note": body.note or ""}),
+                ),
+            )
+        return {"ok": True, "email": email}
+
+    @router.delete("/api/admin/allowlist/{email}")
+    async def remove_allowlist(email: str, request: Request) -> dict[str, Any]:
+        viewer = auth.require_admin(request)
+        existing = db.conn().execute(
+            "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+        ).fetchone()
+        if existing is None:
+            raise HTTPException(404, "Email not on the allowlist")
+        db.conn().execute("DELETE FROM allowed_emails WHERE email = ?", (email,))
+        subject = db.conn().execute(
+            "SELECT id FROM users WHERE email = ? COLLATE NOCASE LIMIT 1", (email,)
+        ).fetchone()
+        if subject is not None:
+            db.conn().execute(
+                """
+                INSERT INTO permission_events
+                    (actor_user_id, subject_user_id, event_kind, details)
+                VALUES (?, ?, 'allowlist_removed', ?)
+                """,
+                (
+                    viewer.user_id,
+                    subject["id"],
+                    json.dumps({"email": email}),
+                ),
+            )
+        return {"ok": True, "email": email}
+
     return router
 
 

backend/app/auth.py

@@ -77,6 +77,43 @@ async def fetch_user_profile(config: Config, access_token: str) -> dict[str, Any
         return resp.json()
 
 
+def allowlist_is_active() -> bool:
+    """The private-beta gate is on iff the `allowed_emails` table has any
+    rows. Empty list means "open" — any successful OAuth provisions a
+    user; first row added flips the deployment into private-beta mode.
+    See `migrations/011_allowlist.sql` for the reasoning.
+    """
+    row = db.conn().execute("SELECT 1 FROM allowed_emails LIMIT 1").fetchone()
+    return row is not None
+
+
+def is_allowed_sign_in(profile: dict[str, Any]) -> bool:
+    """Decide whether a freshly-completed OAuth profile may sign in.
+
+    Three accept paths:
+      1. The allowlist is empty (gate off).
+      2. The Gitea profile's email is in `allowed_emails` (case-insensitive).
+      3. A `users` row already exists for this `gitea_id` — grandfather
+         per `migrations/011_allowlist.sql`.
+    """
+    gitea_id = profile.get("id")
+    if gitea_id is not None:
+        existing = db.conn().execute(
+            "SELECT 1 FROM users WHERE gitea_id = ? LIMIT 1", (gitea_id,)
+        ).fetchone()
+        if existing is not None:
+            return True
+    if not allowlist_is_active():
+        return True
+    email = (profile.get("email") or "").strip()
+    if not email:
+        return False
+    row = db.conn().execute(
+        "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+    ).fetchone()
+    return row is not None
+
+
 def provision_user(config: Config, profile: dict[str, Any]) -> SessionUser:
     """Insert or update the users row for this Gitea profile.
 

backend/app/main.py

@@ -107,6 +107,12 @@ def _oauth_router(config) -> APIRouter:
         if not access_token:
             raise HTTPException(400, "Token exchange failed")
         profile = await auth.fetch_user_profile(config, access_token)
+        if not auth.is_allowed_sign_in(profile):
+            # Private-beta gate: clear any partial OAuth state and bounce to
+            # the public /beta-pending page. The session is left empty so the
+            # rejected viewer continues as anonymous read-only.
+            request.session.pop(auth.SESSION_STATE_KEY, None)
+            return RedirectResponse("/beta-pending")
         user = auth.provision_user(config, profile)
         auth.store_session(request, user)
         return RedirectResponse("/")

backend/migrations/011_allowlist.sql

@@ -0,0 +1,22 @@
+-- Private-beta email allowlist.
+--
+-- The framework supports a deployment-gated sign-in mode: when this
+-- table contains rows, only emails listed here (case-insensitively)
+-- may sign in via OAuth. Users already provisioned in the `users`
+-- table are grandfathered in by gitea_id and never re-checked against
+-- this list — so the operator who allow-listed themselves, signed in
+-- once, then removed their own email from the list does not lose
+-- access.
+--
+-- An empty `allowed_emails` table is the "open" state: no allowlist
+-- gate runs, and any successful OAuth sign-in provisions a new user
+-- as before. This means a fresh framework install behaves exactly as
+-- prior versions until the operator adds the first row, at which
+-- point the gate turns on for everyone not yet in `users`.
+
+CREATE TABLE allowed_emails (
+    email            TEXT PRIMARY KEY COLLATE NOCASE,
+    added_by_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    note             TEXT,
+    created_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);