Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

POST /api/events/open is documented public+unauth but 401s anonymously

DoneOwner · met_f981e96d

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**POST /api/events/open is documented public+unauth but 401s anonymously** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## The brief on file

Found 2026-08-06 by the backend session while adding a sibling public endpoint. Needs a decision, not a silent fix — changing the auth posture of a live analytics ingest endpoint is not something to do mid-task.

THE CONTRADICTION
  apps/api/tactile-api/src/routes/events.ts:4 documents the endpoint as:
      POST /api/events/open — logs a trigger scan (public, unauth).
  and its module header says it is "an ADDITIONAL ingestion point that the
  landing-page interstitial JS calls FROM THE BROWSER".

  But the path is not in `applyRateLimit`'s skip list
  (apps/api/tactile-api/src/middleware/rate-limit.ts). That limiter skips
  GET/HEAD/OPTIONS, then for every other verb calls `requireSession` to key its
  quota — so a POST with no Bearer token is rejected before the route runs.

VERIFIED LIVE, not inferred:
  $ curl -X POST https://staging-api.tactile.to/api/events/open \
      -H 'Content-Type: application/json' \
      -d '{"destinationHash":"ZZZZZZZZZ","method":"qr"}'
  401 {"error":"Missing Bearer token."}

WHY IT MAY NOT HAVE HURT YET: grepping the whole tree for "events/open" finds
NO caller — not in apps/web, apps/web-mobile, apps/ios or apps/android. The
free-tier scan path goes through the `log_open_event` RPC called from
routes/nfc.ts / routes/qr.ts instead, per the module header. So this endpoint
may simply be unused, and its docstring aspirational.

WHY IT STILL MATTERS
  - If anything ever does call it from a browser, it silently records nothing
    and the caller sees a 401 it cannot fix by any means available to it.
  - This is the SAME bug class already fixed three times in that skip list, each
    time after it bit: the Stripe webhook, anonymous form submissions
    (/api/form/:hash/submit), abuse reports, and the container→worker video
    callbacks. The comments in rate-limit.ts record each one. This is the fourth
    instance, not yet caught.
  - A "link"-method open (t_258a2a7c) would naturally be reported by the web
    viewer through exactly this endpoint.

THE DECISION
  (a) It is genuinely public — add `path === "/api/events/open"` to the skip
      list and give it its own per-IP window, exactly as
      `/api/events/destination` now does (see commit f7e26746 for the pattern:
      bounded input, server-side owner resolution, per-IP limiter, and a
      response that is not an enumeration oracle). Note this endpoint currently
      404s on an unknown destination, which IS an oracle — fix that in the same
      change.
  (b) It is not public — correct the docstring, and decide what the
      "landing-page interstitial JS" it describes is supposed to call instead.
  (c) It is dead — delete it, as /api/upload was.

Do not pick silently. Whichever way it goes, the docstring and the code must
end up agreeing, because right now a reader of either one is misled.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

POST /api/events/open is documented public+unauth but 401s anonymously