[huyplb]

What this adds

A public demo needs one shared login that anyone can use, safely.

• The Demo role. It browses and compares schemas, reads history and access reports, and runs SELECTs.
  • The server lets a demo account write only through routes that read. This is an allow-list in the auth guard, checked against every guarded write route by demo-account.test.ts.
  • A demo account is a viewer in every workspace, whatever role it was given.
  • Visitors cannot reset the shared password, sign the others out, or send verification mail to its address.
• Demo mode (Access control → Sign-in). It shows a banner on every page and the admin's sign-in hint on the sign-in page. It is read with the setup state at startup, with no extra request.
• The setup guide is in docs/DEPLOYMENT.md → Publishing a demo. It recommends pointing demo connections at read-only database accounts.

Review pass (2026-10-25)

Four reviewers covered reuse, simplification, efficiency and altitude. Fixes:

• A demo login made owner of a workspace kept owner powers in services that read the role. It could list pending invite emails, the UI offered script writing, and it could run its own workspace's members. It is now capped at the shared role seam (cappedRole / memberRoleCeiling).
• /auth/verify/send is refused for demo.
• Workspace switching is allowed.
• The guard refuses a demo write before doing any workspace reads.
• Demo mode moved into GET /auth/setup. VIEWER now builds on DEMO. DEMO_HINT_MAX is shared. The e2e spec uses helpers/accounts.

Tests

• demo-account.test.ts runs against a live server. It covers every guarded write as demo, the owner-workspace cap, invites, scripts, verify/send, workspace switching, sign-out-others, forgot-password, and demo mode. Each new check fails without its fix and passes with it.
• e2e: demo-role passes 3/3; workspaces and workspaces-sharing-limits pass 10/10 against this branch.
• Typecheck, eslint . and the security lint are clean. 968 related unit tests pass.

Not in this PR (on the board)

The reviewers suggested making read-only a permission declared on each route, instead of a URL allow-list plus a role check. That is a bigger RBAC change, and the allow-list is guarded by a test over the real route table.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes authentication guards, RBAC, and workspace role resolution for a shared public login; impact is broad but covered by integration and e2e tests.

Overview
Adds a published demo story: a new demo app role for a shared read-only login, plus demo mode so admins can show a global banner and a public sign-in hint.

Server: Demo accounts are limited by an allow-listed write guard (demo-access) before workspace resolution; workspace effective role is capped to viewer; password reset, verify-email, and sign-out-others are blocked. Demo mode is stored in app settings, exposed on GET /auth/setup and PUT /admin/sign-in/demo.

Web: DemoBanner and sign-in hint UI; admin Sign-in panel to toggle demo mode and save the hint; demo users no longer see “Sign out other sessions”. SQL runs skip App Secrets resolution when the user lacks secrets.view (fixes spurious warnings for demo/viewer).

Tests & docs: Live-server demo-account.test.ts, new e2e demo-role suite, unit tests for banner/auth/admin; DEPLOYMENT.md section on publishing a demo.

^{Reviewed by Cursor Bugbot for commit f75b790. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 8733cf30-1585-4c84-b052-6f510c31468f)

[github-actions]

Test IDs

Added (6)

• auth-demo-hint
• demo-banner
• sign-in-demo
• sign-in-demo-hint
• sign-in-demo-save
• sign-in-demo-toggle

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: c42ed250-126c-48bc-a5b6-a68993e766eb)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 06d218d2-1651-4876-9fe1-02ffbb4bfdae)