Dynamic Documentation Visibility — Session-Based Backend Control

Backend-controlled project visibility via shared links. No new routes or components.

Dynamic Documentation Visibility — Session-Based Backend Control

Goal

When sharing the docs app with someone, control which projects they see from the backend. Keep current docs structure, routes, and components. Add a filter layer driven by session tokens.

Approach: URL + Backend Filter

Create session (admin): POST /docs-api/sessions with allowedProjectIds
Share link: docs.app.com?v=TOKEN or docs.app.com?session=TOKEN
Frontend: On load, if v or session in URL, call GET /docs-api/sessions/:token
Backend: Returns { allowedProjectIds: ["english/AI", "english/GoGrab-Space"] } or { allowedProjectIds: null } if invalid
Frontend: Filter availableProjects to only those in allowedProjectIds (when present)

No new routes, no new components — only filter the existing project list.

Backend (backend-docs-api)

Endpoints

Method	Path	Auth	Purpose
GET	`/docs-api/sessions/:token`	Public	Resolve token → allowedProjectIds
POST	`/docs-api/sessions`	T0/T1	Create session
GET	`/docs-api/sessions`	T0/T1	List all sessions
DELETE	`/docs-api/sessions/:token`	T0/T1	Deactivate session

Schema (doc-view-sessions)

Field	Type	Description
token	string	Unique token (24-char hex)
allowedProjectIds	string[]	e.g. `["english/AI", "english/GoGrab-Space"]`
name	string	Optional label
createdBy	string	User ID
isActive	boolean	Enable/disable
expiresAt	Date	Optional expiry

Files

APIs/backend-docs-api/src/app/view-sessions/schemas/doc-view-session.schema.ts
APIs/backend-docs-api/src/app/view-sessions/view-sessions.service.ts
APIs/backend-docs-api/src/app/view-sessions/view-sessions.controller.ts
APIs/backend-docs-api/src/app/view-sessions/view-sessions.module.ts

Frontend (docs-angular)

Implementation (Done)

In LoadAvailableProjects (project-selection.state.ts):

Read v or session query param from URL (supports hash routing: #/path?v=TOKEN)
If present: call GET /docs-api/sessions/:token (base: /docs-api in dev via proxy, full docs-api URL in prod)
If response has allowedProjectIds (array): filter projects to only those whose id is in allowedProjectIds
If no token or invalid: show all projects (current behavior)

Proxy (dev)

/docs-api → http://localhost:3002 (backend-docs-api)

Production

docs-api: https://docs-api.gograb.space/docs-api
Frontend calls: https://docs-api.gograb.space/docs-api/sessions/:token

Flow (Unchanged for Normal Users)

No ?v= in URL → load all projects from assets → no change
Invalid/expired token → allowedProjectIds: null → show all projects (fallback)

Future: User-Assigned Visibility

Extend backend: GET /docs-api/sessions/for-user (authenticated)
Returns allowedProjectIds for current user if assigned
Frontend: when logged in, optionally fetch and filter