---
estimated_steps: 18
estimated_files: 8
skills_used: []
---

# T01: Update Forgejo wiki with auth, consent, and LightRAG documentation

Clone the Chrysopedia Forgejo wiki repo on ub01, update 5 existing pages (Architecture, Data-Model, API-Surface, Deployment, _Sidebar) and create 1 new Authentication page documenting the three subsystems built in M019 S01-S04.

Content sources (read these files for accurate details):
- `backend/models.py` — User (line ~133), InviteCode (~163), UserRole (~77), VideoConsent (~582), ConsentAuditLog (~627), ConsentField (~573)
- `backend/auth.py` — JWT utilities, OAuth2PasswordBearer, get_current_user, require_role
- `backend/routers/auth.py` — 4 endpoints: POST /register, POST /login, GET /me, PUT /me
- `backend/routers/consent.py` — 5 endpoints: GET /videos, GET /videos/{id}, PUT /videos/{id}, GET /videos/{id}/history, GET /admin/summary
- `docker-compose.yml` — chrysopedia-lightrag service (line ~81, port 9621, ghcr.io/hkuds/lightrag:latest)
- `frontend/src/context/AuthContext.tsx` — AuthProvider, useAuth hook
- `frontend/src/components/ProtectedRoute.tsx` — route protection component

Wiki access: git clone via HTTPS with token auth on ub01. The wiki repo URL is `https://git.xpltd.co/xpltdco/chrysopedia.wiki.git`. A Forgejo token should be available on ub01 (used in M018/S02). If not found, check `~/.forgejo_token` or environment.

Page updates needed:

1. **Architecture.md** — Update container count to 11, remove 'No authentication' bullet, add auth description, add LightRAG to ASCII diagram and Docker Services table (port 9621, ghcr.io/hkuds/lightrag:latest, chrysopedia_lightrag volume, Python urllib healthcheck)

2. **Data-Model.md** — Add sections for: User model (id, email, display_name, password_hash, role, creator_id FK), InviteCode model (id, code, max_uses, use_count, expires_at, created_by), UserRole enum (admin, creator), VideoConsent model (id, source_video_id FK, allow_index/summarize/embed/attribution booleans, updated_by FK), ConsentAuditLog (id, video_consent_id FK, field, old_value, new_value, version, changed_by FK), ConsentField enum. Update ER relationships.

3. **API-Surface.md** — Add Auth endpoints section (POST /auth/register, POST /auth/login, GET /auth/me, PUT /auth/me) and Consent endpoints section (GET /consent/videos, GET /consent/videos/{id}, PUT /consent/videos/{id}, GET /consent/videos/{id}/history, GET /consent/admin/summary). Update total endpoint count.

4. **Deployment.md** — Add chrysopedia_lightrag_data to file layout, .env.lightrag to config notes, LightRAG to service dependencies.

5. **_Sidebar.md** — Add Authentication page link under Architecture section.

6. **Authentication.md (NEW)** — JWT auth flow (HS256, 24h expiry, OAuth2PasswordBearer), invite code registration, role model (admin, creator), FastAPI dependencies (get_current_user, require_role), frontend AuthContext/ProtectedRoute/localStorage token, consent data model and API overview.

Keep existing page style consistent — tables for models and endpoints, match existing formatting patterns.

## Inputs

- ``backend/models.py` — User, InviteCode, VideoConsent, ConsentAuditLog model definitions`
- ``backend/auth.py` — JWT utilities and FastAPI auth dependencies`
- ``backend/routers/auth.py` — Auth endpoint implementations (4 routes)`
- ``backend/routers/consent.py` — Consent endpoint implementations (5 routes)`
- ``backend/schemas.py` — Auth and consent Pydantic schemas`
- ``docker-compose.yml` — LightRAG service definition (line ~81)`
- ``frontend/src/context/AuthContext.tsx` — Frontend auth state management`
- ``frontend/src/components/ProtectedRoute.tsx` — Route protection component`

## Expected Output

- ``Architecture.md` — Updated wiki page with LightRAG and auth info (in wiki repo on ub01)`
- ``Data-Model.md` — Updated wiki page with User, InviteCode, VideoConsent, ConsentAuditLog models`
- ``API-Surface.md` — Updated wiki page with auth and consent endpoint sections`
- ``Deployment.md` — Updated wiki page with LightRAG deployment info`
- ``_Sidebar.md` — Updated sidebar with Authentication link`
- ``Authentication.md` — New wiki page covering JWT auth, invite codes, consent`

## Verification

ssh ub01 'curl -sf "https://git.xpltd.co/api/v1/repos/xpltdco/chrysopedia/wiki/pages?limit=50" -H "Authorization: token $(cat ~/.forgejo_token 2>/dev/null || echo $FORGEJO_TOKEN)"' | python3 -c "import sys,json; pages=json.load(sys.stdin); names=[p['title'] for p in pages]; assert len(pages)>=11, f'Only {len(pages)} pages'; assert 'Authentication' in names, 'Missing Authentication page'; print(f'{len(pages)} pages OK')"
