# S06 Research: Forgejo KB Update — Auth, Consent, LightRAG

## Summary

Straightforward documentation update. The Forgejo wiki at `git.xpltd.co/xpltdco/chrysopedia/wiki/` has 10 pages bootstrapped in M018/S02. Three new subsystems from M019 (S01-S04) need documenting: creator authentication, video consent, and LightRAG. No new technology — the established pattern is git clone the wiki repo, update/create markdown pages, push.

## Recommendation

Single task: clone wiki, update 5 existing pages + create 1 new page, push, verify via API.

## Implementation Landscape

### What Exists

**Wiki pages (10 current):** Home, Architecture, Data-Model, API-Surface, Frontend, Pipeline, Deployment, Development-Guide, Decisions, _Sidebar

**Wiki update method (from M018/S02/T02):** Git clone via HTTPS with token auth → edit markdown files → git push. More efficient than per-page API calls. The wiki repo URL is `https://git.xpltd.co/xpltdco/chrysopedia.wiki.git`.

### What Needs Updating

**1. Architecture page** — currently says "No authentication" and shows 8 containers. Needs:
- Update to reflect 11 containers (LightRAG added in S01, count was already 10 with watcher)
- Remove "No authentication" bullet, add auth description
- Add LightRAG to the ASCII architecture diagram
- Add LightRAG row to Docker Services table (port 9621, ghcr.io/hkuds/lightrag:latest, chrysopedia_lightrag volume)

**2. Data-Model page** — currently documents 13 models. Needs:
- Add User model (id, email, display_name, password_hash, role, creator_id FK)
- Add InviteCode model (id, code, max_uses, use_count, expires_at, created_by)
- Add UserRole enum (admin, creator)
- Add VideoConsent model (id, source_video_id FK, allow_index, allow_summarize, allow_embed, allow_attribution, updated_by FK)
- Add ConsentAuditLog model (id, video_consent_id FK, field, old_value, new_value, version, changed_by FK)
- Add ConsentField enum
- Update ER diagram to show User→Creator link and VideoConsent→SourceVideo link

**3. API-Surface page** — currently documents 41 endpoints grouped by domain. Needs:
- Add Auth endpoints section (4 endpoints: POST /register, POST /login, GET /me, PUT /me)
- Add Consent endpoints section (5 endpoints: GET /consent/videos, GET /consent/videos/{id}, PUT /consent/videos/{id}, GET /consent/videos/{id}/history, GET /consent/admin/summary)
- Update endpoint count in header

**4. Deployment page** — needs:
- Add chrysopedia_lightrag_data to file layout
- Add .env.lightrag to configuration notes
- Add LightRAG to service dependencies section

**5. _Sidebar** — add Authentication page link under Architecture section

**6. NEW: Authentication page** — standalone reference covering:
- JWT auth flow (HS256, 24h expiry, OAuth2PasswordBearer)
- Invite code registration system
- Role model (admin, creator)
- FastAPI dependencies (get_current_user, require_role)
- Frontend AuthContext, ProtectedRoute, localStorage token
- Consent data model and API overview

### Source Material for Content

All content can be synthesized from the inlined slice summaries (S01-S04) and the source code:
- `backend/models.py` — User, InviteCode, VideoConsent, ConsentAuditLog models
- `backend/auth.py` — JWT utilities, FastAPI dependencies
- `backend/routers/auth.py` — Auth endpoints
- `backend/routers/consent.py` — Consent endpoints
- `backend/schemas.py` — Auth and consent Pydantic schemas
- `docker-compose.yml` — LightRAG service definition
- `.env.lightrag` — LightRAG configuration
- `frontend/src/context/AuthContext.tsx` — Frontend auth state
- `frontend/src/components/ProtectedRoute.tsx` — Route protection

### Verification

- `curl -sf "https://git.xpltd.co/api/v1/repos/xpltdco/chrysopedia/wiki/pages?limit=50"` → count ≥ 11 (10 existing + 1 new Authentication page)
- Spot-check updated pages via API: Architecture page contains "LightRAG", API-Surface contains "consent", Data-Model contains "User"
- _Sidebar contains "Authentication" link

### Constraints

- Need Forgejo API token for push access (was used in M018/S02, should still be available on ub01 or in env)
- Wiki git operations happen on ub01 (where the Forgejo instance is accessible)
- Keep existing page style/structure consistent — tables for models and endpoints, ASCII for diagrams
