Design 2 · Gating published projects, htaccess-style

Per-directory HTTP Basic Auth over TLS · one optional read_access_password per project · works for browsers, curl, and agents alike

A project directory can carry one read password. If set, every URL under /<project>/ answers 401 with WWW-Authenticate: Basic until credentials arrive — exactly the consumer experience of dropping an .htaccess/.htpasswd pair into a folder: the browser pops its native login box once and remembers; an agent adds one header. There is no Apache in this stack (kamal-proxy → gunicorn, content served from sqlite), so Django plays Apache's part in views.py — about 40 lines.

Model change (migration 0004)

class Directory(models.Model):
    ...
    # '' = publicly readable (default, today's behavior). Otherwise a Django
    # password hash (make_password) — never plaintext, never readable over MCP.
    # Gates READING the published site only; writes are always the space
    # credential over MCP.
    read_access_password = models.CharField(max_length=128, blank=True, default='')

    @property
    def is_read_protected(self):
        return bool(self.read_access_password)

Semantics kept deliberately htaccess-simple: one shared read password per project, any username accepted (some clients insist on sending one — it is ignored). The realm is the directory name. Protection is orthogonal to visible_in_index/available_online; an offline project stays 404, a read-protected one is 401.

Enforcement in views.py

def _check_read_access(request, d):
    """None if allowed; otherwise the 401 challenge response."""
    if not d.read_access_password:
        return None
    header = request.headers.get('Authorization', '')
    if header.startswith('Basic '):
        try:
            decoded = base64.b64decode(header[6:]).decode('utf-8')
            _user, _, password = decoded.partition(':')
        except (ValueError, UnicodeDecodeError):
            password = ''
        if password and _password_ok(d, password):   # cached check_password
            return None
        _note_failure(request)                       # per-IP rate limit
    resp = HttpResponse('Authentication required', status=401,
                        content_type='text/plain; charset=utf-8')
    resp['WWW-Authenticate'] = f'Basic realm="{d.name}", charset="UTF-8"'
    return resp

# project_index / project_file grow two lines each:
def project_index(request, dirname):
    d = _get_online_directory(dirname)
    denied = _check_read_access(request, d)
    if denied: return denied
    ...

Who sets the read password

Under option A, one new MCP tool (keeping the platform's no-single-file-write spirit of few, explicit tools):

set_read_access_password(directory, password)   # 8–128 chars → protect
set_read_access_password(directory, null)       # remove the gate

_dir_meta gains "read_protected": true|false. The password itself is never returned by any tool — the agent that set it is expected to relay it to its human; a later session can only see that a gate exists. /space_admin/ gets a matching set/clear form and a 🔒 column.

Stopping the side-channel leaks

• Space index pages (/<space id>/) currently parse each listed project's index.html for title and description. For a read-protected project that is a content leak — so a listed-but-protected project renders as its directory name plus a 🔒 badge, and _parse_index_html is skipped entirely.
• Crawlers: 401 responses keep search engines out by construction; no robots.txt coordination needed.
• Caches: gated responses get Cache-Control: private, no-store so nothing sticks in shared caches.

How agents and humans get in

# human: open https://says.hermione.online/notes/ → browser prompt → done for the session

# curl (any username works):
curl -u guest:s3cret https://says.hermione.online/notes/

# fetch / any HTTP client:
fetch(url, { headers: { Authorization: 'Basic ' + btoa('guest:s3cret') } })

# URL form many tools accept (incl. simple fetch-a-page MCP tools):
https://guest:s3cret@says.hermione.online/notes/

Considered and rejected

Optional extensions (explicitly out of v1)

• Space-wide gate: same field on Space, checked for every project in it plus the space index page — turns a whole space into a private area with one read password.
• Multiple users: an htpasswd-style {user: hash} JSON field if per-person credentials are ever wanted; the 401 dance is identical.
• Auth for the fetch-through-MCP tool: the Pass Web Through MCP fetcher can pass Basic credentials via the URL form above already; a dedicated header argument would be cleaner.

Honest limits

• One shared read password: anyone who has it can share it. That is the htaccess trade-off, accepted knowingly.
• Basic sends credentials on every request — safe only because TLS is mandatory end-to-end (kamal-proxy terminates Let's Encrypt certs; both domains covered).
• Browsers cache Basic credentials until the window closes; there is no logout button. Fine for the use case.
• Not for genuinely sensitive data — this gates "drafts, family pages, client previews", not secrets.

Implementation checklist

← Design 1 — MCP OAuth 2.1 · Overview