From 9b9756079826de4120939073026ece7699811e08 Mon Sep 17 00:00:00 2001
From: Tyler Adam Martinez <TylerAdamMartinez@outlook.com>
Date: Wed, 19 Aug 2026 10:16:25 -0500
Subject: [PATCH 1/2] docs(public-page): add public page content audit

---
 docs/public-page-content-audit.md | 59 +++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 docs/public-page-content-audit.md

diff --git a/docs/public-page-content-audit.md b/docs/public-page-content-audit.md
new file mode 100644
index 00000000..ad779011
--- /dev/null
+++ b/docs/public-page-content-audit.md
@@ -0,0 +1,59 @@
+# Public Page Content Audit
+
+## Summary
+
+Define what unauthenticated users should see on Ocotillo before public-page design begins.
+
+The public page should explain what Ocotillo is, how to access it, and who it is for without exposing internal data, workflows, or infrastructure.
+
+## Recommended Public Content
+
+The public page should include:
+
+- A brief description of Ocotillo and NMBGMR.
+- A sign-in button.
+- Instructions for requesting access.
+- A support contact method.
+- A note that access is restricted to authorized users.
+
+Avoid assuming visitors already understand "Ocotillo" or internal acronyms.
+
+## Security
+
+Public pages should not expose:
+
+- API endpoints, infrastructure, environments, or bucket names
+- Authentication or authorization implementation details
+- Internal documentation, admin tools, dashboards, or logs
+- Unpublished datasets, record identifiers, or data schemas
+- Internal workflows
+- Staff-only (nonpublic) contact information
+
+Public content should generally be limited to application information, authentication, support, and explicitly approved public services.
+
+## Public Routes
+
+Recommended public routes:
+
+- `/login` .
+- `/callback` — Required for the authentication redirect flow
+- `/about`
+- `/analytics-disclosure`
+- `/report-a-bug`
+- `/ogcapi` — How to connect to ArcGIS manual
+
+Basically, the existing markdown files in `public/content/` for `about`, `analytics-disclosure`, `ogcapi`, and `report-a-bug` are good candidates for these public informational pages.
+
+## Protected Routes
+
+Keep application and data-management functionality authenticated, including:
+
+- `/home` in its current form.
+- `/ocotillo/*`
+- `/geothermal/*`
+- `/st2/*`
+- `/geochronology/*`
+- `/example/*`
+- Create, edit, import, correction, export, inventory, record-detail, and form routes.
+
+Error pages **should** be accessible without authentication but should **not** expose protected navigation or debugging information.

From 5fd11f67ed79e276cbaf864c37dad7e8685da5e9 Mon Sep 17 00:00:00 2001
From: Tyler Adam Martinez <TylerAdamMartinez@outlook.com>
Date: Thu, 20 Aug 2026 07:02:14 -0500
Subject: [PATCH 2/2] chore(public-page): rm description of Ocotillo
 requirement

---
 docs/public-page-content-audit.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/public-page-content-audit.md b/docs/public-page-content-audit.md
index ad779011..183c5231 100644
--- a/docs/public-page-content-audit.md
+++ b/docs/public-page-content-audit.md
@@ -10,7 +10,6 @@ The public page should explain what Ocotillo is, how to access it, and who it is
 
 The public page should include:
 
-- A brief description of Ocotillo and NMBGMR.
 - A sign-in button.
 - Instructions for requesting access.
 - A support contact method.