feat: add explicit public access setting

Author: css521

docs/public-access.md

@@ -0,0 +1,41 @@
+# Public Access
+
+Status: Implemented
+
+## Summary
+
+Whether anonymous visitors may browse an instance is controlled by an explicit administrator setting, not by the canonical instance URL. A fresh or unconfigured instance is private by default.
+
+## Behavior
+
+When public access is **disabled** (the default):
+
+- Anonymous visitors are redirected to the sign-in page in the web UI.
+- Anonymous API requests are limited to setup, sign-in, sign-up, identity-provider discovery, and share-token routes.
+- Attachments and avatars require authentication.
+- RSS feeds (`/explore/rss.xml`, `/u/:username/rss.xml`) return `404`.
+
+When public access is **enabled**:
+
+- Anonymous visitors may browse public memos in Explore and public user profiles.
+- Attachments linked from public memos and user avatars are served without authentication.
+- RSS feeds for public memos are available.
+
+Authenticated users are never restricted by this setting. Memo visibility (public, protected, private) continues to be enforced independently. Share-token routes keep working on private instances.
+
+## Configuration
+
+Toggle **Settings > System > Access > Allow public access** as an administrator. The change takes effect immediately after saving; no restart is required.
+
+Deployment-managed instances (a `memos-instance-setting-GENERAL.json` file in `/etc/secrets`) reject changes to the whole GENERAL setting with a failed-precondition error, as with the other options on that page.
+
+## Relationship to `MEMOS_INSTANCE_URL`
+
+`--instance-url` / `MEMOS_INSTANCE_URL` remains the canonical URL used for link generation, OAuth redirect URLs, RSS enclosure URLs, and deployment metadata. It no longer influences access control. You can:
+
+- Keep the instance private while still configuring a canonical URL.
+- Allow public access without configuring a canonical URL, although a canonical URL is recommended so generated links are stable.
+
+## Upgrade note
+
+Earlier releases treated a non-empty instance URL as permission for anonymous access. After upgrading, such instances remain configured with the URL but become private until an administrator enables **Allow public access**.

internal/profile/profile.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync/atomic"
 
 	"github.com/pkg/errors"
 )
@@ -32,19 +33,35 @@ type Profile struct {
 	Version string
 	// Commit is the current build commit of server
 	Commit string
-	// InstanceURL is the url of your memos instance.
+	// InstanceURL is the url of your memos instance. It is used only for
+	// canonical URL and link generation; it never controls anonymous access.
 	InstanceURL string
+
+	// allowAnonymous mirrors the persisted GENERAL instance setting
+	// (allow_public_access). The zero value is false, so a fresh or
+	// unconfigured instance is private.
+	allowAnonymous atomic.Bool
 }
 
-// AllowAnonymous reports whether unauthenticated visitors may access the instance.
-//
-// Anonymous access is enabled only when an InstanceURL is configured. An instance
-// with no InstanceURL set is treated as private: anonymous callers are limited to
-// the auth-bootstrap endpoints (sign-in, share links, etc.) and the web UI redirects
-// them to the sign-in page instead of the public Explore view. Authenticated callers
-// (session, access token, or personal access token) are never affected.
+// SetAllowAnonymous publishes the effective anonymous-access policy. It is
+// called by the store whenever the GENERAL instance setting is read or updated,
+// so an administrator toggle takes effect immediately without a restart.
+func (p *Profile) SetAllowAnonymous(allowed bool) {
+	if p == nil {
+		return
+	}
+	p.allowAnonymous.Store(allowed)
+}
+
+// AllowAnonymous reports whether unauthenticated visitors may access the
+// instance, per the persisted allow_public_access setting. Absent or unloaded
+// state is private. Authenticated callers (session, access token, or personal
+// access token) are never affected by this policy.
 func (p *Profile) AllowAnonymous() bool {
-	return strings.TrimSpace(p.InstanceURL) != ""
+	if p == nil {
+		return false
+	}
+	return p.allowAnonymous.Load()
 }
 
 func checkDataDir(dataDir string) (string, error) {

internal/profile/profile_test.go

@@ -8,10 +8,8 @@ func TestAllowAnonymous(t *testing.T) {
 		url  string
 		want bool
 	}{
-		{"empty is private", "", false},
-		{"whitespace only is private", "   ", false},
-		{"configured url is public", "https://memos.example.com", true},
-		{"configured url with padding is public", "  https://memos.example.com  ", true},
+		{"empty url stays private", "", false},
+		{"configured url alone is private", "https://memos.example.com", false},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -22,3 +20,18 @@ func TestAllowAnonymous(t *testing.T) {
 		})
 	}
 }
+
+func TestAllowAnonymousExplicitPolicy(t *testing.T) {
+	p := &Profile{}
+	if p.AllowAnonymous() {
+		t.Fatal("fresh profile must default to private")
+	}
+	p.SetAllowAnonymous(true)
+	if !p.AllowAnonymous() {
+		t.Fatal("explicit public policy must be reported")
+	}
+	p.SetAllowAnonymous(false)
+	if p.AllowAnonymous() {
+		t.Fatal("explicit private policy must be reported")
+	}
+}

proto/api/v1/instance_service.proto

@@ -81,6 +81,10 @@ message InstanceProfile {
   // false once any user exists, so an instance that has lost its admins is not
   // mistaken for a fresh install.
   bool needs_setup = 9;
+
+  // Whether anonymous visitors may access public instance content.
+  // Absent or false means the instance is private.
+  bool allow_public_access = 10;
 }
 
 // Request for instance profile.
@@ -146,6 +150,9 @@ message InstanceSetting {
     bool disallow_change_username = 8;
     // disallow_change_nickname disallows changing nickname.
     bool disallow_change_nickname = 9;
+    // allow_public_access controls whether anonymous visitors may access public
+    // instance content. Absent or false means the instance is private.
+    bool allow_public_access = 10;
 
     // Custom profile configuration for instance branding.
     message CustomProfile {

proto/gen/api/v1/instance_service.pb.go

@@ -2790,6 +2790,11 @@ components:
                          setup (creating the first admin account). Unlike a null admin, this stays
                          false once any user exists, so an instance that has lost its admins is not
                          mistaken for a fresh install.
+                allowPublicAccess:
+                    type: boolean
+                    description: |-
+                        Whether anonymous visitors may access public instance content.
+                         Absent or false means the instance is private.
             description: Instance profile message containing basic instance information.
         InstanceSetting:
             type: object
@@ -2888,6 +2893,11 @@ components:
                 disallowChangeNickname:
                     type: boolean
                     description: disallow_change_nickname disallows changing nickname.
+                allowPublicAccess:
+                    type: boolean
+                    description: |-
+                        allow_public_access controls whether anonymous visitors may access public
+                         instance content. Absent or false means the instance is private.
             description: General instance settings configuration.
         InstanceSetting_MemoRelatedSetting:
             type: object

proto/gen/openapi.yaml

@@ -63,6 +63,9 @@ message InstanceGeneralSetting {
   bool disallow_change_username = 8;
   // disallow_change_nickname disallows changing nickname.
   bool disallow_change_nickname = 9;
+  // allow_public_access controls whether anonymous visitors may access public
+  // instance content. Absent or false means the instance is private.
+  bool allow_public_access = 10;
 }
 
 message InstanceCustomProfile {

proto/gen/store/instance_setting.pb.go

@@ -52,7 +52,7 @@ func IsPublicMethod(procedure string) bool {
 }
 
 // AuthBootstrapMethods is the subset of PublicMethods that stays reachable by
-// anonymous callers even when the instance is private (no InstanceURL configured).
+// anonymous callers even when the instance is private (public access disabled).
 //
 // It is the minimum required to render the sign-in page, authenticate, and follow
 // share links, and register when instance settings permit it. Every entry here

proto/store/instance_setting.proto

@@ -106,7 +106,7 @@ func TestAuthBootstrapMethodsAreSubsetOfPublic(t *testing.T) {
 }
 
 // TestAuthBootstrapClassification verifies which endpoints remain reachable by
-// anonymous callers on a private instance (no InstanceURL configured).
+// anonymous callers on a private instance (public access disabled).
 func TestAuthBootstrapClassification(t *testing.T) {
 	// Reachable while private: sign-in flow, registration, instance metadata, SSO, share links.
 	bootstrap := []string{