The sky is not something an account grants you

`liveData` was one flag meaning two unrelated things, and it was set to
`tier !== "anon"`. That reasoning does not survive asking what the data actually
is. Cloud cover over San Francisco is a reading from a government sensor. The
aircraft are broadcasting their positions, unencrypted, to anyone within range
who owns a forty-dollar receiver. Neither is withheld from anybody by anybody,
so neither is a thing an account can grant access to — and putting them behind a
sign-in cost the only moment that makes this project land: real fog rolling off
the Pacific onto a city you recognise, at the real time of day, on a first
visit. On an SSO-gated deployment it cost that moment for every visitor there
currently is.

So `liveData` splits. `liveEnvironment` is public and unconditional.
`liveMarkers` is asked for by everyone and granted by the server, because the
marker set is the one feed here that can carry something private — a company's
pipeline, a person's job search — and whether it is public is a property of the
deployment, not of a file in this repo.

`TERA_MARKERS_ACCESS` is therefore a server switch and its default is `members`,
which is the safe answer rather than the common one. The failure mode of getting
this wrong is silent: nothing throws, nothing looks broken, the data is simply
readable by the internet. An operator who wires real markers up gets the shut
door without having chosen it and has to say `public` out loud — and saying it
appends a line to `degraded[]`, so `/api/v1/health` reports that this box is
publishing its map without anyone having to go and read the env file. Same
reasoning as `TERA_ADMIN_SUBJECTS=*`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

server/src/config.ts

@@ -58,6 +58,20 @@ export interface MarkersConfig {
    */
   provenanceAllowlist: string[];
   ttlSeconds: number;
+  /**
+   * Who may read the feed. `TERA_MARKERS_ACCESS`, `members` by default.
+   *
+   * The default is the safe answer rather than the common one, deliberately.
+   * A marker set is the one feed here that can carry something private — a
+   * company's pipeline, a person's job search — and the failure mode of getting
+   * it wrong is silent: nothing errors, nothing looks broken, the data is just
+   * readable by the internet. So an operator who wires real data up gets
+   * `members` without having chosen it, and has to say `public` out loud to
+   * publish it. The weather and the aircraft need no such switch, because a
+   * government sensor reading and an unencrypted ADS-B broadcast are not
+   * withheld from anyone by anybody.
+   */
+  access: "members" | "public";
 }
 
 /**
@@ -313,11 +327,33 @@ function loadMarkers(env: Env, authMode: AuthMode, degraded: string[]): MarkersC
   // can sign in has built something no browser will ever see, and one sentence
   // now is cheaper than an afternoon. `routes/markers.ts` has the reasoning for
   // why the feed is members-only with no public escape hatch.
-  if (source === "file" && authMode === "none") {
+  const askedAccess = str(env, "TERA_MARKERS_ACCESS", "members");
+  const access = askedAccess === "public" ? "public" : "members";
+  if (askedAccess !== "members" && askedAccess !== "public") {
+    degraded.push(
+      `TERA_MARKERS_ACCESS="${askedAccess}" is not one of members, public; ` +
+        "keeping the feed members-only.",
+    );
+  }
+  if (source === "file" && access === "public") {
+    // Not a demotion — a deliberate choice, announced. It goes in `degraded[]`
+    // because that array is what `/api/v1/health` publishes, and an operator
+    // reading their own health endpoint should be able to see that this box is
+    // serving its marker set to the world without going and reading the env
+    // file. The same reasoning as `TERA_ADMIN_SUBJECTS=*`.
+    degraded.push(
+      "TERA_MARKERS_ACCESS=public: the marker feed is served to anonymous " +
+        "callers. Correct for a public map; wrong for anything private.",
+    );
+  }
+  // Members-only and nobody can ever be a member is the combination that answers
+  // 401 to the entire internet, which looks like an outage rather than a policy.
+  if (source === "file" && access === "members" && authMode === "none") {
     degraded.push(
       "TERA_MARKERS_SOURCE=file needs an authentication mode: the marker feed is " +
         "refused to anonymous callers, and with TERA_AUTH_MODE=none nobody is ever " +
-        "anything else, so it will answer 401 to everybody. Set TERA_AUTH_MODE.",
+        "anything else, so it will answer 401 to everybody. Set TERA_AUTH_MODE, or " +
+        "TERA_MARKERS_ACCESS=public if the map is meant to be open.",
     );
   }
 
@@ -327,6 +363,7 @@ function loadMarkers(env: Env, authMode: AuthMode, degraded: string[]): MarkersC
     file,
     provenanceAllowlist: allowlist.length > 0 ? allowlist : DEFAULT_PROVENANCE_ALLOWLIST,
     ttlSeconds: num(env, "TERA_MARKERS_TTL", 300, degraded),
+    access,
   };
 }
 

server/src/routes/markers.ts

@@ -54,9 +54,16 @@ const UNAUTHORIZED: ErrorBody = {
 
 export function registerMarkers(app: FastifyInstance, services: Services): void {
   app.get("/api/v1/markers", async (req, reply) => {
-    if (services.config.markers.source === "none") {
+    const { markers } = services.config;
+    // Two ways to be public and they are not the same fact. `source === "none"`
+    // is "there is nothing here to protect" — the body is the bundled sample
+    // set. `access === "public"` is an operator saying this deployment's real
+    // marker set is meant to be read by anyone. Both end up here; only the
+    // second one is a decision, and `config.ts` announces it in `degraded[]`
+    // so it cannot be made silently.
+    if (markers.source === "none" || markers.access === "public") {
       const body = await services.markers.current();
-      publicCache(req, reply, services.config.markers.ttlSeconds);
+      publicCache(req, reply, markers.ttlSeconds);
       return body;
     }
 

server/src/test/markers.test.ts

@@ -83,6 +83,35 @@ function asMember(app: ReturnType<typeof buildApp>) {
   });
 }
 
+describe("TERA_MARKERS_ACCESS", () => {
+  it("defaults to members, so wiring real data up is safe by omission", async () => {
+    const config = loadConfig({ TERA_MARKERS_FILE: file, ...feedEnv });
+    assert.equal(config.markers.access, "members");
+  });
+
+  it("serves anonymous callers when an operator says public out loud", async () => {
+    const app = appWith({ ...feedEnv, TERA_MARKERS_ACCESS: "public" });
+    after(() => app.close());
+
+    const res = await app.inject({ method: "GET", url: "/api/v1/markers" });
+    assert.equal(res.statusCode, 200);
+    assert.ok(res.body.includes("Ferry"));
+    // Public means publicly cacheable. The members-only body deliberately is not.
+    assert.match(res.headers["cache-control"] as string, /max-age/);
+  });
+
+  it("announces a public feed in degraded, so health shows it without reading the env", async () => {
+    const config = loadConfig({ TERA_MARKERS_FILE: file, ...feedEnv, TERA_MARKERS_ACCESS: "public" });
+    assert.ok(config.degraded.some((line) => line.includes("TERA_MARKERS_ACCESS=public")));
+  });
+
+  it("keeps the feed shut on a value it does not understand", async () => {
+    const config = loadConfig({ TERA_MARKERS_FILE: file, ...feedEnv, TERA_MARKERS_ACCESS: "yes" });
+    assert.equal(config.markers.access, "members");
+    assert.ok(config.degraded.some((line) => line.includes("is not one of members, public")));
+  });
+});
+
 describe("a configured marker feed", () => {
   it("refuses an anonymous caller", async () => {
     const app = appWith(feedEnv);