2, "wing" => "Identity", "title" => "Visitors get a real page", "promise" => "Someone who is not signed in sees the page, not a bounce to a sign-in screen.", "block" => "auth_user() is null for a visitor. The app decides what a visitor sees; the platform never forces a sign-in.", "show" => function (?array $me): string { return $me ? '

You are signed in. Open this page in a private window: it loads and says "you are a visitor".

' : '

You are a visitor. This whole page loaded without a sign-in.

'; }, // Load the front page with no cookies at all, as a private window does. "check" => function (): array { [$code, $loc, $body] = (new Browser())->get("https://" . env("RC_HOST") . "/"); if ($code !== 200 || $loc !== "") return [false, "a visitor got $code" . ($loc ? " to $loc" : "") . " instead of the page"]; if (!str_contains((string)$body, "You are a visitor")) return [false, "the page loaded but does not say \"you are a visitor\""]; return [true, "a visitor gets the page (200, no redirect) and it says \"you are a visitor\""]; }, ];