[leanderva]

What

A customer can open published documentation behind a generated password, seeing only the requests an
admin selected, for a limited time.

• New visibility "Cliente, com senha". Only a workspace admin creates, changes or removes it.
• Selection of requests by fixed id, or the whole collection, which follows it.
• With a selection, the page also leaves out the collection description and the variables the shown requests do not use.
• Expiry on every publication (7, 30, 90 days, a date, or none; default 30). Expired pages answer 410.
• Password generated and shown once, stored as a scrypt hash, 8 hour token.
• Lockout: 5 wrong tries lock the page for 15 minutes. Changing the password unlocks it.
• Last access per publication, written at most once an hour.
• The credential scan also reads the environment a page uses.

Decision record: docs/adr/0003-customer-access-to-published-documentation.md, with the limits that were accepted.

Changes to template.yml

TTL attribute ttl on the table and dynamodb:UpdateItem on the Lambda role.
Manual CloudFormation test: PENDING. Do it before opening this pull request, then edit this line.

Deploy note

Publications saved before this change have no expiry, so they never expire.

How it was tested

• bun run test:ci: 312 tests pass. bun run build passes.
• Browser run on the local stack: gate, wrong password warnings, lock, rotate unlocks and
  invalidates the old password, only the selected requests, no secrets on the page, editor sees it read-only.
• An independent review of types, silent failures, DynamoDB access and security. Findings were fixed or recorded in the ADR.
• Not tested: the access counters against a real DynamoDB, only the in-memory version.

Refs: TEC-3584