Decision: bible-texts/books anonymous read vs. require auth

[henrique221]

Question

The bible-texts, books, and bible-books read endpoints remain
unauthenticated (left unchanged in #189). In particular
POST /bibles/{bibleId}/bulk-texts returns up to 1200 chapters/request and is
documented "No authentication required" — an efficient scraping primitive.

Is anonymous read intentional (e.g. mobile pre-cache)?

• If yes → document the use case explicitly and add rate limiting
  (rate-limiting is a guard for the intentional-anonymous case, not a substitute
  for auth).
• If no → add authenticateUser, consistent with the bibles reads secured in
  fix(auth): require authentication on bibles and USFM routes #189.

Decision needed from

Kasey (per the audit follow-up).

Refs

Follow-up from #194 / PR #189.
Detail: docs/proposals/security-and-export-hardening/01-auth-open-domains.md (follow-up 2).

[henrique221]

Decision from Kasey (2026-06-26): anonymous access is intentional — the ~1200-chapter bulk return supports a mobile sync feature. Per the agreed plan: keep it unauthenticated, document the use case explicitly, and add rate limiting to the bulk endpoint as an abuse guard (not a substitute for auth). Implementation PR incoming.