decide what entities can be read by an anonymous user in a public hackathon

[Panaetius]

Currently, only the Hackathon itself is visible to non-members for public hackathons. see https://github.com/SwissDataScienceCenter/hackagon/blob/main/components/backend/internal/middleware/rbac.go#L283-L288

We need to decide what is visible on a public hackathon to a non-member:

• pages
• phases
• members
• tracks
• projects
• teams
• submissions
• vote categories
• votes
• vote results

[caviri]

Hi @Panaetius @hanaCasey @sabinem

I'd say that as a rule of thumb everything related to marketing and annoucement such as the open call, registration, projects available should be public. Then people/participants + competition internals should be member-only. Said this, I think submitted projects should be public once a Hackathon is done, as this create a nice showcase for the future.

Resource	Non-members	Condition
pages	✅	only visible=true
phases	✅	—
tracks	✅	—
projects	✅	approved only
vote categories	✅	— (judging transparency)
vote results	✅	only after finalized/published
members	❌	expose aggregate count only (GDPR)
teams	❌	names surface via published results
submissions	?	finalized ones surface via results page / Only when hackathon is over
votes (ballots)	❌	never — voter + admin/audit only