GuilanCE/guilan-ace-deployment
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Record CMS roles and admin checkpoint for review

Browse Source
This commit is contained in:
Amirhossein Khalili
2026-09-27 10:22:16 +03:30
parent 964588e363
commit 51211a71c9
7 changed files with 33 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tasks/bundle1-checkpoint-d-review.md Normal file
View File

@@ -0,0 +1,26 @@
# Bundle 1 — Checkpoint D review
Prepared 2026-09-27. **Awaiting owner review.** This covers T08–T09: editorial draft/publish/restore rules and Django admin editing. Public and private preview APIs (T10–T11), seed (T12–T13), and frontend adapter (T14) have not started.
## What is ready
- The `content_editor` group can create and preview drafts. The `content_publisher` group can also publish and restore. Active superusers override these rules. Staff status alone grants no content action. Migration `content.0003_content_groups` creates both groups and their explicit permissions without assigning accounts.
- Each save creates a new content revision. Publishing validates the full page and any referenced media, then swaps the published pointer in one transaction. A stale pointer rejects the publish. Restore creates a new revision from a prior published snapshot and keeps history. Audit entries record actor, operation, and revision numbers.
- Home publishing requires all four visible sections in the approved order. About requires identity first and contact last. Optional About sections can be reordered or hidden. Listing pages contain an intro and SEO but no sections. Unapproved media cannot be published.
- Django admin exposes named fields for site identity, navigation, contacts, page copy, sections, actions, and typed About entries. Editors do not edit raw JSON, revision status, or the published pointer. The dashboard shows drafts, preview links, the published revision, and publisher actions. Approved media becomes read only.
- Admin draft preview requires the preview permission, stays on an admin route, and sends `Cache-Control: private, no-store` plus `X-Robots-Tag: noindex, nofollow`. No public content API is active yet.
## Verification
- Full backend suite on the isolated SQLite test settings: **79 unit passed; 184 integration passed; 1 PostgreSQL-only concurrency test skipped**.
- The two-publisher race test ran separately against a local PostgreSQL test database: **1 passed**. One publish won; the second received a conflict. The SQLite suite also tests a second publish attempt using the same stale pointer.
- Django system check: no issues. Migration consistency check: no changes detected. The additive content permission/group migrations applied on the local test database.
- Browser walkthrough on a local test database: editor saved a Home draft at 390px, publisher opened its no-store preview and published it, and the dashboard then identified revision 1 as published. The draft form had no horizontal overflow at 390px or 1440px. Captures: [editor form at 390px](evidence/2026-09-27/cms-admin-home-390.png), [editor form at 1440px](evidence/2026-09-27/cms-admin-home-1440.png), [publisher dashboard at 390px](evidence/2026-09-27/cms-admin-publisher-390.png), [published dashboard at 1440px](evidence/2026-09-27/cms-admin-published-1440.png).
## Review points
1. Confirm the editor/publisher separation and the admin draft → preview → publish → restore workflow.
2. Confirm that the Home section order and About optional reorder/hide controls match the approved contract.
3. Confirm the admin layout at phone and desktop widths from the captures. Actual staff account assignment remains a later gate.
No production content, media, account assignment, or public route was changed. Checkpoint D closes only after owner review; T10–T11 begin afterward.