Francisco Ignácio Fontoura Solla
473c82d09d
Lock down CMS/PII collection access and leader routes
...
- users/signature/subscription/consent: all operations Payload-admin-only
(Payload's default allowed ANY authenticated user, incl. campaign JWTs
via /api — privilege escalation + PII exposure)
- post/tag/media/petition: public read kept, writes admin-only,
readVersions admin-only on drafted collections
- leader lockdown: staff gates on /campanha/demandas* and /campanha/planos*;
removed the dead leader branch of the demand detail page
- fix createLeaderSupporter: scope now asserted via the leader's engaged
leadership municipalities (canReadMunicipality always denied leaders)
- candidate alignment: supporter area, invite creation, and escalated
demand decisions now treat candidate as unrestricted staff consistently
- tests: collectionAccessLockdown.int.spec pins the lockdown; leased-consent
helpers generalized (supporter keys); fixtures purge deletes residue
invites before leaderships; stale leader-phone tests updated to the
lockdown model; 'sem Praça' copy renamed to 'sem município'
2026-07-23 22:25:18 -03:00
Francisco Ignácio Fontoura Solla
14961c5fea
feat: overhaul petition UX, add contact/signature data model, and refresh shadcn theming
...
- redesign petition page layout with responsive hero, content section, and form card
()
- refactor frontend theming setup:
- add with in frontend layout
- migrate/clean global style tokens and base styles in
- adjust header/social visuals for theme-aware rendering
(, ,
, , )
- expand petition form with additional fields and new UI primitives
(native select, textarea, button, state/city flow)
(, , , )
- add new Payload collections and wire them into config:
, ,
(, ,
, ,
)
- update petition collection admin grouping and project config
(, , )
- add supporting dependency/lockfile updates and workspace tooling tweaks
(, , , )
2026-02-22 20:02:51 -03:00
