Francisco Ignácio Fontoura Solla 473c82d09d Lock down CMS/PII collection access and leader routes ... - users/signature/subscription/consent: all operations Payload-admin-only (Payload's default allowed ANY authenticated user, incl. campaign JWTs via /api — privilege escalation + PII exposure) - post/tag/media/petition: public read kept, writes admin-only, readVersions admin-only on drafted collections - leader lockdown: staff gates on /campanha/demandas* and /campanha/planos*; removed the dead leader branch of the demand detail page - fix createLeaderSupporter: scope now asserted via the leader's engaged leadership municipalities (canReadMunicipality always denied leaders) - candidate alignment: supporter area, invite creation, and escalated demand decisions now treat candidate as unrestricted staff consistently - tests: collectionAccessLockdown.int.spec pins the lockdown; leased-consent helpers generalized (supporter keys); fixtures purge deletes residue invites before leaderships; stale leader-phone tests updated to the lockdown model; 'sem Praça' copy renamed to 'sem município'		2026-07-23 22:25:18 -03:00
..
e2e	Type municipalities e2e consent fixture with Payload	2026-07-23 21:39:14 -03:00
fixtures	Remodel the campaign vertical from Praça to Município	2026-07-23 21:36:20 -03:00
helpers	Lock down CMS/PII collection access and leader routes	2026-07-23 22:25:18 -03:00
int	Lock down CMS/PII collection access and leader routes	2026-07-23 22:25:18 -03:00
unit	Remodel the campaign vertical from Praça to Município	2026-07-23 21:36:20 -03:00