Cursor Agent 6705db80eb security: lock public globals update to payloadAdminOnly (Pass 4 P0) ... The four public globals (site-settings, home, metadata, privacy-policy) spelled update access as "any authenticated user" — and campaign JWTs authenticate against /api/*, so any campaign session (leader included) could PATCH the public site. payloadAdminOnly matches the collection lockdown precedent; editors lose config-global writes deliberately (content editing stays on canManagePublishedContent collections). Pins: identity + deny (coordinator/editor) + allow (admin fn) + anonymous read in collectionAccessLockdown.int.spec.ts. Recurrence guard: globalAccessConventions.unit.spec.ts bans the Boolean(user) shape in src/globals. Co-authored-by: Francisco Solla <fsolla@users.noreply.github.com>		2026-07-31 20:57:18 -03:00
..
e2e	test(miss-53): gate WebAuthn ceremonies on authenticator readiness	2026-07-31 20:57:18 -03:00
fixtures	Remodel the campaign vertical from Praça to Município	2026-07-23 21:36:20 -03:00
helpers	A6 — Dobradinha 2026 automática quando o TSE publicar candidaturas (pós-15/08) (#82)	2026-07-31 00:14:27 -03:00
int	security: lock public globals update to payloadAdminOnly (Pass 4 P0)	2026-07-31 20:57:18 -03:00
unit	security: lock public globals update to payloadAdminOnly (Pass 4 P0)	2026-07-31 20:57:18 -03:00