Cursor Agent 6705db80eb security: lock public globals update to payloadAdminOnly (Pass 4 P0) ... The four public globals (site-settings, home, metadata, privacy-policy) spelled update access as "any authenticated user" — and campaign JWTs authenticate against /api/*, so any campaign session (leader included) could PATCH the public site. payloadAdminOnly matches the collection lockdown precedent; editors lose config-global writes deliberately (content editing stays on canManagePublishedContent collections). Pins: identity + deny (coordinator/editor) + allow (admin fn) + anonymous read in collectionAccessLockdown.int.spec.ts. Recurrence guard: globalAccessConventions.unit.spec.ts bans the Boolean(user) shape in src/globals. Co-authored-by: Francisco Solla <fsolla@users.noreply.github.com>		2026-07-31 20:57:18 -03:00
..
CampaignGoals.ts	Tooling: prettier como autoridade de formatacao (organize-imports deterministico, scripts format/format:check, normalizacao mecanica de 312 arquivos; artefatos gerados e migrations excluidos via .prettierignore)	2026-07-25 17:22:20 -03:00
HomePage.ts	security: lock public globals update to payloadAdminOnly (Pass 4 P0)	2026-07-31 20:57:18 -03:00
Metadata.ts	security: lock public globals update to payloadAdminOnly (Pass 4 P0)	2026-07-31 20:57:18 -03:00
PrivacyPolicy.ts	security: lock public globals update to payloadAdminOnly (Pass 4 P0)	2026-07-31 20:57:18 -03:00
SiteSettings.ts	security: lock public globals update to payloadAdminOnly (Pass 4 P0)	2026-07-31 20:57:18 -03:00