Francisco Ignácio Fontoura Solla
cf6ae6c47c
Pass 2 W2: correcoes de fronteira lib/utilities e client boundary
...
- helpers puros movidos utilities->lib: slug, phone, wordStartFilter, voteEstimate (9 inversoes lib->utilities zeradas)
- chaves de consent em src/lib/campaignConsentKeys.ts (client-safe); campaignInvite/campaignConsent re-exportam; onda0ConsentTexts referencia as constantes
- 'server-only' em 21 loaders Payload/cache (CLI segue com --conditions=react-server)
- ciclo de tipos supporterListFilters <-> supporterUi quebrado (SupporterListFilterInput estrutural; sqlFilters idem)
- votePledgeData dividido: votePledgeViews (puro, client-safe) + votePledgeData (loaders, server-only) - padrao contract-module
- predicados de role client-safe em src/lib/campaignRoles.ts; access/shared deriva deles (fonte unica); nav.ts para de importar o barrel campaignAccess (casts 'as CampaignUser' eliminados)
2026-07-25 14:38:41 -03:00
Francisco Ignácio Fontoura Solla
473c82d09d
Lock down CMS/PII collection access and leader routes
...
- users/signature/subscription/consent: all operations Payload-admin-only
(Payload's default allowed ANY authenticated user, incl. campaign JWTs
via /api — privilege escalation + PII exposure)
- post/tag/media/petition: public read kept, writes admin-only,
readVersions admin-only on drafted collections
- leader lockdown: staff gates on /campanha/demandas* and /campanha/planos*;
removed the dead leader branch of the demand detail page
- fix createLeaderSupporter: scope now asserted via the leader's engaged
leadership municipalities (canReadMunicipality always denied leaders)
- candidate alignment: supporter area, invite creation, and escalated
demand decisions now treat candidate as unrestricted staff consistently
- tests: collectionAccessLockdown.int.spec pins the lockdown; leased-consent
helpers generalized (supporter keys); fixtures purge deletes residue
invites before leaderships; stale leader-phone tests updated to the
lockdown model; 'sem Praça' copy renamed to 'sem município'
2026-07-23 22:25:18 -03:00
Francisco Ignácio Fontoura Solla
28647e4760
Add Post and Tag collections for news and publications
...
- Add Post + Tag collections (notícias/publicações) with tag-based
"Esconder" visibility control for electoral-law compliance
- Add static SEO routes /[type]/[category]/[slug] plus /[type] and
/[type]/[category] listings, with shared header/breadcrumb and PostCard
- Recreate the homepage and refresh the site color palette (styles.css)
- Add posts/slug/seo utilities and revalidation wiring (documents.ts)
- Add live-fetch seed script (scripts/seed-posts.mjs + seed-loader.mjs,
db:seed:posts)
- Upgrade Payload 3.79.0 -> 3.82.0 (fixes admin relationship-filter crash)
- Remove obsolete Header component; add shadcn card/badge/breadcrumb;
update AGENTS.md and components rule docs
2026-07-15 19:12:11 -03:00
