fix(demo): refuse publishing the homepage hero (DM21) #225

wtclaude · 2026-10-26T09:35:24-05:00

wtclaude commented

2026-10-26 09:35:24 -05:00

Demo-plan amendment (website#222), DM21, decided by the org lead 2026-10-26.

Problem. Settings stay open on the demo (DM2), so Admin → Hero's Publish wrote hero_layout, which changes the homepage hero every visitor sees.

Change. hero_layout joins PROTECTED_SETTINGS in server/src/demo/locks.js. A PUT /admin/settings that names it gets 403 DEMO_LOCKED with keys: ['hero_layout'].

Draft autosave and Preview write only hero_layout_draft, so they still work.
Image uploads in the editor were already refused by the multipart lock.
Server lock only (DM10, as chosen). No client change: the editor's status line and the toast already show "This is turned off on the demo site."

Tests. A new row in test/demoLocks.test.js checks that a draft-only body goes through and that a publish body is refused with the key named. The full server suite passes locally: 2214 passed, 0 failed (MODULES_DIR pointed at an empty path, as usual). The PUT /admin/settings route is unchanged, so there's no swagger change.

Docs: docs PR on branch fix/demo-hero-publish-lock (DEMO_MODE.md §3.3 + DM21, BACKEND_DESIGN.md).

AI-assisted: Claude Code (Claude Opus 5.5)

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

Demo-plan amendment (website#222), DM21, decided by the org lead 2026-10-26. **Problem.** Settings stay open on the demo (DM2), so Admin → Hero's **Publish** wrote `hero_layout`, which changes the homepage hero every visitor sees. **Change.** `hero_layout` joins `PROTECTED_SETTINGS` in `server/src/demo/locks.js`. A `PUT /admin/settings` that names it gets `403 DEMO_LOCKED` with `keys: ['hero_layout']`. - Draft autosave and **Preview** write only `hero_layout_draft`, so they still work. - Image uploads in the editor were already refused by the multipart lock. - Server lock only (DM10, as chosen). No client change: the editor's status line and the toast already show "This is turned off on the demo site." **Tests.** A new row in `test/demoLocks.test.js` checks that a draft-only body goes through and that a publish body is refused with the key named. The full server suite passes locally: 2214 passed, 0 failed (`MODULES_DIR` pointed at an empty path, as usual). The `PUT /admin/settings` route is unchanged, so there's no swagger change. Docs: docs PR on branch `fix/demo-hero-publish-lock` (DEMO_MODE.md §3.3 + DM21, BACKEND_DESIGN.md). - [x] AI-assisted: Claude Code (Claude Opus 5.5) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-10-26 09:35:26 -05:00

fix(demo): refuse publishing the homepage hero (DM21)

PR Checks / bot-tests (pull_request) Successful in 47s

Details

PR Checks / client-build (pull_request) Successful in 54s

Details

PR Checks / server-tests (pull_request) Successful in 12m42s

Details

c87563bc32

Settings stay open on the demo (DM2), so the hero editor's Publish wrote
hero_layout, the hero every visitor sees. hero_layout joins the protected
settings keys: PUT /admin/settings naming it answers 403 DEMO_LOCKED with
keys: ['hero_layout']. The editor's draft autosave and Preview write only
hero_layout_draft and stay open; its uploads were already refused by the
multipart lock. Server lock only, as decided: the editor needs no change,
since its status line and the toast already show the demo sentence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

whitlocktech approved these changes 2026-10-26 09:40:37 -05:00

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-10-26 09:40:42 -05:00

whitlocktech merged commit c7a24a186c into main

2026-10-26 09:50:57 -05:00

whitlocktech deleted branch fix/demo-hero-publish-lock

2026-10-26 09:50:58 -05:00

whitlocktech referenced this issue from a commit

2026-10-26 09:50:58 -05:00

Merge pull request 'fix(demo): refuse publishing the homepage hero (DM21)' (#225) from fix/demo-hero-publish-lock into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#225