Phillip Tarrant
9a8506970c
Head Hen CMS end-to-end: dashboard lists all posts (drafts + published), Markdown editor with live preview + drag-drop image upload, Pillow media pipeline re-encoding every upload to JPEG, post CRUD + publish toggle + hard delete, About page edit, and double-submit CSRF cookie enforced on every admin mutating endpoint (Phase 3's TODO markers resolved). Slug auto-generated on create and server-locked once a post has been published. Unpublish preserves `published_at` so re-publish keeps original date ordering. Every admin write invalidates the read-side Post/Page TTL caches and records an `auth_events` audit row. CSRF middleware is narrow by design — issues/refreshes the `cb_csrf` cookie only on `GET /admin*`, and mutating endpoints opt in via `require_csrf_form` or `require_csrf_header` Depends. Public routes, healthz, and pre-auth login stay untouched. 64 new tests cover slugs, CSRF, media, admin posts/pages services, and end-to-end CMS routes. Tests never mock the DB — real temp SQLite files per the CLAUDE.md mandate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Documentation Folder
This folder contains business planning, architecture decisions, and documentation.
No application code belongs here.
Contents
| Document | Purpose |
|---|---|
ROADMAP.md |
Phased build plan, data model (dataclasses), SQL schema, visual design, env-var contract |
code_guidelines.md |
Generic Python coding standards (FastAPI overrides its Flask default for this project) |
security.md |
Python security baseline (OWASP-aligned) |
MANUAL_TESTING.md (added in Phase 1) |
Manual test checklist for the public site + admin |
Related Docs (in repo root)
| Document | Purpose |
|---|---|
../CLAUDE.md |
Project instructions — stack, topology, security must-haves, git flow |
Guidelines
- Keep documents focused and concise.
- Update docs when architecture decisions change.
- Use markdown tables for structured information.
- Link to external documentation where relevant.