WingCMS v1 — admin UI status vs Gronktayvius's MUST-FIX gate¶
Built: /Admin editor (Razor Pages + forms) over the Content/site-content.json seam.
Scope of v1 is deliberately narrower than wingcms-design.md: no MCP server, no CLI,
no git-from-runtime publish, no SPA composition. That narrowing is what closes most of
the red-team gate rather than deferring it.
| MUST-FIX | Status in v1 |
|---|---|
| RT-08/RT-38 SPA bundles not content-authorable; hash-pinned manifest + CSP | Closed by scope — no SPA/bundle fields exist in the content model; nothing content-authored becomes a script URL. CSP on /Admin is script-src 'self', no inline script. |
| RT-01/RT-02/RT-37 real machine auth, server-derived identity, authorize in the service | Partly closed — cookie auth with AuthorizeFolder("/Admin"), fail-closed when WINGCMS_ADMIN_KEY is unset. No machine principals exist yet because there is no MCP/CLI surface. A real IdP (OIDC) is still the v2 requirement before multiple named editors. |
RT-20/RT-21 no privileged git push from the request path |
Closed by scope — the editor writes one JSON file and staged images; the process holds no git or deploy credentials. |
| RT-33/RT-15/RT-34 split agent read vs write/publish; human gate; content untrusted | Closed for v1 — no agent write path exists. Content is rendered as data everywhere (no Html.Raw), so stored copy cannot act as markup or instructions. |
| RT-29/RT-32 ETag on all writes; draft vs live | ETag: closed (SHA-256 of file bytes, stale writes rejected). Draft-vs-live: open — v1 publishes on save; acceptable while the editor is a small trusted group, required before wider access. |
| RT-04/RT-09/RT-25/RT-26 CSRF + cookie flags; URL scheme allowlists; re-encode images; server-owned paths | Closed except image re-encode — antiforgery on every POST; HttpOnly/SameSite=Strict/Secure-in-prod; hrefs restricted to relative paths and photos to /img/... by validation; upload paths are server-derived and the client cannot supply a photo path. Images are magic-byte checked and size-capped but not re-encoded — remaining risk is a polyglot/malformed image, mitigated by nosniff on all responses. |
| RT-05 role x section x action matrix incl. agent principals | Open — v1 has a single editor role over all sections. Needed when non-technical editors get scoped access (e.g. Nick edits partnerships copy only). |
Carried into the v2 ticket¶
- OIDC / per-person identity, then the role x section matrix (RT-05, rest of RT-01/02).
- Draft vs live with an explicit promote step (RT-32).
- Server-side image re-encode on upload (RT-26).
- MCP + CLI surfaces — each re-opens RT-01/RT-15/RT-16/RT-20/RT-33 and must be gated again before being built.