Merge commit '685592362aa6f53e981f9b4801d9a2e8ca318605'

cms/core/HANDOVER.md

@@ -12,7 +12,8 @@
   `api/src/plugin-manager.js`, `api/src/plugins/dialog/index.js` + their tests.
 - **Run tests:** `cd api && npm install && node --test` → **44 green**. `node_modules`
   is git-ignored; the fresh clone needs `npm install` once.
-- **Immediate next action:** stage 5 + 5.5 **DONE** on the branch (commits `c4230a4`
+- **Status:** stages 1–9 DONE (6 = full schema-driven editor; 9 = kgva on core, DB-less, staged-verified, repo pushed). openbureau runs on core (dev CT 134); kgva LIVE site still static (unchanged) with the CMS dormant in-repo. **Remaining: deliberate cutovers** — (a) redeploy openbureau with the schema editor after Karim eyeballs it; (b) provision the kgva-core CMS container + Caddy switch (his call, repoints a live domain). Original stage-5 note kept below for history.
+- **Immediate next action (historic):** stage 5 + 5.5 **DONE** on the branch (commits `c4230a4`
   cutover, `5e06337` DDL, `a93d11a` migration runner). Plugin-manager singleton
   (`api/src/plugins.js`) wired into `index.js`/`stats.js`/`publish.js`, hard-coded
   dialog removed, source moved under `api/src/plugins/dialog/`; DDL captured into
@@ -125,19 +126,46 @@ openbureau's extras become plugins (first: `dialog`); kgva enables none.
    `pg` against `DATABASE_URL`, warning-and-skipping if unset. Needs `DATABASE_URL`
    wired into the cms service env for openbureau (stage 8). Tested: migrate.test.js +
    tracking SQL proven on the live dev Postgres (throwaway DB).
-6. admin: `/api/schema` + App.jsx renders from schema (must reproduce openbureau's
-   editor 1:1 when fed `openbureau.config.js`).
-7. **auth provider** (`config.auth` = `supabase` | `local`). Verify is already local
-   (HS256/JWT_SECRET in auth.js). Add a `local` provider: file-based users (bcrypt) +
-   self-signed JWTs of the SAME claim shape (sub/email/app_metadata.role/exp), and a
-   `/login` route to replace GoTrue; admin login (`admin/src/supabase.js`) calls it
-   instead of `signInWithPassword`; users.js CRUD edits the user file. Goal: a
-   dialog-less core runs Node+Hugo+nginx, **no Supabase/Postgres** (~80 MB). openbureau
-   stays `supabase`. Independent of the cutover — `supabase` is the default no-op.
-8. cut openbureau over to consume core (= core + `dialog` plugin + `supabase` auth +
-   its config) — test login / list / edit / preview / publish / dialog — identical.
-9. onboard kgva (`CMS_CONFIG=…/kgva.config.js`, `auth: 'local'`, no plugins) as the
-   2nd consumer — DB-less.
+6. [DONE, commits f709b5d + f8f4131 + 59b9e20] schema-driven admin. `GET /api/schema`
+   + `GET /api/system` + a System panel; AND the editor now renders sidebar groups +
+   fields from the site's collections (admin/src/fields.jsx: per-type controls
+   string/text/slug/number/date/bool/select/list/image/color/markdown; form↔frontmatter
+   + path building). One admin serves any site. Unknown frontmatter is PRESERVED on
+   save (__raw) — no data loss. Verified working via kgva (stage 9). NOTE: openbureau
+   is NOT yet redeployed with the schema editor (its running image keeps the bespoke
+   one); when it is, its config field types (color→swatch, layout opts) are already
+   tuned. Visual review of the openbureau editor by Karim still recommended before
+   redeploying it.
+7. [DONE, commit 86f9f57] **auth provider** (`config.auth` = `supabase` | `local`).
+   `api/src/auth-local.js` = file-based users (bcryptjs) + self-signed HS256 JWTs of
+   the SAME claim shape; `routes/auth.js` POST /api/auth/login (mounted only when
+   auth:local); supabase.js made null-safe (fail-fast moved to index.js); auth/stats/
+   users.js branch local↔GoTrue; admin supabase.js gains a local-auth SHIM (same
+   interface) when VITE_SUPABASE_URL is absent → App/api untouched, supabase path
+   byte-identical. examples/kgva.config.js → auth:'local'. Verified: 59 tests +
+   DB-less boot smoke (no Supabase: local login → /api/me admin → stats-from-file)
+   + openbureau redeployed and confirmed unregressed (auth=supabase).
+8. [DONE, OB main 3d902a0] openbureau consumes core. Mechanism: **git subtree** at
+   `OPENBUREAU/cms/core` (fits the pull-based deploy; update via
+   `git subtree pull --prefix=cms/core <core> main --squash`). docker-compose builds
+   the cms image from `./core`; `cms/openbureau.config.js` (CMS_CONFIG) carries the
+   content model; old vendored cms/api+cms/admin removed. DATABASE_URL left unset (the
+   stack's migrate service owns db/schema.sql incl. dialog). Deployed to dev CT 134
+   and FULL write-verified: login/list/edit/preview/publish/dialog all identical, no
+   git divergence (GIT_PUBLISH=false). Rollback image `cms-cms:rollback` kept.
+9. [DONE (repo + staged verify); live cutover PENDING] kgva consumes core. In
+   `karim/kgva` (git.kgva.ch, main 51a94b8): `cms/core` = core subtree, `cms/kgva.config.js`
+   (project/page/section, auth:'local', no plugins), `docker-compose.yml` builds the core
+   image (Hugo 0.163.3, no VITE_SUPABASE_URL → local-auth admin), `cms/seed-admin.mjs`,
+   updated deploy/provision-lxc.sh + ADMIN.md. VERIFIED DB-less end-to-end on real content
+   (staged on CT134): local login → schema editor → 42 entries (de/en) → stats →
+   create/preview/cleanup; image galleries preserved. The LIVE site is UNCHANGED — CT130
+   still deploys statically (timer → `hugo` → nginx; hugo ignores cms/); the CMS is dormant.
+   PENDING (deliberate, his call — repoints a live domain): provision a kgva-core container
+   (deploy/provision-lxc.sh, free CTID + temp IP) and decide topology — CMS serves the site
+   (Caddy → it) OR CMS edits + GIT_PUBLISH=true commits to git and the CT130 static timer
+   keeps serving. Then Caddy cutover per deploy/README. openbureau also not yet redeployed
+   with the schema editor (stage 6 note).
 
 ## How to run / test
 openbureau CMS stack: `OPENBUREAU/cms/docker-compose.yml` (Node api + Hugo +