Tracker: Post-session review findings + commit plan (2026-05-27)

[tayebmokni]

Context

A long admin-sweep session (2026-05-27) found and partially fixed dozens of bugs while signing in as `admin@dextra.com` and walking every admin page. A subsequent multi-agent code review found regressions in the work itself plus a deeper architectural gap (the public site at `apps/web` is a hardcoded marketing landing — not driven by admin config).

This tracker organizes the follow-up work. Do REVERTs first; the regressions are security-sensitive.

REVERT first

• REGRESSION: OptionalSession in global middleware defeats if !ok auth gates #495 — SECURITY: OptionalSession in global middleware defeats `if !ok` auth gates
• Strip `ignoreBuildErrors` + `ignoreDuringBuilds` from `apps/admin/next.config.ts` (entombs 12 TS errors)
• Ship docker-compose.override.example.yml + .gitignore the working override #517 — `docker-compose.override.yml` in .gitignore + ship `.example`

FIX-FORWARD (in order)

• REGRESSION: TOTP finalize path drops user roles → super_admin loses admin on re-login #496 — SECURITY: TOTP finalize path drops user roles
• REGRESSION: Worker Dispatch nested in storage-init success — MinIO failure disables ALL handlers #497 — Worker Dispatch nested in storage-init success
• REGRESSION: apiBaseUrl in admin api-client may bake server URL into client bundles #498 — apiBaseUrl may bake server URL into client bundles
• Mount /api/v1/settings registry — admin Settings tab is a UI mockup until this lands #499 — Mount `/api/v1/settings` registry endpoint
• Mount /api/v1/plugins lifecycle CRUD — admin Plugins page shows HTTP 404 #500 — Mount `/api/v1/plugins` lifecycle CRUD
• Mount /themes/active/style.css static handler — public site has zero theme CSS #501 — Mount `/themes/active/style.css` static handler
• BUG: /api/v1/admin/jobs/dlq returns 500 — admin DLQ page unusable #502 — `/api/v1/admin/jobs/dlq` returns 500
• BUG: /api/v1/admin/plugin-pages 500 — sidebar PluginSidebarSection breaks every render #503 — `/api/v1/admin/plugin-pages` 500 (sidebar)
• REGRESSION: comments table dead-links to deleted /posts/[id]/edit route #504 — Comments table dead-links to deleted `/posts/[id]/edit`
• BUG: nil-slice JSON in router.Page[T] — admin Client Components crash on empty lists #505 — `Page[T].MarshalJSON` nil-slice fix (one-line API fix)
• Admin Pages module is non-functional — SEED_PAGES list, console.log save, disabled editor #506 — Admin Pages module is non-functional (SEED_PAGES + console.log save)
• Dead admin routes: /posts/new, /pages/new, /posts/import, /jobs — buttons 404 on click #507 — Dead admin routes (`/posts/new`, `/pages/new`, `/posts/import`, `/jobs`)
• Wire admin Settings → public site identity (title, OG, robots, locale) #508 — Wire admin Settings → public site identity
• Wire admin Menus → public site navigation #509 — Wire admin Menus → public navigation
• Implement core.reading.show_on_front dispatch — admin static-front-page → public homepage #510 — `core.reading.show_on_front` dispatch in `apps/web/src/app/page.tsx`
• Mount /api/v1/tokens — Personal Access Token issuance #511 — Mount `/api/v1/me/tokens` (PAT issuance)
• Mount /api/v1/admin/customizer/preview and site-editor parts endpoints #512 — Customizer preview + site-editor parts endpoints
• Theme seeding must run during migrate step (not manual docker run) #513 — Theme seeding into migrate step (not manual docker run)
• Generate @gonext/api-types from existing OpenAPI spec — eliminate per-page envelope adapters #514 — Generate `@gonext/api-types` from existing OpenAPI spec
• Posts list adapter encodes fields the API doesn't emit — empty Author cells #515 — Posts list adapter encodes fields API doesn't emit (empty Author cells)
• status=any alias missing in admin/search handler — third copy of the same bug #516 — `status=any` alias missing in admin/search handler
• TypeScript debt: 12 errors silenced by ignoreBuildErrors flag in admin next.config #518 — TypeScript debt (12 silenced errors)
• Test broken: PostListClient.test.tsx asserts old /posts/[id]/edit href #519 — Test broken: PostListClient.test.tsx asserts old href
• Fix react/no-unescaped-entities ESLint errors at posts/[id]/page.tsx:237 #520 — Fix react/no-unescaped-entities at posts/[id]/page.tsx:237
• Backfill regression tests for this session's bug fixes #521 — Backfill regression tests for this session's bug fixes

Verdict on "is this a CMS yet?"

From the multi-agent review: NO. Public marketing site is fully hardcoded React. Admin Settings tab persists nothing (`/api/v1/settings` returns 404). Only the `[...slug]` post route flows admin → public.

P0 path forward in ~one week: items #495–#502 + #505–#506 = stack functions as a basic CMS.
P0+P1 in ~two weeks: + #508–#513 = admin config actually drives the public site.

"If you had ONE WEEK, ship the P0 list. If two weeks, P0+P1. Beyond that, this isn't shippable to a paying user yet."

[tayebmokni]

PR #523 landed: 13 commits covering most of this tracker's items

Branch: `feat/post-session-cleanup` → #523

Closed by this PR (13)

• ✅ REGRESSION: OptionalSession in global middleware defeats if !ok auth gates #495 OptionalSession (REVERTED in commit 1)
• ✅ REGRESSION: TOTP finalize path drops user roles → super_admin loses admin on re-login #496 TOTP role drop
• ✅ REGRESSION: Worker Dispatch nested in storage-init success — MinIO failure disables ALL handlers #497 Worker Dispatch
• ✅ REGRESSION: apiBaseUrl in admin api-client may bake server URL into client bundles #498 api-client client-bundle bake
• ✅ Mount /api/v1/settings registry — admin Settings tab is a UI mockup until this lands #499 Mount `/api/v1/settings` registry
• ✅ Mount /themes/active/style.css static handler — public site has zero theme CSS #501 Mount `/themes/{slug}/{file}` static handler
• ✅ REGRESSION: comments table dead-links to deleted /posts/[id]/edit route #504 Comments table dead links
• ✅ BUG: nil-slice JSON in router.Page[T] — admin Client Components crash on empty lists #505 `Page[T].MarshalJSON` nil coerce
• ✅ Ship docker-compose.override.example.yml + .gitignore the working override #517 docker-compose.override.example.yml + .gitignore
• ✅ TypeScript debt: 12 errors silenced by ignoreBuildErrors flag in admin next.config #518 TypeScript debt (12 silenced errors)
• ✅ Test broken: PostListClient.test.tsx asserts old /posts/[id]/edit href #519 PostListClient.test.tsx broken
• ✅ Fix react/no-unescaped-entities ESLint errors at posts/[id]/page.tsx:237 #520 react/no-unescaped-entities errors
• ✅ Partial Admin Pages module is non-functional — SEED_PAGES list, console.log save, disabled editor #506 (disabled broken pages editor button) + partial Posts list adapter encodes fields the API doesn't emit — empty Author cells #515 (envelope adapter)

Still pending in this tracker (deliberately deferred to separate PRs)

• ⏳ Mount /api/v1/plugins lifecycle CRUD — admin Plugins page shows HTTP 404 #500 Mount `/api/v1/plugins` lifecycle CRUD — significant new surface
• ⏳ BUG: /api/v1/admin/jobs/dlq returns 500 — admin DLQ page unusable #502 `/api/v1/admin/jobs/dlq` 500
• ⏳ BUG: /api/v1/admin/plugin-pages 500 — sidebar PluginSidebarSection breaks every render #503 `/api/v1/admin/plugin-pages` 500
• ⏳ Admin Pages module is non-functional — SEED_PAGES list, console.log save, disabled editor #506 Pages module is fake (full implementation)
• ⏳ Dead admin routes: /posts/new, /pages/new, /posts/import, /jobs — buttons 404 on click #507 Dead admin routes (`/posts/new` etc.)
• ⏳ Wire admin Settings → public site identity (title, OG, robots, locale) #508 Wire admin Settings → public site identity (blocked by Mount /api/v1/settings registry — admin Settings tab is a UI mockup until this lands #499 merging)
• ⏳ Wire admin Menus → public site navigation #509 Wire admin Menus → public navigation
• ⏳ Implement core.reading.show_on_front dispatch — admin static-front-page → public homepage #510 `core.reading.show_on_front` dispatch
• ⏳ Mount /api/v1/tokens — Personal Access Token issuance #511 Mount `/api/v1/me/tokens` (PAT)
• ⏳ Mount /api/v1/admin/customizer/preview and site-editor parts endpoints #512 Customizer preview + site-editor parts
• ⏳ Theme seeding must run during migrate step (not manual docker run) #513 Theme seeding into migrate step
• ⏳ Generate @gonext/api-types from existing OpenAPI spec — eliminate per-page envelope adapters #514 Generate `@gonext/api-types` from OpenAPI
• ⏳ Posts list adapter encodes fields the API doesn't emit — empty Author cells #515 Posts adapter empty fields (band-aid landed; real fix tracked here)
• ⏳ status=any alias missing in admin/search handler — third copy of the same bug #516 `status=any` alias in admin/search
• ⏳ Backfill regression tests for this session's bug fixes #521 Backfill regression tests

New follow-ups surfaced by PR #523 work

• 🆕 BUG: PATCH writes via /api/v1/settings, /admin/themes, /admin/customizer 500 — non-existent namespace column #524 PATCH writes 500 due to non-existent `namespace` column (affects settings + themes + customizer stores)
• 🆕 Register core.reading and core.writing setting keys #525 Register `core.reading.` + `core.writing.` keys
• 🆕 Cache active-theme resolver in /themes static handler #526 Cache active-theme resolver in /themes static handler

Verification

• 606/606 admin tests pass
• All Go test packages pass
• `pnpm exec tsc --noEmit` clean
• Live container verified: `/api/v1/settings?group=core.site` → 200; `/themes/active/style.css` → 200

🤖 PR-management automation