MishkaCmsCore.Runtime.Resources.Validations.CodeChange (Mishka CMS Core v0.0.1)

Copy Markdown View Source

Refuses code written by hand when this deployment has turned it off, and Elixir from a write that names no actor.

Who may write a document, its code included, is the resource's policy: the document's own runtime area or admin:<surface>:code. What this enforces at the action boundary is the deployment switch of MishkaCmsCore.Runtime.PageBuilder.CodeAccess — config :mishka_cms_core, :page_code, :off stops code the server runs for everybody, master included. A form, the admin JSON:API, a script and the builder all pass through here.

What counts as code

  • Elixir — events, infos and helpers, whichever the resource declares. Code has to APPEAR to count: a create sets these to [], and removing code is always allowed.
  • HEEx typed by hand — template, root_layout_template, and each template of an error page's error_pages entries. A template that changed counts, except an empty document's starter markup (MishkaCmsCore.Runtime.PageBuilder.PageStarter.blank/1).

Who is writing, read from the changeset context

  • page_code: :package — a package installing what it ships (a UI kit, starter content, an extension's sample pages, the dev generator). Nothing is checked.
  • page_code: :publish — a draft being published onto its live record. Nothing is checked: the draft was checked when it was written.
  • page_code: :fork — the builder writing a draft: its source's Elixir, copied unchanged, and the template the builder generated. Nothing is checked.
  • page_code: :builder — the builder writing the template it generated from its tree. The template is not typed; Elixir still counts.
  • page_code: :copy — a record copied whole. Its template is not typed; Elixir still counts.

A write with no actor is the system's own — a seed, a fixture, a background job. Its templates are let through, and its Elixir is refused.