Epic: Add blog_content Module for Blog Management in AWCMS-Mini #536

Context

AWCMS-Mini already provides the base platform capabilities: Bun runtime, Astro 7, PostgreSQL, modular monolith architecture, tenant-aware design, RBAC/ABAC, PostgreSQL RLS, audit logging, OpenAPI/AsyncAPI contracts, admin shell, and production-oriented deployment.

This Epic adds a new derived module named blog_content for blog and content management. EmDash is used only as UX and feature inspiration. Do not import EmDash, do not add its plugin system, and do not introduce Node/npm/pnpm/yarn workflows.

Objective

Build a tenant-scoped blog/content management module for AWCMS-Mini that supports:

• Blog posts
• Static pages
• Draft, review, scheduled, published, and archived lifecycle
• Categories and tags
• Revision history
• Scheduled publishing
• PostgreSQL full-text search
• Public blog routes
• RSS feed
• Blog sitemap
• SEO metadata
• RBAC/ABAC enforcement
• PostgreSQL RLS
• Audit logging
• OpenAPI and AsyncAPI updates
• Admin UI using existing AWCMS-Mini admin shell
• Optional presentation extensions: templates, menus, widgets, media/gallery, multilingual content, dark/light mode, and advertisement placements

Scope

In Scope

• New blog_content module descriptor
• PostgreSQL schema and migrations
• Permission seed migration
• Tenant-scoped RLS policies
• Admin APIs for blog management
• Public read routes for published content
• Search, RSS, sitemap, and SEO metadata
• Revision history and scheduled publishing
• Admin UI screens
• OpenAPI and AsyncAPI contract updates
• Unit, integration, RLS, API, and build tests
• Documentation updates

Out of Scope

• Importing EmDash as a dependency
• EmDash plugin system
• Dynamic schema builder
• WordPress import wizard
• Comment system
• Public user registration
• AI writing assistant
• Full media library rebuild
• Rebuilding auth, tenant, RBAC, ABAC, audit, sync, or admin shell base features
• Adding npm, pnpm, yarn, or Node.js runtime workflow

Child Issues

• Issue 1: Scaffold blog_content Module and Core Database Foundation #537
• Issue 2: Implement Blog Post Admin API and Lifecycle Actions #538
• Issue 3: Implement Pages, Taxonomies, and PostgreSQL Search #539
• Issue 4: Implement Public Blog Routes, RSS, Sitemap, and SEO #540
• Issue 5: Implement Revisions and Scheduled Publishing #541
• Issue 6: Implement Templates, Menus, Widgets, Media/Gallery, Multilingual, Theme Mode, and Ads #542
• Issue 7: Implement Admin UI, Documentation, and Final Hardening for blog_content #543

Recommended Implementation Order

1. Issue 1: Scaffold blog_content Module and Core Database Foundation #537 — Scaffold blog_content Module and Core Database Foundation
2. Issue 2: Implement Blog Post Admin API and Lifecycle Actions #538 — Implement Blog Post Admin API and Lifecycle Actions
3. Issue 3: Implement Pages, Taxonomies, and PostgreSQL Search #539 — Implement Pages, Taxonomies, and PostgreSQL Search
4. Issue 4: Implement Public Blog Routes, RSS, Sitemap, and SEO #540 — Implement Public Blog Routes, RSS, Sitemap, and SEO
5. Issue 5: Implement Revisions and Scheduled Publishing #541 — Implement Revisions and Scheduled Publishing
6. Issue 6: Implement Templates, Menus, Widgets, Media/Gallery, Multilingual, Theme Mode, and Ads #542 — Implement Templates, Menus, Widgets, Media/Gallery, Multilingual, Theme Mode, and Ads
7. Issue 7: Implement Admin UI, Documentation, and Final Hardening for blog_content #543 — Implement Admin UI, Documentation, and Final Hardening

Global Acceptance Criteria

Architecture

• blog_content module exists under src/modules/blog-content.
• Module descriptor key is blog_content.
• Module version starts at 0.1.0.
• Module status is experimental.
• No duplicate auth, tenant, RBAC, ABAC, audit, sync, or admin shell system is introduced.
• No EmDash dependency is added.
• No npm, pnpm, yarn, or Node.js workflow is introduced.

Database and Security

• All blog tables are created via numbered SQL migrations.
• Tenant-scoped tables include tenant_id.
• Tenant-scoped tables use ENABLE ROW LEVEL SECURITY.
• Tenant-scoped tables use FORCE ROW LEVEL SECURITY.
• Tenant isolation policies are implemented.
• Least-privilege grants are applied to awcms_mini_app.
• Slug uniqueness is enforced per tenant and locale where applicable.
• Soft delete fields exist where deletion is supported.
• High-risk mutations require idempotency.
• High-risk actions write audit events.
• Public content queries never leak draft, review, scheduled-future, archived, private, unlisted, or deleted content.
• Rendering rejects or sanitizes unsafe content.

API and Events

• Admin API uses existing session/auth pattern.
• Tenant context is enforced.
• RBAC/ABAC default-deny behavior is enforced.
• OpenAPI is updated.
• AsyncAPI is updated for meaningful blog events.
• Error responses do not expose stack traces or secrets.

UI

• Admin UI uses existing AWCMS-Mini admin shell.
• Astro + vanilla JS pattern is preserved.
• No new frontend framework is added.
• Loading, empty, error, and ready states exist.
• High-risk actions require explicit confirmation.
• Double-submit is prevented.
• UI follows accessibility-aware labels, focus states, contrast, and keyboard navigation.

Testing

Before closing this Epic, these commands must pass:

bun run db:migrate
bun run api:spec:check
bun run typecheck
bun run test
bun run build
bun run check
bun run production:preflight

Risks and Mitigations

Risk: Scope becomes too large

Mitigation: implement through child issues and review each PR independently.

Risk: Public routes leak non-public content

Mitigation: centralize public visibility predicate and cover it with tests.

Risk: XSS from rich content

Mitigation: store structured JSON as source of truth, validate content blocks, sanitize rendering, and reject script tags, inline JavaScript, unsafe iframe/embed content, and unsafe URLs.

Risk: RLS is incomplete

Mitigation: every migration must include ENABLE ROW LEVEL SECURITY, FORCE ROW LEVEL SECURITY, tenant isolation policy, and integration tests.

Risk: Rebuilding base systems

Mitigation: reuse existing AWCMS-Mini identity, access, audit, idempotency, event, response, and admin shell patterns.