Issue 6: Implement Templates, Menus, Widgets, Media/Gallery, Multilingual, Theme Mode, and Ads #542

Parent Epic: #536
Depends on: #537, #538, #539, #540

Objective

Add advanced presentation and monetization features for the blog_content module without rebuilding the base media library or introducing unrelated systems.

Context

This issue extends the core blog/content module into a more complete CMS experience inspired by EmDash-style content management, while remaining native to AWCMS-Mini architecture. These features should be implemented after core posts, pages, public routes, and search are stable.

Scope

• Template configuration
• Public menu management
• Widget positioning system
• Gallery/media integration
• Multilingual content support
• Dark/light theme mode configuration
• Advertisement management
• Advertisement placement in widgets, posts, pages, and global layout areas
• Advertisement scheduling and activation rules

Important Scope Control

This issue must not rebuild:

• Base media library
• Base tenant system
• Base RBAC/ABAC system
• Base audit system
• Base theme engine if already present
• Any EmDash plugin architecture

Suggested Files

src/modules/blog-content/application/template-directory.ts
src/modules/blog-content/application/widget-directory.ts
src/modules/blog-content/application/menu-directory.ts
src/modules/blog-content/application/media-directory.ts
src/modules/blog-content/application/ads-directory.ts
src/modules/blog-content/domain/template-policy.ts
src/modules/blog-content/domain/widget-policy.ts
src/modules/blog-content/domain/menu-policy.ts
src/modules/blog-content/domain/ad-policy.ts
sql/NNN_awcms_mini_blog_content_presentation_schema.sql
tests/integration/blog-content-presentation.integration.test.ts

Suggested Database Additions

Create a separate migration for advanced presentation features:

awcms_mini_blog_templates
awcms_mini_blog_menus
awcms_mini_blog_menu_items
awcms_mini_blog_widgets
awcms_mini_blog_widget_placements
awcms_mini_blog_gallery_items
awcms_mini_blog_ads
awcms_mini_blog_ad_placements
awcms_mini_blog_localized_content
awcms_mini_blog_theme_settings

Use tenant-scoped RLS where applicable.

Suggested Routes

GET    /api/v1/blog/templates
POST   /api/v1/blog/templates
PATCH  /api/v1/blog/templates/{id}
DELETE /api/v1/blog/templates/{id}

GET    /api/v1/blog/menus
POST   /api/v1/blog/menus
PATCH  /api/v1/blog/menus/{id}
DELETE /api/v1/blog/menus/{id}

GET    /api/v1/blog/widgets
POST   /api/v1/blog/widgets
PATCH  /api/v1/blog/widgets/{id}
DELETE /api/v1/blog/widgets/{id}

GET    /api/v1/blog/ads
POST   /api/v1/blog/ads
PATCH  /api/v1/blog/ads/{id}
DELETE /api/v1/blog/ads/{id}

Data and Behavior Requirements

Templates

• Support layout configuration.
• Store tenant-scoped template settings.
• Do not execute arbitrary scripts.
• Template rendering must stay within safe predefined layout rules.

Menus

• Support hierarchical navigation.
• Menu items can reference internal blog content or safe external URLs.
• Unsafe URLs must be rejected.

Widgets

• Support positions such as:
  • header
  • sidebar
  • footer
  • content_before
  • content_after
• Widget content must be safely rendered.
• Widget visibility must respect tenant isolation.

Media/Gallery

• Integrate with existing media/file capability where available.
• Do not rebuild the base media library.
• Support image and video gallery display.
• Validate allowed file/media references.

Multilingual Content

• Support locale-based content storage and retrieval.
• Align admin UI strings with existing .po usage.
• Content slug uniqueness must remain tenant + locale aware.

Theme Mode

• Support dark/light configuration at schema and rendering level.
• Respect existing theme/design-token approach if present.

Advertisement Management

• Support advertisement records.
• Support placement targeting:
  • global
  • widget
  • post
  • page
• Support active/inactive lifecycle.
• Support scheduling by start/end datetime.
• Rendering must respect tenant isolation.
• Rendering must respect schedule and active status.
• Unsafe scripts or embeds must not be rendered.

Security Requirements

• All admin routes require authenticated session.
• All admin routes require tenant context.
• All admin routes enforce RBAC/ABAC default deny.
• Tenant-scoped tables must enable and force RLS.
• Unsafe scripts, inline JavaScript, dangerous iframe/embed content, and unsafe URLs must be rejected or stripped.
• High-risk changes should write audit events.
• Advertisement rendering must not become an XSS channel.

Acceptance Criteria

• Template system supports layout configuration.
• Menu system supports hierarchical navigation.
• Widget system supports header/sidebar/footer/content positions.
• Media/gallery integrates with existing file/media capability.
• Image gallery display works publicly.
• Video gallery display works publicly where supported.
• Multilingual content is stored and retrieved per locale.
• Admin UI strings follow existing .po pattern where applicable.
• Theme mode supports dark/light configuration.
• Advertisement supports placement targeting: global, widget, post, and page.
• Advertisement supports scheduling.
• Advertisement supports active/inactive lifecycle.
• Advertisement rendering respects tenant isolation.
• Advertisement rendering respects schedule and visibility rules.
• No unsafe script/embed content is rendered.
• OpenAPI is updated.
• Tests cover templates.
• Tests cover menus.
• Tests cover widgets.
• Tests cover gallery/media integration.
• Tests cover multilingual content.
• Tests cover theme mode.
• Tests cover advertisement placement and scheduling.
• Tests cover RLS and ABAC.

Validation Commands

bun run db:migrate
bun run api:spec:check
bun run test
bun run typecheck
bun run build