README, the changelog and the built-in welcome page were missing the
page-lock feature and the bootstrap/LoginRateLimiter/Logger hardening
from the earlier security audit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Administrators can lock a page from the Pages list to stop editors
publishing, saving a draft, or scheduling a change to it. Administrators
are never restricted by a lock. State is stored per-page URI in the new
cms/data/pagelocks.json, following the existing pagetemplates.json
pattern: it moves with the page on rename, is cleared on delete, and is
never copied onto a duplicate.
- New lockPageAction and assertNotLockedForEditor() guard, called from
save/saveDraft/schedule.
- getPages responses gain a locked flag; the Pages list gets a Lock/
Unlock row action and a Locked badge.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Geoff MooreandClaude Sonnet 5