T

Angelo B. J. Luidens 1d1494a77c Stage 5: admin dashboard (Next.js App Router) + completes Stage 2.3 handlers

Operator console for the Publishing Engine — cool/forge Nine Laws temperature
(forest + citrus, amber deliberately absent).

- Auth: Authentik forward-auth header parsing (x-authentik-username / -groups ->
  roles) with a dev-stub principal (AUTH_DEV_PRINCIPAL). Pure auth-core is
  unit-tested; getPrincipal binds it to next/headers.
- API route handlers (closes Stage 2.3): /api/content, /api/approvals,
  /api/publications/cancel, /api/feature-flags. Each: Zod parse -> principal ->
  role authz (requireAllowed) -> DB write + append-only audit. handleMutation
  maps errors to 401/403/404/409/422/500 with a correlation id.
- Pages (force-dynamic, DB-backed): /queue (approve/cancel), /publications/[id]
  (detail + metrics), /metrics (AST day x hour heatmap with text+color per WCAG
  1.4.1), /auth/linkedin (OAuth status + per-outlet kill-switch toggle).
- A11y: semantic landmarks, skip-link, scoped table headers, aria-live error
  alerts, heatmap text redundancy.
- Tests: 10 pure (auth-core, heatmap) + 5 gated handler-integration (authz tiers
  + happy paths vs real Postgres). Strict tsc + next build (standalone) green.

Deferred (need a browser/IdP runner): live Authentik binding, axe-core/Playwright
+ NVDA CI, Lighthouse gates (Stage 5.3/5.4).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 15:30:16 -04:00