- Add a Save as draft button that bypasses the completeness gate: the user
can save partial work and finish later
- projectDraftInputSchema makes the user-facing copy (title, summary, service
label, client) optional; the action auto-generates a slug from the title
(or draft-<timestamp>), defaults the year to the current year, and forces
the project unpublished
- Drafts drop not-yet-valid sections/assets instead of failing the save
- Pass intent via a hidden field set on click so the server reliably sees it
- Tests: draft schema accepts empty copy a strict save rejects, and still
requires a slug and a valid year
- Fix critical bug: TabsContent unmounted inactive panels, so the project
form only submitted the active tab's fields and could never save; add an
opt-in forceMount that keeps panels mounted (hidden) and use it on all
four project-form tabs
- Make Sections and Assets optional: a project saves with just Basics and
Localized Content; new projects start with no sections/assets, and the
last one can now be removed
- Update wizard progress so empty sections/assets steps count as complete
- Update save hint copy and step labels to reflect the optional steps
- Correct .claude/launch.json dev port to 3014
- Update portfolio-form-progress tests for the optional-steps behaviour
- Move admin login lockout from client cookie to AppConfig (DB), keyed
by hashed client IP — clearing browser cookies no longer bypasses it
- Replace rate-limit $transaction (TOCTOU) with atomic SQL
INSERT...ON CONFLICT...RETURNING; add stale-entry cleanup on each
submission to prevent table bloat
- Add 5 s module-level cache for middleware runtime state fetch, reducing
per-request DB roundtrips
- Rename middleware.ts → proxy.ts to resolve Next.js 16 deprecation
warning; update test import accordingly
- Require ADMIN_PASSWORD, ADMIN_AUTH_SECRET, ADMIN_BASIC_AUTH_USER, and
ADMIN_BASIC_AUTH_PASS in docker-compose.yml (:? syntax) — startup
fails loudly instead of using placeholder defaults
- Add set -e and informative echo lines to Dockerfile CMD for clearer
startup failure attribution
- Export requireAdminAuth() from lib/admin-auth for centralised use in
admin pages
- Add CLAUDE.md with architecture notes and working rules
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
moh