sass-mohfarawati/docs/DOMAIN_RULES.md

Domain Rules

Portfolio

Current implementation

• A project must belong to one category
• Categories cannot be deleted while linked projects exist
• Public portfolio pages only show published projects
• Category filters only use active categories
• Project content is localized across

ar

,

en

,

de

• Project sections and assets are ordered by

sortOrder

• Project view mode is limited to:
  • GRID
  • STORY
  • CASE_STUDY

Media

Current implementation

• Media assets are tracked separately from portfolio records
• Media usage bindings connect assets to entity fields
• Usage binding is unique by

usageType + entityType + entityId + fieldKey

• Media is currently used by:
  • portfolio cover
  • portfolio sections
  • portfolio assets
  • site settings

Contact

Current implementation

• Contact submission requires valid name, email, and message
• Turnstile is optional and controlled by settings
• Rate limiting is optional and keyed by hashed client IP plus time window
• Successful submission sends email only
• No submission record is stored in the database

Admin

Current implementation

• Admin access depends on environment configuration
• Middleware can require HTTP Basic Auth before app access
• In-app admin session is cookie-based
• Repeated failed password attempts trigger temporary lockout

Configuration

Current implementation

• Global settings are stored in

AppConfig

• Site settings, SMTP settings, contact protection, marquee settings, and maintenance mode all depend on configuration keys

Recommended Improvements

• Add explicit domain rules for future

products

,

orders

,

downloads

only after data models exist

• Introduce database retention and moderation rules for contact or inquiry submissions if they become persisted