Manage navigation, announcements, sponsors, redirects, and safe site settings

[alexeygrigorev]

Parent epic: #7

Normative specs: 01 — Data ownership, 06 — Studio sections

Scope

Implement database-owned versioned navigation overrides, announcements, sponsors, explicit redirect/retirement manifest records, SEO exceptions, and typed safe operational site settings through shared services with Studio/admin API CRUD/preview/publish/archive, revision/idempotency, permissions, audit, and cache invalidation. Clearly distinguish GitHub-owned content fields and bootstrap-only secret configuration.

Non-goals

No arbitrary template/HTML/script injection, secret editing/export, GitHub editorial override, unreviewed redirect, or settings that require DB availability before bootstrap.

Acceptance criteria

• Each setting/content type has schema, validation, ownership, default/source badge, lifecycle, and cache behavior.
• Redirect/410 records require exact source/destination/status/reason/owner/test and reject loops/chains/homepage catch-all.
• Announcement/navigation/sponsor output is accessible and cannot introduce unsafe URLs/markup or break legacy links.
• Studio/API parity and role/field permissions, stale edits, publish/archive, audit/redaction, and rollback pass.
• Security-critical bootstrap values remain environment/Secrets Manager only.

Test scenarios

1. Valid/invalid navigation tree, duplicate order/path, unsafe link/HTML, announcement schedule/timezone, sponsor lifecycle.
2. Redirect loop/chain/case/query/fragment/unknown, stale/replayed publish, cache invalidation and rollback.
3. Attempt to edit/export secret or GitHub-owned field is denied.

Playwright

Manage and preview/publish each type in Studio; verify public desktop/mobile navigation/announcement/sponsor and explicit redirect; test empty/error/stale/denied states and screenshots.

Dependencies

Depends on #31–#35. Redirect behavior depends on cutover scope #29.

[alexeygrigorev]

Product-owner API parity decision

Implement safe site settings with the same operator pattern proven in AI Shipping Labs, adapted to this repository's stronger shared primitives:

• A code-owned, typed allowlist/registry is the single source of truth for key, group, label, description, type, default, validation, docs link, lifecycle, cache behavior, and sensitivity.
• Studio exposes these settings to humans; /api/v1/admin/settings exposes the same query and command capabilities to scoped Bearer credentials.
• Both adapters call core.configuration services and create the same immutable revision and redacted audit event. No duplicated write logic is allowed.
• GET returns registry metadata plus safe resolved non-secret values/source/revision. Secret/bootstrap settings are never database-backed or returned; only a safe configured/source indicator may be exposed where needed.
• Writes are allowlisted, typed, transactional, compare-and-swap (If-Match/revision), idempotent, rate-limited, audited, and reject unknown keys or partial batches.
• Cache invalidation must work across web and worker processes; the next read observes an accepted change without a restart.
• Environment/Secrets Manager retains bootstrap and secret values. The API cannot edit/export arbitrary Django settings, environment variables, GitHub-owned editorial fields, templates, HTML, or scripts.
• OpenAPI and parity checks enumerate the Studio/API surfaces and fail CI when a registered setting lacks validation, permissions, docs, tests, or both adapters.

Reference implementation inspected in ../ai-shipping-labs: integrations/settings_registry.py, integrations/config.py, studio/views/settings.py, and api/views/integration_settings.py. Copy/adapt the pattern; do not copy its legacy plaintext-secret export behavior.

[alexeygrigorev]

Tracked the first end-to-end registry/Studio/admin-API implementation slice as #114. It includes safe announcement settings so the adapter is exercised by a real public consumer; the remaining navigation, sponsor, redirect, and SEO-exception CRUD stays in this parent epic.