[Spike] Velocity Playground: consolidated audit — current state, backend API, target UI sketch

[hmoreras]

Goal

Consolidated audit of the current Velocity Playground portlet that produces every input the FE implementation will need: feature parity, backend API contract, target UI sketch, and security findings.

Deliverables

Post the four artifacts below as a comment on this issue, then back-link a one-line summary on epic #34737.

1. Feature parity matrix

Table of every feature in dotCMS/src/main/webapp/WEB-INF/jsp/velocity_playground/render.jsp with classification (Keep / Drop / Defer) and a short note explaining why. Cover at minimum:

• Ace editor with Velocity mode (target: Monaco)
• Split-pane layout with draggable separator
• "Wrap Code" toggle
• History dropdown (last 10 entries persisted in localStorage under key velocityPlayground)
• Auto-wrapped timing helper (#set($dotTimer = $date.date.time) prefix + $math.sub(...)ms suffix)
• Output rendering for JSON, XML, and plain text content types
• Spinner during execution

2. Backend API audit

Table for POST /api/vtl/dynamic/ covering:

Aspect	Finding
Route
Auth gates (license, role)
Request body (raw Velocity vs JSON-wrapped velocity property)
Accepted Content-Type and Accept values
OpenAPI presence
Response shape per output type (JSON / XML / text)
Known gaps

3. Target UI sketch

Annotated screenshot or low-fi mockup of the target Angular layout — split-pane with Monaco editor on the left, output panel on the right, run control + history affordance + output content-type indicator.

4. Security findings

If the API audit surfaces a license or role gating gap (e.g. /api/vtl/dynamic/ callable without STANDARD+ license or without admin role), file a separate [Task] security issue immediately and link it from epic #34737.

Inputs

• JSP: dotCMS/src/main/webapp/WEB-INF/jsp/velocity_playground/render.jsp
• Backend: com.dotcms.rest.api.v1.vtl.VTLResource#dynamicPost (POST /api/vtl/dynamic/)
• Portlet registration: dotCMS/src/main/webapp/WEB-INF/portlet.xml (entry velocity_playground)
• i18n keys: com.dotcms.repackage.javax.portlet.title.velocity_playground / ...velocity in dotCMS/src/main/webapp/WEB-INF/messages/Language.properties

Definition of Done

• Parity matrix + API audit + UI sketch posted as a comment on this issue
• Any discovered security gap filed as a separate issue and linked on epic Dojo to Angular: Velocity Playground Portlet #34737
• Summary comment cross-posted on epic Dojo to Angular: Velocity Playground Portlet #34737