CMS pages override shipped routes (reserved-slug blacklist) — v0.37.0-beta#42
Merged
Conversation
…list) (v0.37.0-beta) PageDispatch was a pure 404-fallback: a published page only rendered when no controller claimed the URL, so shipped routes like the /vibe marketing alias could never be replaced by CMS content. Now a published `page` whose slug matches the request WINS — overriding a matched static route — so an admin can swap any built-in landing page for real, editable, SEO'd CMS content just by giving a page that slug. The guard is a reserved blacklist built per request from the live module list: every registered module namespace (/admin, /api, /docs, /pay, …) plus the core default-module system controllers stay off-limits, so a page can never shadow application routes. Root `/` unchanged (IndexController serves the admin-chosen home page); unmatched slugs still 301 via page_redirect or fall to a clean 404; fail-open throughout. Verified on dev against the live DB: a page at slug `features` served over the static /features route; /vibe /agency (no page) still rendered the shipped pages; /docs /api /admin untouched; /nonexistent 404. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Tiger_Controller_Plugin_PageDispatchwas a pure 404 fallback — a publishedpageonly rendered when no controller claimed the URL. So shipped routes (the/vibe,/agency, … marketing aliases inconfigs/routes.ini) could never be replaced by CMS content.This flips it: a published
pagewhose slug matches the request now wins, overriding a matched static route. An admin can swap any built-in landing page for real, editable, SEO'd CMS content just by giving a page that slug — no code, no route edit.The guard — reserved-slug blacklist
A page may claim any slug except reserved namespaces, so it can never shadow application routes:
/admin,/api,/docs,/pay,/blog, …) — built per request from the live module list, so newly installed modules are protected automatically;admin,auth,error,install,login,logout,page).Unchanged: root
/still routes toIndexController(the admin-chosen home page); unmatched slugs still 301 viapage_redirector fall through to a clean 404; fail-open throughout (a broken lookup never takes down routing).Verified on dev (live DB)
/features(throwaway published page)/featuresroute)/vibe,/agency(no page)/docs,/api/admin/builder-test(existing page)/nonexistent-xyzNotes
/vibestays 200 (falls through to the shipped page when no CMS page exists).🤖 Generated with Claude Code