V1 Web PWA · Surface walkthrough

Studio Aja · Content Security

A per-surface walkthrough of the V1 Web PWA studio surface: layout, states, interactions, data, and cross-references.

walked
8sections3 minread
Markdown source
On this page

Context. surface studio · domain aja · route /studio/aja/content-security · auth signed-in + studio entitlement · source apps/oshun/web/src/app/studio/aja/content-security/page.tsx

Last walked. 2026-07-26 authority-boundary runtime coverage — unbound deploy authority, disabled mutations, responsive layout, and automated WCAG 2.1 AA scan

Purpose#

Leaf lane console for content access governance. The catalog is always available, but decisions are authoritative only when the BFF is explicitly bound to an owning deploy service that the delivery/decrypt path consumes. The default deployment is currently unbound: it reports aja_content_security_authority_not_configured, disables all controls, and returns 503 for direct mutation requests. ContentSecurityStore is retained only as an explicitly injected process-local test/development adapter.

Entry points#

  • Direct URL / bookmark — /studio/aja/content-security.
  • Studio nav — Domain-bridge studios section of /studio.
  • Embedded — appears as the Content Security Lane inside /studio/aja/asset-storage.
  • Sibling quick-actions — Content Moderation, Consent Management, Privacy Protection, Data Retention.

Layout regions#

page.tsx renders inside <ShellLayout active="studio">:

  • Breadcrumb panel (data-aja-content-security-breadcrumbs): <nav aria-label="Aja Content Security breadcrumbs"> → Studio (link) / Aja (plain text) / Content Security (aria-current="page").
  • Workspace <StudioAjaContentSecurityWorkspace />:
    • <h1> "Aja Content Security Workspace" + summary (data-aja-content-security-summary).
    • The access-control lane (states below).
  • Route Map panel (data-aja-content-security-route-map, <h2> "Route Map"): 6 STUDIO_AJA_CONTENT_SECURITY_ROUTE_MAP entries (path + purpose) — primary, scenes, exports, revisions, parity, governance.
  • Quick-action lane: five Link.quickAction anchors (no self-link).

States#

The lane fetches GET /v1/admin/aja/content-security on mount.

  • Loading — data-aja-cs-loading "Loading access controls…".
  • Unauthorized — data-aja-cs-unauthorized (401/403; default message "Aja workspace scope required to view content security.").
  • Error — data-aja-cs-error (non-2xx, malformed, or network).
  • Ready (controls) — data-aja-cs-controls with the resource/grantee inputs + permission select + Grant/Check/Revoke buttons.
  • Authority unavailable — data-aja-authority-status="content-security" names the boundary; all fields and mutation buttons are disabled and emit no request.
  • Grant result — data-aja-cs-grant-result (data-aja-cs-active).
  • Check result — data-aja-cs-check-result (data-aja-cs-allowed + effective permissions).

Interactions#

Access-control controls (data-aja-cs-controls)#

These controls are enabled only when authority.configured is true.

  • resourceId — input data-aja-cs-field-resource (default resource-1).
  • granteeId — input data-aja-cs-field-grantee (default user-1).
  • permission — select data-aja-cs-field-permission (options from the catalog permissions).
  • Grant — data-aja-cs-grant; fires POST /v1/admin/aja/content-security/grants (resourceType: 'content', granteeType: 'user', createdBy: 'studio-operator').
  • Check — data-aja-cs-check; fires POST /v1/admin/aja/content-security/check.
  • Revoke — data-aja-cs-revoke (disabled until a grant exists); fires POST /v1/admin/aja/content-security/grants/{id}/revoke.

Route Map#

  • Route entries (6) — non-interactive listing.

Quick-action lane#

  • "Open Aja Content Moderation workspace" → /studio/aja/content-moderation
  • "Open Aja Consent Management workspace" → /studio/aja/consent-management
  • "Open Aja Privacy Protection workspace" → /studio/aja/privacy-protection
  • "Open Aja Data Retention workspace" → /studio/aja/data-retention
  • "Back to Studio workspace index" → /studio

Data & contracts#

  • Reads: GET /v1/admin/aja/content-security (catalog: authority, permissions, resourceTypes, granteeTypes).
  • Writes: POST …/grants, POST …/check, POST …/grants/{id}/revoke; valid requests return 503 while the deploy authority is unbound.
  • Realtime: none.
  • Caching: client fetch on mount (cache: 'no-store'); SSR shell.
  • Auth/role check: BFF endpoints admin-scoped + fail-closed (401/403 → unauthorized render); route gated signed-in + studio via proxy.

Cross-references#

  • Parent: ../../studio-overview.md
  • Aggregator that embeds this lane: ./studio-aja-asset-storage.md
  • Siblings (quick-actions): /studio/aja/content-moderation, /studio/aja/consent-management, /studio/aja/privacy-protection, /studio/aja/data-retention
  • Component sources:
    • apps/oshun/web/src/components/studio/StudioAjaContentSecurityWorkspace.tsx
    • apps/oshun/web/src/components/studio/StudioAjaContentSecurityRouteMap.ts

Open questions / known gaps#

  • Bind an owning access-control service used by real delivery, sharing, and decrypt enforcement paths before enabling decisions in production.
  • Route Map lists scenes/exports/revisions/parity/governance child routes that are not yet implemented as pages.