[Feature][Blog][Angular] Author edit UI — updateBlogPost exists server+service side, no surface calls it (epic #705) #709

New Issue

2026-07-19T01:15:19Z

spikerj commented

2026-07-19 01:15:19 +00:00

Epic #705. PUT /api/blog/posts/{id} + BlogService.updateBlogPost(dto) exist, but authors can't edit anything after publishing — no edit affordance on the card or anywhere else. Typos are forever (or a delete-and-repost).

Shape: edit action next to the owner-delete button (#420 pattern: isOwner gate) → reuse the blog-create form prefilled (/blog/edit/:id route, auth-guarded). Decide moderation semantics: does editing a published post re-enter pendingReview for minors' accounts (mirror the create-time DeterminePostStatus logic)?

Note the update endpoint currently has no [Authorize]/ownership check server-side — same class as the create-provenance fix (backend #423); harden it as part of this.

Epic #705. `PUT /api/blog/posts/{id}` + `BlogService.updateBlogPost(dto)` exist, but authors can't edit anything after publishing — no edit affordance on the card or anywhere else. Typos are forever (or a delete-and-repost). **Shape:** edit action next to the owner-delete button (#420 pattern: `isOwner` gate) → reuse the blog-create form prefilled (`/blog/edit/:id` route, auth-guarded). Decide moderation semantics: does editing a published post re-enter pendingReview for minors' accounts (mirror the create-time `DeterminePostStatus` logic)? Note the update endpoint currently has no `[Authorize]`/ownership check server-side — same class as the create-provenance fix (backend #423); harden it as part of this.

spikerj referenced this issue

2026-07-19 01:15:58 +00:00

[Security][Blog][Record] Create endpoints accepted spoofable client-supplied AuthorId — fixed by backend #423 (epic #705) #716

spikerj referenced this issue

2026-07-19 01:16:08 +00:00

[Epic][Blog][UX] Blog management & UX overhaul — findings from the 2026-07-18 full review #705

spikerj commented

2026-08-07 13:46:01 +00:00

Migrated to spikerj/spikersoft-angular#628 as part of the umbrella-tracker breakup.

Verified 2026-08-07 against spikersoft-angular@8e5a4048, and live against the deployed learn.spikersoft.com bundle (main-KZKZUOSX.js).
Status: not started — The whole Angular surface: /blog/edit/:id auth-guarded route, an owner-gated edit affordance next to the delete button, the prefilled create form, and the moderation-semantics decision (does editing a published post re-enter pendingReview for minors?).

Closing here. Work now lives in the repo that holds the fix, so fixes #628 in a PR will auto-close it on merge. The umbrella tracker keeps cross-repo epics only (parent epic #705 is untouched).

— Opus 5 Agent

Migrated to **spikerj/spikersoft-angular#628** as part of the umbrella-tracker breakup. Verified 2026-08-07 against `spikersoft-angular@8e5a4048`, and live against the deployed `learn.spikersoft.com` bundle (`main-KZKZUOSX.js`). Status: not started — The whole Angular surface: `/blog/edit/:id` auth-guarded route, an owner-gated edit affordance next to the delete button, the prefilled create form, and the moderation-semantics decision (does editing a published post re-enter pendingReview for minors?). Closing here. Work now lives in the repo that holds the fix, so `fixes #628` in a PR will auto-close it on merge. The umbrella tracker keeps cross-repo epics only (parent epic #705 is untouched). — Opus 5 Agent

spikerj closed this issue

2026-08-07 13:46:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#709