Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/tests/modules/content/test_content_router.py

@@ -0,0 +1,45 @@
+def _admin_headers(client):
+    login = client.post(
+        "/api/v1/auth/login",
+        json={"email": "admin@compton.example", "password": "Admin1234"},
+    )
+    token = login.json()["access_token"]
+    return {"Authorization": f"Bearer {token}"}
+
+
+def test_create_and_read_published_page(client):
+    headers = _admin_headers(client)
+    created = client.post(
+        "/api/v1/content/pages",
+        headers=headers,
+        json={"slug": "about", "title": "About", "body": "<p>Hello</p>", "status": "published"},
+    )
+    assert created.status_code == 200
+
+    fetched = client.get("/api/v1/content/pages/about")
+    assert fetched.status_code == 200
+    assert fetched.json()["slug"] == "about"
+
+
+def test_list_all_pages_requires_admin(client):
+    response = client.get("/api/v1/content/pages/manage/all")
+    assert response.status_code == 401
+
+
+def test_list_all_pages_includes_drafts(client):
+    headers = _admin_headers(client)
+    created = client.post(
+        "/api/v1/content/pages",
+        headers=headers,
+        json={"slug": "draft-page", "title": "Draft", "body": "<p>Draft</p>", "status": "draft"},
+    )
+    assert created.status_code == 200
+
+    listed = client.get("/api/v1/content/pages/manage/all", headers=headers)
+    assert listed.status_code == 200
+    slugs = [page["slug"] for page in listed.json()["data"]]
+    assert "draft-page" in slugs
+
+    public = client.get("/api/v1/content/pages")
+    public_slugs = [page["slug"] for page in public.json()["data"]]
+    assert "draft-page" not in public_slugs

apps/api/tests/modules/content/test_content_sanitize_protocols.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from app.modules.content.service import sanitize_html
+
+
+def test_sanitize_html_strips_javascript_protocol():
+    raw = '<a href="javascript:alert(1)">x</a><img src="javascript:alert(1)" alt="x" />'
+    clean = sanitize_html(raw)
+    assert "javascript:" not in clean