hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/site/site_host/templates.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "dockerfile"
+
+module Hecks
+  module Projections
+    module Site
+      module SiteHost
+        # The text of the two files, written as the file a project would write by hand.
+        module Templates
+          BANNER = "Generated by hecks site site_projection.project_site. Do not edit."
+
+          module_function
+
+          # @param cms [Hash{Symbol => Object}] the checked `Cms` row
+          # @return [String] the image's build file
+          def dockerfile(cms)
+            format(Dockerfile::TEXT, banner: BANNER, node: cms[:node], port: cms[:port], heap: cms[:heap_mb])
+          end
+
+          # @param secrets [Array<Hash{Symbol => Object}>] the checked `BootSecret` rows
+          # @return [String] the start-up script
+          def boot(secrets)
+            ["// #{BANNER}", BOOT_HEAD, *secrets.map { |secret| extra(secret) }, BOOT_TAIL].join("\n\n") << "\n"
+          end
+
+          def extra(secret)
+            from = JSON.generate(secret[:from])
+            env = JSON.generate(secret[:env])
+            return field_secret(from, env, JSON.generate(secret[:field])) if secret[:field]
+
+            whole_secret(secret, from, env)
+          end
+
+          def field_secret(from, env, field)
+            <<~JS.chomp
+              if (process.env[#{from}]) {
+                process.env[#{env}] = await secretField(process.env[#{from}], #{field});
+              }
+            JS
+          end
+
+          def whole_secret(secret, from, env)
+            note = "// #{secret[:env]} is the whole of the secret named by #{secret[:from]}. Optional and non-fatal."
+            "#{note}\n#{whole_read(secret, from, env)}"
+          end
+
+          def whole_read(secret, from, env)
+            <<~JS.chomp
+              if (process.env[#{from}] && !process.env[#{env}]) {
+                try {
+                  const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: process.env[#{from}] }));
+                  if (SecretString) process.env[#{env}] = SecretString;
+                } catch (err) {
+                  console.warn(`boot: could not read #{secret[:from]}: ${err instanceof Error ? err.message : err}`);
+                }
+              }
+            JS
+          end
+
+          BOOT_HEAD = <<~JS.chomp
+            // Cold-start bootstrap: resolve the secrets, then start Next.
+            //
+            // The database password and the signing secret are fetched from Secrets Manager here, in the
+            // process, and composed into the environment keys payload.config.ts reads (DATABASE_URL,
+            // PAYLOAD_SECRET), so neither is ever a plaintext environment variable of the task. A
+            // DATABASE_URL / PAYLOAD_SECRET already in the environment is used when the *_ARN variables are
+            // absent: a person running this file locally.
+            import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+
+            const client = new SecretsManagerClient({});
+
+            async function secretField(arn, field) {
+              const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: arn }));
+              const value = JSON.parse(SecretString)[field];
+              if (!value) throw new Error(`secret ${arn} has no "${field}" field`);
+              return value;
+            }
+
+            if (process.env.DB_SECRET_ARN) {
+              const { DB_HOST, DB_NAME } = process.env;
+              if (!DB_HOST || !DB_NAME) throw new Error("DB_HOST and DB_NAME are required when DB_SECRET_ARN is set");
+              const password = await secretField(process.env.DB_SECRET_ARN, "password");
+              // The password goes through encodeURIComponent: the generated one can hold characters (@ / #)
+              // that would otherwise split the URL. RDS enforces TLS; verify against Amazon's CA bundle,
+              // which the image holds beside this file.
+              const ssl = "sslmode=verify-full&sslrootcert=" + new URL("./rds-global-bundle.pem", import.meta.url).pathname;
+              process.env.DATABASE_URL = `postgres://postgres:${encodeURIComponent(password)}@${DB_HOST}:5432/${DB_NAME}?${ssl}`;
+            } else if (!process.env.DATABASE_URL) {
+              throw new Error("either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required");
+            }
+
+            if (process.env.PAYLOAD_SECRET_ARN) {
+              process.env.PAYLOAD_SECRET = await secretField(process.env.PAYLOAD_SECRET_ARN, "secret");
+            } else if (!process.env.PAYLOAD_SECRET) {
+              throw new Error("either PAYLOAD_SECRET_ARN or PAYLOAD_SECRET is required");
+            }
+          JS
+
+          BOOT_TAIL = <<~JS.chomp
+            // Next's standalone server starts listening on import (PORT and HOSTNAME come from the environment).
+            await import("./server.js");
+          JS
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/site_host.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "../../projector"
+require_relative "root_rows"
+require_relative "site_host/templates"
+
+module Hecks
+  module Projections
+    module Site
+      # The content system's container image and its start-up script, from rows beside the route
+      # table: `cms/Dockerfile` and `cms/deploy-aws/boot.mjs`.
+      #
+      # The script resolves the content system's secrets before it starts the server: the database
+      # password and the signing secret always, and any further secret a `BootSecret` row names.
+      # Each is
+      # fetched from Secrets Manager in the process, so none is ever a plaintext environment
+      # variable of
+      # the task. The image is a plain two-stage build of a Next standalone server that runs the
+      # script.
+      module SiteHost
+        extend Projector::Target
+
+        projects_as :site_host, emits: :files
+
+        # The `Cms` row: where the content system lives and how its image is built.
+        CMS = RootRows.new("Cms", fields:   { dir: String, node: String, port: Integer, heap_mb: Integer,
+                                             dockerfile: [TrueClass, FalseClass] },
+                                  defaults: { dir: "cms", node: "22", port: 8080, heap_mb: 1024, dockerfile: true })
+
+        # A `BootSecret` row: an environment variable filled from a secret whose id the variable
+        # `from`
+        # holds. With `field` the secret is JSON and that field is the value, required once the
+        # secret
+        # is named; without it the whole secret is the value and failing to read it only warns.
+        BOOT_SECRETS = RootRows.new("BootSecret", fields: { env: String, from: String, field: String },
+                                                  required: %i[env from], many: true)
+
+        module_function
+
+        # @param bluebook [Bluebook::Chapter] the chapter that declares the route table
+        # @param options [Hash{Symbol => Object}] unused
+        # @return [Hash{String => String}] each file's path relative to the project root to its
+        #   text;
+        #   empty when the project declares no `Cms` row
+        # @raise [Table::Invalid] when a row is refused
+        def call(bluebook:, options: {})
+          cms = CMS.read(bluebook).first
+          return {} unless cms
+
+          files = { "#{cms[:dir]}/deploy-aws/boot.mjs" => Templates.boot(BOOT_SECRETS.read(bluebook)) }
+          files["#{cms[:dir]}/Dockerfile"] = Templates.dockerfile(cms) if cms[:dockerfile]
+          files
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/site_root/workflow.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      module SiteRoot
+        # The workflow that keeps the generated files current, as a `format` template.
+        module Workflow
+          # The file, with `%<name>s` placeholders for the row's values.
+          TEXT = <<~YAML
+            %<banner>s
+            # Two checks, neither needing AWS or a database:
+            #
+            #   1. the generated files are current: `%<script>s --check` regenerates them with the hecks
+            #      gem the Gemfile.lock pins and exits 1, naming each file, if a row was edited without
+            #      regenerating or a generated file was hand-edited;
+            #   2. `%<test>s`, which holds the generated code to what the hand-written code does.
+            name: %<name>s
+
+            on:
+              push:
+                branches: [main]
+                paths:
+            %<paths>s
+              pull_request:
+                paths:
+            %<paths>s
+              # Lets a GitHub merge queue run this check on each queued PR (paths do not apply to merge_group).
+              merge_group:
+              workflow_dispatch: {}
+
+            permissions:
+              contents: read
+
+            jobs:
+              routes-current-and-parity:
+                runs-on: ubuntu-24.04
+                timeout-minutes: 15
+
+                steps:
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+                  - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
+                    with:
+                      ruby-version: %<ruby>s
+                      bundler-cache: true
+                      working-directory: %<gem_dir>s
+
+                  - name: The generated files are current
+                    run: %<script>s --check
+
+                  - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+                    with:
+                      node-version: %<node>s
+
+                  %<install_steps>s
+
+                  - name: Parity between the generated code and the hand-written code
+                    run: %<test>s
+          YAML
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/site_root.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require_relative "../../projector"
+require_relative "root_rows"
+require_relative "site_root/workflow"
+
+module Hecks
+  module Projections
+    module Site
+      # The files at a project's root that are written from rows beside its route table: the
+      # local-stack settings template (`.env.tpl`, from `Secrets` and `Env` rows) and the workflow
+      # that
+      # keeps the generated files current (`.github/workflows/site-routes.yml`, from a `Ci` row).
+      #
+      # Each file is written only when its rows are declared. Settings that are secrets are
+      # references
+      # into 1Password, never values, so nothing secret is written to disk.
+      module SiteRoot
+        extend Projector::Target
+
+        projects_as :site_root, emits: :files
+
+        # The `Secrets` row: where the secrets live and what starts the stack.
+        SECRETS = RootRows.new("Secrets", fields:   { vault: String, item: String, section: String, launcher: String },
+                                          required: %i[vault item])
+
+        # An `Env` row: a plain setting when it carries `value`, a secret reference when it does
+        # not. `group` heads the rows from it on with a comment; `off` comments the line out.
+        ENV_ROWS = RootRows.new("Env", required: %i[name], many: true,
+                                       fields: { name: String, value: [String, Integer, TrueClass, FalseClass], group: String,
+                                                off: [TrueClass, FalseClass] })
+
+        # The `Ci` row: the workflow that checks the generated files.
+        CI = RootRows.new("Ci", fields:   { name: String, ruby: String, node: String, gem_dir: String, script: String,
+                                          test: String, paths: String, install: String },
+                                required: %i[gem_dir],
+                                defaults: { name: "Site routes", ruby: "3.3", node: "22", script: "bin/site_routes",
+                                            test: "npm test", paths: "", install: "npm ci" })
+
+        # The workflow's path and the steps' action pins, which a project does not choose.
+        WORKFLOW = ".github/workflows/site-routes.yml"
+        BANNER = "# Generated by hecks site site_projection.project_site. Do not edit."
+
+        module_function
+
+        # @param bluebook [Bluebook::Chapter] the chapter that declares the route table
+        # @param options [Hash{Symbol => Object}] unused
+        # @return [Hash{String => String}] each file's path relative to the project root to its
+        #   text;
+        #   empty when the project declares no such rows
+        # @raise [Table::Invalid] when a row is refused
+        def call(bluebook:, options: {})
+          files = {}
+          env = env_template(bluebook)
+          files[".env.tpl"] = env if env
+          ci = CI.read(bluebook).first
+          files[WORKFLOW] = workflow(ci) if ci
+          files
+        end
+
+        # @return [String, nil] the template, or nil with no `Env` rows
+        def env_template(chapter)
+          vars = ENV_ROWS.read(chapter)
+          return nil if vars.empty?
+
+          secrets = SECRETS.read(chapter).first
+          if secrets.nil? && vars.any? { |var| !var.key?(:value) }
+            raise Table::Invalid, "Env rows without a value are secrets; the project declares no Secrets row"
+          end
+
+          [BANNER, *header(secrets), *body(vars, secrets)].join("\n") << "\n"
+        end
+
+        def header(secrets)
+          return [] unless secrets
+
+          where = ["vault \"#{secrets[:vault]}\"", "item \"#{secrets[:item]}\"",
+                   *(secrets[:section] ? ["section \"#{secrets[:section]}\""] : [])].join(", ")
+          starter = secrets[:launcher] ? " (#{secrets[:launcher]} does this)" : ""
+          ["# Local-stack settings. Secrets are op:// references into 1Password (#{where}),",
+           "# resolved at start-up by `op run --env-file=.env.tpl -- <command>`#{starter};",
+           "# no secret is ever written to disk. The plain lines are not secret."]
+        end
+
+        def body(vars, secrets)
+          group = nil
+          vars.flat_map do |var|
+            heading = var[:group] && var[:group] != group ? ["", "# #{var[:group]}"] : []
+            group = var[:group] if var[:group]
+            [*heading, line(var, secrets)]
+          end
+        end
+
+        def line(var, secrets)
+          text = "#{var[:name]}=#{var.key?(:value) ? var[:value] : reference(var, secrets)}"
+          var[:off] ? "# #{text}" : text
+        end
+
+        def reference(var, secrets)
+          "op://#{[secrets[:vault], secrets[:item], secrets[:section], var[:name]].compact.join("/")}"
+        end
+
+        # @param row [Hash{Symbol => Object}] the checked `Ci` row
+        # @return [String] the workflow
+        def workflow(row)
+          paths = path_list(row).map { |path| "      - #{path.to_s.inspect}" }.join("\n")
+          format(Workflow::TEXT, banner: BANNER, name: row[:name], paths: paths, ruby: row[:ruby].inspect,
+                                node: row[:node].inspect, gem_dir: row[:gem_dir], script: row[:script], test: row[:test],
+                                install_steps: install_steps(row[:install]))
+        end
+
+        # The steps that install the project's dependencies; a project that installs with yarn gets
+        # corepack enabled first, so the version it pins is the one that runs.
+        def install_steps(install)
+          steps = []
+          steps << "- name: Enable corepack\n        run: corepack enable" if install.start_with?("yarn")
+          steps << "- name: Install dependencies\n        run: #{install}"
+          steps.join("\n\n      ")
+        end
+
+        def path_list(row)
+          listed = row[:paths].split(",").map(&:strip).reject(&:empty?)
+          [*listed, row[:script], "#{row[:gem_dir]}/Gemfile.lock", WORKFLOW].uniq
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/table/checks.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../edge/pattern"
+require_relative "navigation_checks"
 
 module Hecks
   module Projections
@@ -12,8 +13,6 @@ module Hecks
         # prefix that is not.
         class Checks
           SWITCH_ID = /\A[a-z][a-z0-9_]*\z/
-          FRAGMENT = /\A[A-Za-z0-9][\w:.-]*\z/
-          PUBLIC_MENUS = %w[desktop mobile footer].freeze
 
           # The navigation slots a row sits in.
           #
@@ -31,6 +30,7 @@ module Hecks
             @rows = rows
             @links = links
             @problems = problems
+            @navigation = NavigationChecks.new(problems)
           end
 
           # @return [void]
@@ -38,7 +38,7 @@ module Hecks
             check_duplicate_paths
             check_switches
             @rows.each { |row| check_row(row) }
-            @links.each { |link| check_link(link) }
+            @links.each { |link| @navigation.check_link(link) }
             check_unique((@rows + @links).filter_map(&:admin_key), "admin key")
             check_unique(@rows.map(&:source).grep(/\Aglobal:/), "source")
           end
@@ -47,28 +47,33 @@ module Hecks
 
           def check_duplicate_paths
             seen = Hash.new { |hash, path| hash[path] = [] }
-            @rows.each do |row|
-              [row.path, *row.aliases].compact.each do |path|
-                problem(path, "is declared twice") if seen[path].any? { |other| other.verbs.intersect?(row.verbs) }
-                seen[path] << row
-              end
-            end
+            @rows.each { |row| [row.path, *row.aliases].compact.each { |path| claim(seen, row, path) } }
+          end
+
+          def claim(seen, row, path)
+            problem(path, "is declared twice") if seen[path].any? { |other| other.verbs.intersect?(row.verbs) }
+            seen[path] << row
           end
 
           def check_switches
             @rows.reject { |row| row.switch.empty? }.group_by(&:switch).each do |id, rows|
-              next if rows.map(&:off).uniq.size == 1
-
-              problem("switch #{id}", "is on for #{rows.reject(&:off).map(&:path).join(', ')} and off for the rest")
+              check_switch_agreement(id, rows)
             end
           end
 
+          def check_switch_agreement(id, rows)
+            return if rows.map(&:off).uniq.size == 1
+
+            problem("switch #{id}", "is on for #{rows.reject(&:off).map(&:path).join(", ")} and off for the rest")
+          end
+
           def check_row(row)
             path = row.path.to_s
             problem(path, "must start with /") unless path.start_with?("/")
             check_switch(row, path)
             check_redirect(row, path)
-            check_navigation(row, path)
+            check_aliases(row, path)
+            @navigation.check_row(row, path)
             check_indexing(row, path)
             check_beneath_prefix(row, path)
             return unless row.preview == "draft" && row.source == "none"
@@ -86,45 +91,15 @@ module Hecks
           def check_redirect(row, path)
             targeted = %w[redirect rewrite].include?(row.kind)
             problem(path, "is a #{row.kind} and needs redirect_to") if targeted && row.redirect_to.to_s.empty?
-            if !targeted && row.redirect_to
-              problem(path, "has redirect_to but is a #{row.kind}; only a redirect or rewrite has a target")
-            end
-            return if row.aliases.empty? || row.kind == "page"
-
-            problem(path, "has aliases but is a #{row.kind}; aliases redirect to a page")
-          end
+            return unless !targeted && row.redirect_to
 
-          def check_navigation(row, path)
-            slots = self.class.navigation(row)
-            return if slots.empty?
-
-            unless row.verbs.include?("GET")
-              problem(path, "sits in the navigation but answers #{row.verbs.join(',')}; a link is a GET")
-            end
-            problem(path, "sits in the navigation and has a parameter") if path.match?(/[:*]/)
-            problem(path, "sits in the navigation and has no label") if row.label.to_s.empty?
-            check_heading(row, path)
-            check_menu_audience(row, path, slots)
+            problem(path, "has redirect_to but is a #{row.kind}; only a redirect or rewrite has a target")
           end
 
-          def check_heading(item, path)
-            return unless item.mobile_heading
-            return problem(path, "has a mobile_heading but no mobile_order") if item.mobile_order.nil?
-
-            problem(path, "has an empty mobile_heading") if item.mobile_heading.strip.empty?
-          end
+          def check_aliases(row, path)
+            return if row.aliases.empty? || row.kind == "page"
 
-          def check_link(link)
-            path = "NavLink #{link.path}"
-            slots = self.class.navigation(link)
-            problem(path, "sits in no navigation; give it nav_order, mobile_order, footer_column or admin_key") if slots.empty?
-            problem(path, "has a parameter; a link is to one page") if link.path.to_s.match?(/[:*]/)
-            problem(path, "has no label") if link.label.to_s.empty?
-            if link.fragment && !link.fragment.match?(FRAGMENT)
-              problem(path, "has fragment #{link.fragment.inspect}; a fragment is an element id, written without #")
-            end
-            check_heading(link, path)
-            check_menu_audience(link, path, slots)
+            problem(path, "has aliases but is a #{row.kind}; aliases redirect to a page")
           end
 
           # A public route under a prefix that is not public (the sign-in page beside the admin
@@ -133,22 +108,18 @@ module Hecks
           def check_beneath_prefix(row, path)
             return if row.auth != "public" || row.explicit_cache || row.path.nil?
 
-            pattern = Edge::Pattern.edge(row.path)
-            prefix = @rows.find do |other|
-              other.auth != "public" && other.path && Edge::Pattern.strictly_covers?(Edge::Pattern.edge(other.path), pattern)
-            end
+            prefix = non_public_prefix(row)
             return unless prefix
 
             problem(path, "is public but sits beneath #{prefix.path}, which is #{prefix.auth}; " \
                           "name its cache class (cache: \"no_store\" for a sign-in page) to say that is meant")
           end
 
-          def check_menu_audience(row, path, slots)
-            public_slots = slots & PUBLIC_MENUS
-            if row.auth != "public" && public_slots.any?
-              problem(path, "is an admin page in the #{public_slots.join(' and ')} navigation")
+          def non_public_prefix(row)
+            pattern = Edge::Pattern.edge(row.path)
+            @rows.find do |other|
+              other.auth != "public" && other.path && Edge::Pattern.strictly_covers?(Edge::Pattern.edge(other.path), pattern)
             end
-            problem(path, "is public and sits in the admin navigation") if row.auth == "public" && slots.include?("admin")
           end
 
           def check_indexing(row, path)

data/lib/hecks/projections/site/table/link_builder.rb

@@ -33,18 +33,27 @@ module Hecks
             fields = checked_fields(member, label)
             target = @rows.find { |row| row.path == fields[:path] && row.verbs.include?("GET") }
             problem(label, "points at no route that answers GET; declare the route first") unless target
-            link = Link.new(**fields, off: target ? target.off : false, switch: target ? target.switch : "",
-                                      auth: target ? target.auth : "public")
+            fill_orders(Link.new(**fields, **route_facts(target)))
+          end
+
+          private
+
+          # What a link copies from the route it points at; a link to no route is on and public.
+          def route_facts(target)
+            return { off: false, switch: "", auth: "public" } unless target
+
+            { off: target.off, switch: target.switch, auth: target.auth }
+          end
+
+          def fill_orders(link)
             link.footer_order ||= 0 if link.footer_column
             link.admin_order ||= 0 if link.admin_key
             link
           end
 
-          private
-
           def checked_fields(member, label)
             member.each_key do |key|
-              problem(label, "has no field #{key}; fields are #{FIELDS.keys.join(', ')}") unless FIELDS.key?(key)
+              problem(label, "has no field #{key}; fields are #{FIELDS.keys.join(", ")}") unless FIELDS.key?(key)
             end
             known = member.slice(*FIELDS.keys)
             known.each do |key, value|

data/lib/hecks/projections/site/table/navigation_checks.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      class Table
+        # What a row or an extra link in the navigation must satisfy: a GET with a label and no
+        # parameter, a heading only where it has a mobile slot, and a menu its audience may see.
+        class NavigationChecks
+          FRAGMENT = /\A[A-Za-z0-9][\w:.-]*\z/
+          PUBLIC_MENUS = %w[desktop mobile footer].freeze
+
+          # @param problems [Array<String>] collects each problem found, one line each
+          def initialize(problems)
+            @problems = problems
+          end
+
+          # @param row [Row] a row whose defaults are filled in
+          # @param path [String] the row's path, as the problems name it
+          # @return [void]
+          def check_row(row, path)
+            slots = Checks.navigation(row)
+            return if slots.empty?
+
+            unless row.verbs.include?("GET")
+              problem(path, "sits in the navigation but answers #{row.verbs.join(",")}; a link is a GET")
+            end
+            problem(path, "sits in the navigation and has a parameter") if path.match?(/[:*]/)
+            problem(path, "sits in the navigation and has no label") if row.label.to_s.empty?
+            check_heading(row, path)
+            check_menu_audience(row, path, slots)
+          end
+
+          # @param link [Link] an extra navigation entry
+          # @return [void]
+          def check_link(link)
+            path = "NavLink #{link.path}"
+            slots = Checks.navigation(link)
+            problem(path, "sits in no navigation; give it nav_order, mobile_order, footer_column or admin_key") if slots.empty?
+            check_link_target(link, path)
+            check_heading(link, path)
+            check_menu_audience(link, path, slots)
+          end
+
+          private
+
+          def check_link_target(link, path)
+            problem(path, "has a parameter; a link is to one page") if link.path.to_s.match?(/[:*]/)
+            problem(path, "has no label") if link.label.to_s.empty?
+            return unless link.fragment && !link.fragment.match?(FRAGMENT)
+
+            problem(path, "has fragment #{link.fragment.inspect}; a fragment is an element id, written without #")
+          end
+
+          def check_heading(item, path)
+            return unless item.mobile_heading
+            return problem(path, "has a mobile_heading but no mobile_order") if item.mobile_order.nil?
+
+            problem(path, "has an empty mobile_heading") if item.mobile_heading.strip.empty?
+          end
+
+          def check_menu_audience(row, path, slots)
+            public_slots = slots & PUBLIC_MENUS
+            if row.auth != "public" && public_slots.any?
+              problem(path, "is an admin page in the #{public_slots.join(" and ")} navigation")
+            end
+            problem(path, "is public and sits in the admin navigation") if row.auth == "public" && slots.include?("admin")
+          end
+
+          def problem(label, text) = @problems << "#{label} #{text}"
+        end
+      end
+    end
+  end
+end