@prenta/admin 1.17.2 → 1.17.4

package/dist/views/page-editor/sections/admin-renderers.js

@@ -32,15 +32,15 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * renderer falls back to the built-in for that type, or to the placeholder if
  * the type has no built-in, instead of taking down the editor.
  */
+import { sanitizeHtml } from '@prenta/core/sanitize';
 import { createContext, useContext } from 'react';
 /**
- * Render options passed to every admin renderer. Rich text is sanitized on
- * write by cms-core, so the canvas (same trust domain as the public default)
- * uses the identity sanitizer; images render as plain lazy `<img>` since the
- * editor canvas has no next/image pipeline.
+ * Render options passed to every admin renderer. Draft HTML is sanitized
+ * with the cms-core allow-list before any renderer injects it. Images render
+ * as plain lazy `<img>` since the editor canvas has no next/image pipeline.
  */
 export const ADMIN_RENDER_OPTIONS = {
-    sanitizeHtml: (html) => html,
+    sanitizeHtml,
     baseUrl: '',
     // Never grants the priority slot. On a public page exactly one image may
     // load eagerly; in the canvas nothing competes for bandwidth and every

package/dist/views/page-editor/sections/admin-renderers.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-renderers.js","sourceRoot":"","sources":["../../../../src/views/page-editor/sections/admin-renderers.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAkB,MAAM,OAAO,CAAA;AA4EjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;IAC5B,OAAO,EAAE,EAAE;IACX,yEAAyE;IACzE,uEAAuE;IACvE,wDAAwD;IACxD,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACjE,cACE,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,KAAK,IAAI,SAAS,EACzB,MAAM,EAAE,MAAM,IAAI,SAAS,EAC3B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GACtC,CACH;CACF,CAAA;AAED,MAAM,4BAA4B,GAAG,aAAa,CAA0B,EAAE,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,QAAQ,CAAA;AAElF,oFAAoF;AACpF,MAAM,UAAU,wBAAwB;IACtC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"admin-renderers.js","sourceRoot":"","sources":["../../../../src/views/page-editor/sections/admin-renderers.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAkB,MAAM,OAAO,CAAA;AA4EjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,YAAY;IACZ,OAAO,EAAE,EAAE;IACX,yEAAyE;IACzE,uEAAuE;IACvE,wDAAwD;IACxD,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACjE,cACE,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,KAAK,IAAI,SAAS,EACzB,MAAM,EAAE,MAAM,IAAI,SAAS,EAC3B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GACtC,CACH;CACF,CAAA;AAED,MAAM,4BAA4B,GAAG,aAAa,CAA0B,EAAE,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,QAAQ,CAAA;AAElF,oFAAoF;AACpF,MAAM,UAAU,wBAAwB;IACtC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAA;AACjD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prenta/admin",
-  "version": "1.17.2",
+  "version": "1.17.4",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -99,7 +99,7 @@
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
     "@prenta/component-blocks": "0.3.1",
-    "@prenta/core": "7.0.0",
+    "@prenta/core": "7.2.0",
     "@prenta/plugin-ai": "3.0.0",
     "@prenta/plugin-blocks": "0.2.0",
     "@prenta/plugin-commerce": "0.2.1",
@@ -107,7 +107,7 @@
     "@prenta/plugin-media": "0.2.0",
     "@prenta/plugin-navigation": "0.3.0",
     "@prenta/plugin-seo": "1.0.0",
-    "@prenta/sections-react": "0.17.42"
+    "@prenta/sections-react": "0.17.45"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && npx @tailwindcss/cli -i src/styles/build-input.css -o dist/prenta-admin.css --minify",

package/src/__tests__/lib/posts-service.test.ts

@@ -186,6 +186,41 @@ describe('posts-service.fetchPosts', () => {
     })
   })
 
+  it('lists the public path from the collection urlPrefix, not the collection slug (#921)', async () => {
+    cmsApiMock.mockReset()
+    cmsApiMock.mockImplementation((url: string) => {
+      if (!url.startsWith('/posts')) return { error: `unexpected url: ${url}` }
+      return {
+        data: {
+          ...POSTS_RESPONSE,
+          posts: [
+            { ...POSTS_RESPONSE.posts[1], id: 'p1', collection: 'posts', slug: 'seo-cost' },
+            { ...POSTS_RESPONSE.posts[1], id: 'r1', collection: 'resources', slug: 'guide' },
+            { ...POSTS_RESPONSE.posts[1], id: 'n1', collection: 'news', slug: 'q2' },
+            { ...POSTS_RESPONSE.posts[1], id: 'x1', collection: 'unknown-type', slug: 'orphan' },
+          ],
+          types: [
+            { ...POSTS_RESPONSE.types[0], slug: 'posts', urlPrefix: 'blog' },
+            { ...POSTS_RESPONSE.types[0], slug: 'resources', urlPrefix: '' },
+            { ...POSTS_RESPONSE.types[1], slug: 'news', urlPrefix: 'news' },
+          ],
+        },
+      }
+    })
+    const res = await fetchPosts({})
+    const byId = new Map(res.posts.map((p) => [p.id, p]))
+    // `posts` collection relabelled Blog with `urlPrefix: 'blog'` → /blog/{slug}.
+    expect(byId.get('p1')?.publicPath).toBe('/blog/seo-cost')
+    // Collection slug stays the API identity.
+    expect(byId.get('p1')?.postTypeId).toBe('posts')
+    // Empty urlPrefix (root-mounted) → /{slug}.
+    expect(byId.get('r1')?.publicPath).toBe('/guide')
+    // Prefix equal to slug is unchanged.
+    expect(byId.get('n1')?.publicPath).toBe('/news/q2')
+    // No type row for the collection → fall back to the collection slug.
+    expect(byId.get('x1')?.publicPath).toBe('/unknown-type/orphan')
+  })
+
   it('surfaces the scheduled date for SCHEDULED posts as the display date', async () => {
     const res = await fetchPosts({})
     const news = res.posts.find((p) => p.id === 'n1')

package/src/__tests__/lib/public-path.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+
+import { publicPathFor } from '../../lib/public-path.js'
+
+describe('publicPathFor', () => {
+  it('lists /{urlPrefix}/{slug} when the collection declares a public prefix', () => {
+    // The collection slug (`posts`) is API identity; the public path is `/blog`.
+    expect(publicPathFor('blog', 'posts', 'how-much-do-seo-services-cost')).toBe(
+      '/blog/how-much-do-seo-services-cost',
+    )
+  })
+
+  it('falls back to /{collectionSlug}/{slug} when no urlPrefix is declared', () => {
+    expect(publicPathFor(undefined, 'posts', 'hello')).toBe('/posts/hello')
+  })
+
+  it('lists /{slug} when urlPrefix is the empty string (root-mounted collection)', () => {
+    expect(publicPathFor('', 'pages', 'about')).toBe('/about')
+  })
+
+  it('supports nested prefixes and trims stray slashes', () => {
+    expect(publicPathFor('help/articles', 'help-articles', 'reset-password')).toBe(
+      '/help/articles/reset-password',
+    )
+    expect(publicPathFor('/careers/', 'careers', '/senior-engineer/')).toBe(
+      '/careers/senior-engineer',
+    )
+  })
+
+  it('is unchanged for a type whose prefix equals its slug', () => {
+    expect(publicPathFor('news', 'news', 'q2-roadmap')).toBe('/news/q2-roadmap')
+  })
+
+  it('keeps a trailing slash placeholder when the slug is empty', () => {
+    expect(publicPathFor('blog', 'posts', '')).toBe('/blog/')
+  })
+})

package/src/__tests__/views/admin-section-renderers.test.tsx

@@ -56,6 +56,7 @@ describe('pluggable admin section renderers', () => {
     )
     const options = seen[0] as { sanitizeHtml: (h: string) => string; baseUrl: string }
     expect(options.sanitizeHtml('<b>x</b>')).toBe('<b>x</b>')
+    expect(options.sanitizeHtml('<p>ok</p><script>alert(1)</script>')).not.toContain('script')
     expect(options.baseUrl).toBe('')
     expect(screen.getByAltText('x')).toBeTruthy()
   })

package/src/__tests__/views/article-body-section.render.test.tsx

@@ -29,4 +29,18 @@ describe('ArticleBodySection', () => {
     expect(container.querySelector('.prenta-rich-text')).toBeTruthy()
     expect(container.querySelector('.prose')).toBeNull()
   })
+
+  it('strips script tags from draft HTML before rendering (#396)', () => {
+    const { container } = render(
+      <ArticleBodySection
+        section={section({ source: 'field' })}
+        context={{ body: '<p>Safe copy</p><script>alert(1)</script>' }}
+      />,
+    )
+
+    const preview = container.querySelector('.prenta-rich-text')
+    expect(preview?.querySelector('script')).toBeNull()
+    expect(preview?.innerHTML).toContain('Safe copy')
+    expect(preview?.innerHTML).not.toContain('alert')
+  })
 })

package/src/__tests__/views/posts-list-view.render.test.tsx

@@ -13,6 +13,9 @@ function makePost(id: string, title: string) {
     postTypeAccentColor: 'blue',
     title,
     slug: id,
+    // Public path comes from the collection's `urlPrefix` (`blog`), not the
+    // collection slug (`articles`) — see #921.
+    publicPath: `/blog/${id}`,
     authorName: 'Author',
     authorInitials: 'AU',
     status: 'PUBLISHED',
@@ -47,6 +50,15 @@ beforeEach(() => {
   bulkDeletePosts.mockClear()
 })
 
+describe('PostsListView — row subtitle', () => {
+  it('shows the public path (/{urlPrefix}/{slug}) rather than /{collectionSlug}/{slug} (#921)', async () => {
+    render(<PostsListView onNavigate={() => {}} />)
+    await screen.findByLabelText('Select "Alpha"')
+    expect(screen.getByText('/blog/a1')).toBeTruthy()
+    expect(screen.queryByText('/articles/a1')).toBeNull()
+  })
+})
+
 describe('PostsListView — page-scoped selection', () => {
   it('clears the selection when navigating to another page so the bulk count stays honest', async () => {
     render(<PostsListView onNavigate={() => {}} />)

package/src/__tests__/views/seo-autopilot-card.render.test.tsx

@@ -123,10 +123,10 @@ beforeEach(() => {
 describe('SeoAutopilotCard', () => {
   it('renders the master toggle, type groups, thresholds, and a Never run status', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    expect(
-      screen.getByRole('switch', { name: /enable autopilot/i }).getAttribute('aria-checked'),
-    ).toBe('false')
+    // The heading is present during the loading skeleton; wait on the first
+    // loaded control instead so the assertions below never race the fetch.
+    const toggle = await screen.findByRole('switch', { name: /enable autopilot/i })
+    expect(toggle.getAttribute('aria-checked')).toBe('false')
     expect(screen.getByText('Titles')).toBeTruthy()
     expect(screen.getByText('Redirects')).toBeTruthy()
     expect((screen.getByLabelText(/minimum brand alignment/i) as HTMLInputElement).value).toBe('85')
@@ -137,8 +137,7 @@ describe('SeoAutopilotCard', () => {
 
   it('a blur-commit followed immediately by a checkbox click lands two PUTs, in order', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const brand = screen.getByLabelText(/minimum brand alignment/i)
+    const brand = await screen.findByLabelText(/minimum brand alignment/i)
     const checkbox = screen.getByLabelText('Missing meta title') as HTMLInputElement
     fireEvent.change(brand, { target: { value: '90' } })
     // mousedown on the checkbox blurs the input (commit → PUT #1) and the click
@@ -161,9 +160,9 @@ describe('SeoAutopilotCard', () => {
     const gate = deferred()
     putGate = gate.promise
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
+    // The card region also wraps the loading skeleton; wait on a loaded control.
+    const checkbox = (await screen.findByLabelText('Missing meta title')) as HTMLInputElement
     const card = screen.getByRole('region', { name: 'SEO Autopilot' })
-    const checkbox = screen.getByLabelText('Missing meta title') as HTMLInputElement
     checkbox.focus()
     fireEvent.click(checkbox)
     await waitFor(() => expect(card.getAttribute('aria-busy')).toBe('true'))
@@ -184,8 +183,7 @@ describe('SeoAutopilotCard', () => {
     runGate = gate.promise
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByRole('button', { name: /run now/i }))
+    fireEvent.click(await screen.findByRole('button', { name: /run now/i }))
     await waitFor(() =>
       expect(cmsApi).toHaveBeenCalledWith('/seo/autopilot/run', expect.anything()),
     )
@@ -199,8 +197,7 @@ describe('SeoAutopilotCard', () => {
 
   it('toggling a type PUTs a types patch', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByLabelText('Missing meta title'))
+    fireEvent.click(await screen.findByLabelText('Missing meta title'))
     await waitFor(() =>
       expect(cmsApi).toHaveBeenCalledWith(
         '/seo/autopilot/settings',
@@ -218,8 +215,7 @@ describe('SeoAutopilotCard', () => {
 
   it('toggling the master switch PUTs { enabled }', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByRole('switch', { name: /enable autopilot/i }))
+    fireEvent.click(await screen.findByRole('switch', { name: /enable autopilot/i }))
     await waitFor(() => expect(putBodies()).toEqual([{ enabled: true }]))
     await waitFor(() =>
       expect(
@@ -230,8 +226,7 @@ describe('SeoAutopilotCard', () => {
 
   it('commits a clamped threshold on blur and sends the outcome-watch ratio as a fraction', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const brand = screen.getByLabelText(/minimum brand alignment/i)
+    const brand = await screen.findByLabelText(/minimum brand alignment/i)
     fireEvent.change(brand, { target: { value: '140' } })
     fireEvent.blur(brand)
     await waitFor(() => expect(putBodies()).toEqual([{ minBrandAlignment: 100 }]))
@@ -244,8 +239,7 @@ describe('SeoAutopilotCard', () => {
 
   it('does not PUT when a number field is blurred unchanged or with garbage', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const perRun = screen.getByLabelText(/max changes per run/i)
+    const perRun = await screen.findByLabelText(/max changes per run/i)
     fireEvent.blur(perRun)
     fireEvent.change(perRun, { target: { value: '' } })
     fireEvent.blur(perRun)
@@ -256,8 +250,7 @@ describe('SeoAutopilotCard', () => {
   it('surfaces a PUT validation error verbatim and keeps the previous state', async () => {
     putResponse = { error: 'maxPerRun must be an integer between 1 and 25', status: 400 }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    fireEvent.click(screen.getByLabelText('Missing meta title'))
+    fireEvent.click(await screen.findByLabelText('Missing meta title'))
     await waitFor(() =>
       expect(toastError).toHaveBeenCalledWith('maxPerRun must be an integer between 1 and 25'),
     )
@@ -268,8 +261,7 @@ describe('SeoAutopilotCard', () => {
   it('resets a number field to the last saved value when its PUT fails', async () => {
     putResponse = { error: 'maxPerRun must be an integer between 1 and 25', status: 400 }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const perRun = screen.getByLabelText(/max changes per run/i) as HTMLInputElement
+    const perRun = (await screen.findByLabelText(/max changes per run/i)) as HTMLInputElement
     fireEvent.change(perRun, { target: { value: '9' } })
     fireEvent.blur(perRun)
     await waitFor(() =>
@@ -368,8 +360,7 @@ describe('SeoAutopilotCard', () => {
       pausedTypes: { 'missing-meta-title': reason },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const list = screen.getByRole('list', { name: /paused fix types/i })
+    const list = await screen.findByRole('list', { name: /paused fix types/i })
     expect(list.textContent ?? '').toContain(`Missing meta title — ${reason}`)
     fireEvent.click(within(list).getByRole('button', { name: /resume/i }))
     await waitFor(() => expect(putBodies()).toEqual([{ resumeTypes: ['missing-meta-title'] }]))
@@ -377,8 +368,7 @@ describe('SeoAutopilotCard', () => {
 
   it('Run now is disabled while the policy is disabled and explains why', async () => {
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i }) as HTMLButtonElement
+    const run = (await screen.findByRole('button', { name: /run now/i })) as HTMLButtonElement
     expect(run.disabled).toBe(true)
     expect(run.getAttribute('title')).toMatch(/enable autopilot to run it now/i)
     const hintId = run.getAttribute('aria-describedby')
@@ -397,8 +387,7 @@ describe('SeoAutopilotCard', () => {
       pausedReason: 'manual',
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i }) as HTMLButtonElement
+    const run = (await screen.findByRole('button', { name: /run now/i })) as HTMLButtonElement
     expect(run.disabled).toBe(true)
     expect(run.getAttribute('title')).toMatch(/resume autopilot to run it now/i)
     const hintId = run.getAttribute('aria-describedby')
@@ -410,8 +399,7 @@ describe('SeoAutopilotCard', () => {
   it('Run now carries no hint once it is runnable', async () => {
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i }) as HTMLButtonElement
+    const run = (await screen.findByRole('button', { name: /run now/i })) as HTMLButtonElement
     expect(run.disabled).toBe(false)
     expect(run.getAttribute('title')).toBeNull()
     expect(run.getAttribute('aria-describedby')).toBeNull()
@@ -420,8 +408,7 @@ describe('SeoAutopilotCard', () => {
   it('Run now POSTs /seo/autopilot/run and reloads', async () => {
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const run = screen.getByRole('button', { name: /run now/i })
+    const run = await screen.findByRole('button', { name: /run now/i })
     expect((run as HTMLButtonElement).disabled).toBe(false)
     fireEvent.click(run)
     // Second click while in flight must not queue a second run.
@@ -457,8 +444,7 @@ describe('SeoAutopilotCard', () => {
       },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const summary = screen.getByRole('status', { name: /last run/i })
+    const summary = await screen.findByRole('status', { name: /last run/i })
     expect(summary.textContent ?? '').toMatch(/4 applied/)
     expect(summary.textContent ?? '').toMatch(/1 verify-failed/)
     expect(summary.textContent ?? '').toMatch(/2 reverted/)
@@ -475,8 +461,7 @@ describe('SeoAutopilotCard', () => {
       lastRun: { ...RUN_SUMMARY, halted: true, haltedReason: 'verify_failures' },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const halted = screen.getByRole('status', { name: /run stopped/i })
+    const halted = await screen.findByRole('status', { name: /run stopped/i })
     expect(halted.textContent ?? '').toMatch(/verification failures/i)
     expect(halted.className).toContain('text-warning')
   })
@@ -491,8 +476,7 @@ describe('SeoAutopilotCard', () => {
       lastRun: { ...RUN_SUMMARY, halted: true, haltedReason: 'budget_exhausted' },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const halted = screen.getByRole('status', { name: /run stopped/i })
+    const halted = await screen.findByRole('status', { name: /run stopped/i })
     expect(halted.textContent ?? '').toMatch(/ran out of time/i)
     expect(halted.textContent ?? '').not.toMatch(/daily/i)
   })
@@ -510,8 +494,7 @@ describe('SeoAutopilotCard', () => {
       lastRun: { ...RUN_SUMMARY, halted: true, haltedReason: reason },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const halted = screen.getByRole('status', { name: /run stopped/i })
+    const halted = await screen.findByRole('status', { name: /run stopped/i })
     expect(halted.textContent ?? '').toMatch(copy)
     expect(halted.textContent ?? '').not.toMatch(/stopped with an error/i)
     expect(halted.className).toContain('text-warning')
@@ -524,10 +507,8 @@ describe('SeoAutopilotCard', () => {
       lastRunAt: new Date(Date.now() - 5 * 60_000).toISOString(),
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    expect(screen.getByRole('status', { name: /last run/i }).textContent ?? '').toMatch(
-      /last run 5m ago/i,
-    )
+    const summary = await screen.findByRole('status', { name: /last run/i })
+    expect(summary.textContent ?? '').toMatch(/last run 5m ago/i)
   })
 
   it('offers every autopilot issue type exactly once (mirror of SEO_AUTOPILOT_ISSUE_TYPES)', () => {
@@ -539,10 +520,8 @@ describe('SeoAutopilotCard', () => {
   it('read-only for non-admins', async () => {
     current = { ...SETTINGS, enabled: true, enabledById: 'a' }
     render(<SeoAutopilotCard canEdit={false} onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    expect(
-      (screen.getByRole('switch', { name: /enable autopilot/i }) as HTMLInputElement).disabled,
-    ).toBe(true)
+    const toggle = await screen.findByRole('switch', { name: /enable autopilot/i })
+    expect((toggle as HTMLInputElement).disabled).toBe(true)
     expect((screen.getByLabelText('Missing meta title') as HTMLInputElement).disabled).toBe(true)
     expect((screen.getByLabelText(/minimum brand alignment/i) as HTMLInputElement).disabled).toBe(
       true,
@@ -561,8 +540,7 @@ describe('SeoAutopilotCard', () => {
     }
     const onNavigate = vi.fn()
     render(<SeoAutopilotCard canEdit onNavigate={onNavigate} />)
-    await screen.findByText('SEO Autopilot')
-    const notice = screen.getByRole('region', { name: /governance/i })
+    const notice = await screen.findByRole('region', { name: /governance/i })
     expect(notice.getAttribute('role')).not.toBe('status')
     expect(notice.textContent ?? '').toMatch(/requires approval/i)
     fireEvent.click(within(notice).getByRole('button', { name: /settings → ai/i }))
@@ -577,7 +555,9 @@ describe('SeoAutopilotCard', () => {
       governance: { issueFixApprovalRequired: true, redirectApprovalRequired: false },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
+    // Wait on a loaded control: against the skeleton the negative check below
+    // would pass vacuously.
+    await screen.findByRole('switch', { name: /enable autopilot/i })
     expect(screen.queryByRole('region', { name: /governance/i })).toBeNull()
   })
 
@@ -593,8 +573,7 @@ describe('SeoAutopilotCard', () => {
       governance: { issueFixApprovalRequired: true, redirectApprovalRequired: false },
     }
     render(<SeoAutopilotCard canEdit onNavigate={() => {}} />)
-    await screen.findByText('SEO Autopilot')
-    const live = screen.getAllByRole('status').map((el) => el.getAttribute('aria-label'))
+    const live = (await screen.findAllByRole('status')).map((el) => el.getAttribute('aria-label'))
     expect(live.sort()).toEqual(['Last run', 'Run stopped'])
   })
 

package/src/__tests__/views/updates-tab.render.test.tsx

@@ -110,7 +110,10 @@ describe('UpdatesTab', () => {
 
   it('enables Save when the repo changes and persists via PUT /updates/config', async () => {
     render(<UpdatesTab role="ADMIN" />)
-    await screen.findByText('GitHub Integration')
+    // The GitHub card renders optimistically for admins before /updates/check
+    // resolves, and that response resets the form — wait for the check to land
+    // before typing so the typed value cannot be wiped mid-test.
+    await screen.findByText("You're up to date!")
 
     const save = screen.getByRole('button', { name: 'Save Changes' }) as HTMLButtonElement
     expect(save.disabled).toBe(true)
@@ -133,7 +136,8 @@ describe('UpdatesTab', () => {
 
   it('blocks Save on an invalid repository format', async () => {
     render(<UpdatesTab role="ADMIN" />)
-    await screen.findByText('GitHub Integration')
+    // See above: wait for the check response, not the optimistic card heading.
+    await screen.findByText("You're up to date!")
 
     const repo = screen.getByLabelText('Repository') as HTMLInputElement
     fireEvent.change(repo, { target: { value: 'not a repo' } })

package/src/lib/posts-service.ts

@@ -13,6 +13,7 @@
  * collections the caller's scope can read.
  */
 import { cmsApi } from './api.js'
+import { publicPathFor } from './public-path.js'
 
 export type PostStatus = 'DRAFT' | 'PUBLISHED' | 'SCHEDULED' | 'ARCHIVED'
 
@@ -40,6 +41,12 @@ export interface Post {
   id: string
   title: string
   slug: string
+  /**
+   * Public path (`/{urlPrefix}/{slug}`) built from the collection's
+   * `urlPrefix`, falling back to the collection slug when no prefix is known.
+   * `postTypeId` stays the API identity — never render that as the URL.
+   */
+  publicPath: string
   postTypeId: string
   postTypeName: string
   postTypeAccentColor: string | null
@@ -229,10 +236,14 @@ export async function fetchPosts(query: PostsQuery = {}): Promise<PostsResult> {
   const posts: Post[] = r.posts.map((d) => {
     const type = typeBySlug.get(d.collection)
     const authorName = d.author?.name?.trim() || 'Unknown'
+    const slug = d.slug ?? ''
     return {
       id: d.id,
       title: d.title ?? '(untitled)',
-      slug: d.slug ?? '',
+      slug,
+      // The server resolves `urlPrefix` from the running config (`''` for a
+      // root-mounted collection); a missing type row falls back to the slug.
+      publicPath: publicPathFor(type?.urlPrefix, d.collection, slug),
       postTypeId: d.collection,
       postTypeName: type?.singular ?? d.collection,
       postTypeAccentColor: type?.color ?? null,

package/src/lib/public-path.ts

@@ -0,0 +1,33 @@
+/**
+ * Public path helpers for list-row subtitles.
+ *
+ * A collection's slug (`posts`) is its API / cache-tag / MCP identity; its
+ * `urlPrefix` (`blog`) is where the public site serves it. Editors read the
+ * subtitle as the live URL, so it must be built from the prefix (#921).
+ */
+
+function trimSlashes(value: string): string {
+  return value.replace(/^\/+|\/+$/g, '')
+}
+
+/**
+ * Build the public path for a document.
+ *
+ * - `urlPrefix` non-empty → `/{urlPrefix}/{slug}` (nested prefixes such as
+ *   `help/articles` are kept; stray slashes are trimmed).
+ * - `urlPrefix === ''` → `/{slug}` (collection mounted at the site root).
+ * - `urlPrefix === undefined` → `/{collectionSlug}/{slug}` (no prefix known;
+ *   the collection slug is the best available guess).
+ *
+ * An empty `slug` yields a trailing slash (`/blog/`) so callers can append a
+ * placeholder.
+ */
+export function publicPathFor(
+  urlPrefix: string | undefined,
+  collectionSlug: string,
+  slug: string,
+): string {
+  const prefix = trimSlashes(urlPrefix ?? collectionSlug)
+  const base = prefix ? `/${prefix}` : ''
+  return `${base}/${trimSlashes(slug)}`
+}

package/src/views/Posts/PostsListView.tsx

@@ -825,7 +825,8 @@ function PostRow({
               {post.title}
             </span>
             <span className="text-muted-foreground block truncate text-xs">
-              /{post.postTypeId}/{post.slug || '—'}
+              {post.publicPath}
+              {post.slug ? '' : '—'}
             </span>
           </span>
         </button>

package/src/views/page-editor/sections/ArticleBodySection.tsx

@@ -1,3 +1,5 @@
+import { sanitizeHtml } from '@prenta/core/sanitize'
+
 import type { PageSection } from '../../../lib/page-editor-service.js'
 import { bool, str, type PostRenderContext } from './parts.js'
 
@@ -6,10 +8,9 @@ import { bool, str, type PostRenderContext } from './parts.js'
  * post's own Body field (passed via context); otherwise it renders the
  * section's own `body` copy.
  *
- * The Body field is a `richText` field (sanitized HTML on write), so this
- * canvas preview renders it as HTML — exactly like the public site's
- * article-body renderer — to stay WYSIWYG. It previews the author's own
- * in-progress draft; the server sanitizes (sanitize-html) on save.
+ * The canvas previews the author's in-progress draft, which has not been
+ * through the write-time sanitizer yet. Strip disallowed tags here with the
+ * cms-core allow-list before injecting HTML.
  */
 export function ArticleBodySection({
   section,
@@ -20,7 +21,8 @@ export function ArticleBodySection({
 }) {
   const c = section.content
   const source = str(c, 'source', 'field')
-  const html = source === 'field' ? (context?.body ?? '') : str(c, 'body')
+  const rawHtml = source === 'field' ? (context?.body ?? '') : str(c, 'body')
+  const html = sanitizeHtml(rawHtml)
   const wide = str(c, 'width', 'normal') === 'wide'
   const showToc = bool(c, 'showToc')
 

package/src/views/page-editor/sections/admin-renderers.tsx

@@ -32,6 +32,7 @@
  * renderer falls back to the built-in for that type, or to the placeholder if
  * the type has no built-in, instead of taking down the editor.
  */
+import { sanitizeHtml } from '@prenta/core/sanitize'
 import { createContext, useContext, type ReactNode } from 'react'
 
 /** Structural mirror of `RenderImageProps` from `@prenta/sections-react`. */
@@ -109,13 +110,12 @@ export type AdminSectionRenderer = (props: AdminSectionRendererProps) => ReactNo
 export type AdminSectionRendererMap = Record<string, AdminSectionRenderer>
 
 /**
- * Render options passed to every admin renderer. Rich text is sanitized on
- * write by cms-core, so the canvas (same trust domain as the public default)
- * uses the identity sanitizer; images render as plain lazy `<img>` since the
- * editor canvas has no next/image pipeline.
+ * Render options passed to every admin renderer. Draft HTML is sanitized
+ * with the cms-core allow-list before any renderer injects it. Images render
+ * as plain lazy `<img>` since the editor canvas has no next/image pipeline.
  */
 export const ADMIN_RENDER_OPTIONS: AdminSectionRendererProps['options'] = {
-  sanitizeHtml: (html) => html,
+  sanitizeHtml,
   baseUrl: '',
   // Never grants the priority slot. On a public page exactly one image may
   // load eagerly; in the canvas nothing competes for bandwidth and every