ruoyi-vue-pro/docs/education/migration/issues/EDU-010-content-publication.md

EDU-010 — Tenant content publication and graph integrity

• Status: in progress — catalog graph-integrity, the verified JAVA_READ tenant-question lifecycle, and Question Placement slices are delivered; category, collection, and blueprint authoring remain
• Type: implementation program
• Phase: 3
• Blockers: EDU-004 ✓ (done), EDU-009 ✓ (done), provider-authority decision ✓ (resolved 2026-07-30, see decisions.md), PUBLIC graph-semantics decision ✓ (resolved 2026-07-30, see decisions.md)

Tenant-admin outcome

Authorized tenant administrators can author, classify, publish, archive, and retire education content without creating cross-tenant or invalid PUBLIC/tenant relationships, and student reads remain consistent with publication state.

Scope

• Question banks, questions, versions, classifications, catalogs, collections, blueprints, and bindings.
• Draft/published/archived lifecycle.
• System RBAC/DataPermission enforcement.
• Tenant-consistent graph constraints or equivalent transactional enforcement.
• Provider consistency between authoring source and student reads.
• Safe projections preserved from EDU-001.

Acceptance criteria

• Admin permission and data-scope matrix is explicit.
• Cross-tenant graph relationships cannot be persisted in the current V4020 catalog graph.
• PUBLIC and tenant-owned reference rules are enforced across the current 19 reference edges, with exact trigger-mapping and focused behavior tests.
• V4080 extends the graph guard to the new Question Version → Question edge and makes the version table the twelfth ownership-protected catalog table.
• Unpublished/archived content is never student-visible.
• Publication is transactional and auditable.
• Tenant Question Placement is permission-separated, tenant-safe, optimistic, and frozen after publication.
• Database graph-integrity changes use flyway-postgresql and forward migrations V4070/V4090.

Delivery progress — graph-integrity slice (2026-07-30)

Delivered:

• V4070__enforce_catalog_reference_scope.sql guards all 19 current foreign-key edges and makes ownership scope immutable on all 11 catalog tables:
  • PUBLIC children may reference only PUBLIC parents;
  • tenant-owned children may reference PUBLIC or same-tenant parents;
  • cross-tenant and PUBLIC-to-tenant references fail closed;
  • tenant_id and scope cannot change after insert, so parent mutations and concurrent ownership moves cannot invalidate existing children.
• V4070 installs write guards before historical pre-validation, eliminating the migration-time validation/write window. The reference trigger function uses a fixed search_path, locks referenced rows during validation, and exposes no PUBLIC execute grant.
• Real PostgreSQL/Flyway integration tests cover fresh and 4009-baselined migration histories, allowed and rejected references, parent ownership immutability, exact configuration of all 19 reference guards and 11 scope guards, function ACLs, and historical invalid-data failure.

No non-Education module changed. Application rollback can disable native authoring when it is introduced; database recovery remains a higher forward migration and must preserve existing content.

Publication-slice constraints (resolved)

Do not add a local-only admin write path while SCALAR_READ remains the default authoritative provider: a successful PostgreSQL write would not be visible to students. The implemented bounded slice is a JAVA_READ-only tenant question draft → publish → archive → student read path that fails closed in unsupported provider modes.

The slice resolves the prerequisite decisions as follows:

1. the command surface is DRAFT → PUBLISHED → ARCHIVED; RETIRED remains undefined, and V4020 HIDDEN/INACTIVE rows map to ARCHIVED;
2. Education owns immutable question versions and transactional lifecycle audit;
3. a question's state controls direct visibility while entry/node/collection availability gates only route-specific discovery;
4. tenant admin action permissions are separate, tenant-wide, and tenant-bound; platform-curator/PUBLIC writes fail closed in this slice.

Delivery progress — JAVA_READ tenant-question lifecycle slice (2026-07-30)

Delivered:

• Explicit Admin APIs and independent RBAC permissions for tenant question author, publish, and archive operations. Requests cannot choose tenant, scope, lifecycle, or actor identity:
  • POST /admin-api/education/questions/drafts — education:question:author;
  • PUT /admin-api/education/questions/{id}/publish — education:question:publish;
  • PUT /admin-api/education/questions/{id}/archive — education:question:archive.
• Provider-authority guard: authoring is accepted only for JAVA_READ; SCALAR_READ fails before any Mapper access.
• V4080 changes native defaults to DRAFT/false, normalizes legacy visibility states, fails closed on unsafe historical published content, constrains the single direction DRAFT → PUBLISHED → ARCHIVED, creates immutable Question Content Versions, and creates append-only lifecycle audit facts.
• V4080 adds the Question Version → Question reference as the twentieth guarded catalog edge. In addition to the generic scope rule, a version's tenant and scope must exactly equal its question's ownership; the version table is the twelfth catalog table protected against ownership mutation.
• When the adopted platform schema contains system_menu, V4080 conditionally seeds the Education capability plus author/publish/archive permissions. A fixed ID already occupied by a different permission aborts migration, and no role assignment is seeded.
• Publication and archive use tenant/scope/expected-state CAS updates and append audit facts in the same transaction. Audit failure rolls back the state change.
• PostgreSQL integration-test coverage exercises the student read-after-write seam: draft is invisible, published content is returned only through the existing Safe Question projection, and archived content is invisible while stored snapshots remain independent.
• Direct question visibility is controlled by the question lifecycle. Container availability is a route-level discovery gate; Question Placement is delivered separately below, while Category, Collection, and platform-curator write paths remain outside the lifecycle slice.

Permission and data-scope matrix is recorded in 07-decisions.md. The three lifecycle endpoints manage tenant-wide shared catalog assets within the current framework tenant; department/self DataPermission does not grant additional row access, PUBLIC authoring fails closed, and the V4080 seed intentionally grants no role.

The listed acceptance criteria are satisfied for the native catalog graph, tenant-question lifecycle, and Question Placement slices. EDU-010 remains in progress because its tenant-admin outcome also includes Category, Collection, Blueprint, Retire, and platform-curator workflows that are not part of these bounded slices.

Delivery progress — JAVA_READ Question Placement slice (2026-07-30)

Delivered:

• PUT /admin-api/education/questions/{id}/placement uses the independent education:question:classify permission. The request contains only nodeId and expectedPlacementVersion; tenant, scope, actor, lifecycle, and ownership remain server-controlled.
• Only current-tenant TENANT_OWNED drafts can be placed. A target must be a visible, active, selectable PUBLIC or same-tenant Content Node. SCALAR_READ fails before Mapper access, and tenant endpoints cannot manage PUBLIC questions.
• Placement uses a monotonic optimistic version and tenant/scope/status/version CAS. Repeating the current placement is rejected as a conflict; two writers using the same expected version have one winner.
• Publication requires a stable available placement and includes the validated placement version in its lifecycle CAS. V4090 prevents direct PUBLIC placement, requires exact placement-version advancement, freezes placement after publication, and rejects publication without an available node.
• Student node-route reads join Question and Content Node in one PostgreSQL statement. A hidden, inactive, non-selectable, cross-scope, or deleted node cannot expose questions through that route; direct question visibility still follows the question Publication State.
• V4090 conditionally seeds education:question:classify at fixed ID 6805, fails closed on conflicting rows, and grants no role.

Category CRUD, Content Node authoring, Collection/Blueprint authoring, PUBLIC curator workflows, and a distinct Retire state remain outside this slice. In the target domain, education_category is not connected to Question; the delivered classification seam is explicitly Question Placement through question.node_id.

Verification evidence (2026-07-30)

• mvn -pl yudao-module-education clean test with the five EDU_TEST_POSTGRES_* variables pointed at the local Docker PostgreSQL: 502 tests passed, including 20 Flyway migration tests and nine lifecycle/placement PostgreSQL integration tests. V4090 was actually executed in disposable PostgreSQL schemas.
• The lifecycle integration tests prove concurrent double-publish has one success and one lifecycle conflict with exactly one publish audit, cross-tenant and PUBLIC management fail closed, and draft → publish → archive matches student visibility.
• The real Spring Method Security contract tests prove each of author/classify/publish/archive requires its own permission and rejected calls do not reach the lifecycle service.
• mvn -pl yudao-server -am -DskipTests clean compile: 22 reactor modules passed.
• git diff --check: passed.
• target/classes/db/migration/education/V4080__add_question_publication_lifecycle.sql and V4090__add_question_placement.sql: present after the module build.

Risk and rollback

• Risk: High content-integrity and authorization risk.
• Rollback: Before rolling the application back behind V4090, disable native authoring by switching away from JAVA_READ (or disable Education when no alternate read authority is configured). Preserve V4090 data and schema, then correct forward. A V4080 application left writable in JAVA_READ is intentionally rejected when it attempts to publish an unplaced draft.