- GET and PUT /_sitemap/api/v1/settings and POST /_sitemap/api/v1/rebuild
resolve the administrator from a backend token, a personal API token or
the MCP dispatch and require the sitemap permission (401/403 otherwise);
bucket sitemap-api
- PUT changes the fields sent with the settings screen's checks (422
validation_failed, nothing stored), merges the HTML sitemap addresses,
writes content types, generates the IndexNow key and queues a rebuild
- GET answers the settings, the content types, the index files with their
counts, the left-out counts, the IndexNow state and the News source
values
- MCP tools sitemap_get_settings, sitemap_update_settings and
sitemap_rebuild bound to those routes, listed with the permission
- the content type settings write and the file listing move to classes,
shared by the form, S1, the index and the API; S1 and the index now list
the image and News files
- sitemap-news.xml lists the articles (content kind article) first
published in the last two days, newest first, at most 1000, with the
publication name (news_publication, else app.name), the language of the
locale, the publication date and the title
- news_sources narrows it to type:<key> and category:<key>:<id> values;
the Images and News tab lists the values to use in a partial
- the index lists the file while news_enabled is on; otherwise it is 404
BREAKING CHANGE: /sitemap.xsl is gone (404), the definitions screen and
the Phase 17 settings tile are replaced by the settings singleton, and
priority, change frequency, priority tiers and the update manifest are
no longer written or read. The config keys golem15.sitemap.cache_seconds
and golem15.sitemap.priority_tiers are removed; site_url, lastmod_ignore
and rebuild_delay_seconds are new.
- sitemap:import and sitemap:import-winter write the additional addresses
(and site_url, default_locale) instead of the definition
- the golem15_sitemap_definitions table stays in the database, unread
- one settings tile opening the golem15.sitemap.settings singleton
- Files tab (site address, file size, S1 files partial), Additional
addresses repeater, Content types tab built from signpost at boot
- golem15_sitemap_types; a type switched off leaves the files (reason type)
- a save validates (errors.*) and dispatches a rebuild after commit
- Settings.BeforeValidate answers a cabana validation error on
frontend_url, so the settings save is a 422 and the row is unchanged
- sitemap:import-winter stops on a frontend_url that
models.AllowedFrontendURL refuses, before the dry-run branch and before
any database use; the value is printed quoted
- errors.frontend_url phrase in en and pl
- TestSettingsBeforeValidate, TestWinterSettingsFrontendURL and the save
and import refusals in the Postgres smokes
A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.
- The definitions form refuses, per row, a url that is not a path or an
http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
with a report line; sitemap:import refuses such an entry.
- definitions singleton controller (theme default, first or create) with a
repeater on data: type dropdown (url plus registry types), reference
dependsOn type through signpost.ReferenceOptions
- Settings page entries: Sitemap (link to the controller) and Sitemap
settings (form), both behind golem15.sitemap.access_definitions
- en and pl phrasebooks with the PHP keys
- README with the PHP parity rules, tiers, hooks, commands and the Winter
YAML adaptations
- TestSitemapAdminSmoke: singleton, PHP-keyed rows, 422 on a foreign
reference, settings save, 403 without the permission
