/*
 * Copyright 2026, Jaime Terrats.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
import { workflow } from '../workflow-generator.js';
export function generateExperienceCloudWorkflows(version) {
    return {
        'experience-cloud-dev.md': workflow(version, 'Experience Cloud Development', `
## 1. Identify the Site

Ask:
- Which Experience Cloud site is being modified? (Community name or API name)
- Is this an LWR or Aura site?
- What is the target org alias?

Read \`force-app/main/default/experiences/\` and \`force-app/main/default/sites/\` to understand existing structure.

## 2. LWR vs Aura Architecture Check

| Concern | LWR | Aura |
|---------|-----|------|
| Component type | LWC only | LWC + Aura |
| Routing | Wire-based | Aura event bus |
| Styling | CSS Modules + SLDS | Aura token system |
| Deploy | \`sf community publish\` required | Standard metadata deploy |

## 3. Guest User Security

- **Always use \`WITH USER_MODE\` or \`Security.stripInaccessible\`** on every SOQL query accessed by guest users.
- Review Object/Field-Level Security for the Guest User profile after every schema change.
- Never expose PII fields through public Knowledge articles or Experience pages without FLS validation.

## 4. CMS Content and Navigation

- Create CMS content types in \`force-app/main/default/cmsContent/\`.
- Navigation menus managed via Experience Workspaces — not in metadata.
- Branding sets should reference SLDS design tokens where possible.

## 5. Deploy and Publish

\`\`\`bash
# Deploy metadata (components, site config)
sf project deploy start -d force-app --target-org <alias>

# Publish site changes (required after LWR content changes)
sf community publish --name "<SiteName>" --target-org <alias>
\`\`\`

## 6. Record Evidence

\`\`\`bash
sf setup-agents evidence add --task <id> --role experience-cloud --type command --summary "Experience Cloud site deployed and published: <SiteName>"
\`\`\`
`),
        'guest-user-security.md': workflow(version, 'Guest User Security Audit', `
## 1. Gather Context

- Which Experience site is being audited?
- What Apex classes, SOQL queries, or data-sharing rules are exposed to guest users?

## 2. SOQL Guest Access Checklist

For every SOQL query reachable by the guest user:
- [ ] Uses \`WITH USER_MODE\` or \`Security.stripInaccessible(AccessType.READABLE, ...)\`
- [ ] Does NOT query: Account (unless explicitly shared), Contact, User, PII custom objects
- [ ] Knowledge articles use public filtering (Published AND IsVisibleInPkg = true)

## 3. FLS Validation

\`\`\`apex
List<Account> accounts = [SELECT Id, Name FROM Account WITH USER_MODE];
// OR
SObjectAccessDecision decision = Security.stripInaccessible(AccessType.READABLE, accounts);
accounts = (List<Account>) decision.getRecords();
\`\`\`

## 4. Sharing Model Check

- [ ] Objects exposed to guest have explicit OWD sharing: Public Read Only (minimum)
- [ ] Guest Profile has only necessary object/field permissions
- [ ] No Apex \`without sharing\` classes called from guest-accessible controllers

## 5. Produce Findings

Record your audit:
\`\`\`bash
sf setup-agents evidence add --task <id> --role experience-cloud --type report --summary "Guest user security audit complete: <findings>"
\`\`\`
`),
    };
}
//# sourceMappingURL=experience-cloud.js.map