Question About Public Submissions

[rainbowforgedev]

Hello there!

I'm wondering if there might be any possible way to either currently use Sveltia or extend Sveltia to be able to take public submissions?

I anticipate that simply making an access token and publishing it to the web would be very bad for security etc. so I was wondering if there might be a way to make it so that public repositories can accept submissions from any gh/gl user? Or is this already possible and I just don't realize it?

The use case I'm considering is to create a directory site where people can submit their own information and have it reviewed by maintainers locally prior to building and deploying changes, similarly to how a WP site might have a contact form that creates a new draft post in a custom post type but instead using SveltiaCMS itself as the submission form if that makes sense? I presume such a site would have to live on a subdomain/separate domain and probably an entirely separate dedicated gh/gl account in order to ensure security for the marketing/other aspects of the website, and that's fine by me.

Please let me know if any of that doesn't make sense or if I'm missing something?

Thanks so much in advance for your time and energy!!

[kyoshino]

I think you’re talking about open authoring. It’s one of the Netlify CMS features we haven’t implemented yet, but we plan to add it in the coming months. I have seen some people waiting for this feature.

[kyoshino]

This is the Netlify/Decap CMS doc for open authoring: https://decapcms.org/docs/open-authoring/

We’re going to implement it in Sveltia CMS.

[rainbowforgedev]

Cooool thank you so much for sharing this I really appreciate it!!! I think this is pretty close to what I'm hoping for! I was thinking maybe I could try to set up a new public gh/gl account and a PAT with a very limited scope and share that publicly so people can just log in using that, which would probably be a bad idea from a security perspective, right?

But yeah open authoring seems like something I could make work! And once again thank you so much for all your hard work on Sveltia it genuinely seems like the best static CMS I've found in my search so far :>

[kyoshino]

Yes, for obvious security reasons, you should avoid sharing a PAT publicly because its scope is simply read/write. Anyone with the PAT would be able to create, update or delete all the files in your repo.

We really have to implement open authoring 😉

[rainbowforgedev]

Thank you so much for taking the time to explain I really appreciate it!!!