# Eventsa — Backend Patch 01: ownership of menus and sliders

## Install
Extract into the **existing backend project root** (the folder with `package.json` and `src/`).
On macOS, take a backup before extraction:

```bash
cd "/PATH/TO/eventsa-backend-p0-fixed-2026-09-16"
cp -R src/menus ../menus-backup-before-patch01
cp -R src/sliders ../sliders-backup-before-patch01
unzip -o "$HOME/Downloads/eventsa-backend-patch-01-site-content.zip" -d .
npm run build
npm run test:regression -- --runTestsByPath regression/site-content-scope.spec.ts
```

Restart the backend after a successful build. There is **no database migration** or new dependency.

## What changed
- Tenant-scoped menu / slider read, update, delete and listing, with server-side ownership checks.
- A requested site ID can no longer override the authenticated tenant's site ID.
- Public `menusApi`, `menuApi`, and `slidersApi` expose only published content. The list APIs require the correct site ID.
- Slider image processing occurs only after ownership is checked.
- Invalid permission or missing site ownership fails closed; unknown database errors propagate rather than pretending a save succeeded.
- Superadmin retains cross-site administrative access.

## What this patch does NOT do
- It does not activate edit/delete buttons in the unified frontend (Phase 9 deliberately hid them).
- It does not fix unrelated attendance, enrollment, payment, or chat backend scope issues.
- It was checked statically here, but full Nest build/DB integration require dependencies and a running database.

## Smoke tests (two sites: A, B)
1. Login as site A manager. Read A menu/slider, edit and delete an expendable item: permitted when role grants those permissions.
2. Try `menu(id:B)` and `slider(id:B)`, update and delete B IDs: must fail.
3. Request `menus({siteid:B})` and `sliders({site:B})` while logged into A: must fail.
4. Unauthenticated `menusApi({siteid:A})` and `slidersApi({site:A})`: only published A rows. Drafts absent even if caller passes `status:false`.
5. Verify current homepage receives published menus/sliders; check superadmin access separately.

Backend ZIP is a patch, not a full backend or a frontend replacement.