docs

docs/backend-platform/static-pages-system.md

@@ -0,0 +1,62 @@
+# Static Pages System
+
+## 1. Endpoint
+- Method: `GET`
+- Path: `/pages/:slug`
+- Scope: tenant-aware by request domain
+
+Supported slugs (example set):
+- `about-us`
+- `privacy-policy`
+- `terms-of-service`
+- `returns-policy`
+
+## 2. Storage Model
+Pages are stored per tenant:
+- key: tenantId + slug
+- multilingual content map (locale -> HTML)
+- optional SEO metadata per locale
+- status (published/draft)
+
+## 3. Example Response
+```json
+{
+  "slug": "about-us",
+  "title": {
+    "en": "About Us",
+    "ru": "О компании",
+    "hy": "Մեր մասին"
+  },
+  "content": {
+    "en": "<h1>About Us</h1><p>...</p>",
+    "ru": "<h1>О компании</h1><p>...</p>",
+    "hy": "<h1>Մեր մասին</h1><p>...</p>"
+  },
+  "seo": {
+    "title": { "en": "About Us" },
+    "description": { "en": "Company information" }
+  },
+  "updatedAt": "2026-07-05T09:00:00Z"
+}
+```
+
+## 4. Frontend Rendering Rule
+Frontend renders static pages via safe HTML flow only:
+- resolve locale-specific HTML
+- sanitize before binding
+- bind to template as trusted/safe HTML only in static page component context
+
+## 5. Security Considerations
+Backend requirements:
+- content moderation/validation pipeline
+- disallow dangerous tags/attributes at content publishing stage
+- maintain revision history and audit trail
+
+Frontend requirements:
+- enforce sanitizer before rendering
+- no raw HTML injection in arbitrary components
+
+Platform requirements:
+- tenant isolation on page retrieval
+- cache with tenant+slug key
+- return 404 for missing slug in tenant scope