# Hotfix10 Template Admin Architecture

## Admin capabilities

`Admin -> Templates` manages the same filesystem library used by deployment tooling. It supports:

- single or multiple ZIP uploads;
- staging and archive safety validation;
- Free/Pro selection;
- metadata editing and publication state;
- institution/university assignment and reusable institution records;
- country/region, degree, faculty/department, category, journal/publisher/conference;
- provenance, original source/author, license/attribution;
- entry file, compiler, bibliography engine, document class, required packages;
- tags and manually editable template features;
- version, last-verified date, preview/thumbnail and SEO fields;
- replacement, archive, validation and Assets Sync;
- bulk classification/tier operations.

## ZIP safety

Archives are staged before publication. The import layer rejects traversal/absolute paths, links, unsafe executable-like payloads, excessive file counts and unpacked size, malformed/conflicting paths and unusable projects. Replacement does not partially overwrite the live template on validation failure.

## Institutions

Reusable records live in `texise-templates/institutions.json`. Admin can create/edit/merge institutions and map templates to stable institution IDs, avoiding duplicate spellings such as `UNSW`, `UNSW Sydney` and `University of New South Wales` becoming separate taxonomy entities.

## Structural validation

`Validate Template` checks project structure and reports the detected root TeX file, document class, packages, bibliography resources, missing assets/metadata and institution/provenance/license warnings. It deliberately does not execute arbitrary uploaded LaTeX in the privileged server process.

## Protected delivery while remaining in public_html

Template directories stay physically in the release tree as required, but Apache denies direct HTTP access to the raw Free/Pro source trees. Public catalog/preview metadata is separate. Project source is requested through `/api/templates/{slug}/files/...`; Pro access is checked server-side against authenticated entitlement and protected responses are not publicly cached.

This is anti-scraping/access-control, not DRM: an authorized user who opens a template necessarily receives its source in their browser.