Skip to content

CTC Wiki Source Investigation And Transfer Scope

Read-Only Investigation

  • Confirmed 37 active T_WIKI_PAGE rows in the local CTC QA DB on hub. Client 1 has 19, Client 2 has 18, and TENANT_ID is empty, so CLIENT_ID is kept as the distinguishing key.
  • The CTC source DB was queried only in read-only transactions. The source pages, menus and business data were not changed.
  • For the 3 samples, the original UUID, Client, slug, PAGE_SLUG, metadata, raw audit timestamps, the original Markdown and the SHA-256 are preserved in a separate delivery package.
  • Package: /home/kyle/ops/wikijs/data/imports/ctc-samples-2026-09-28. Manifest SHA-256: ea4b19180516a8da729669b911d1f49f9e5519875adda32f968e86349fdca28a.

The Wiki.js Copies That Were Created

  • Client 1: Container List, Empty Schedule
  • Client 2: Booking List
  • Each copy records the original UUID, the collection date and the menu link that was not restored. The pre-conversion originals are preserved in the package objects/. The three pages were created by hand in the UI, and there is still no general importer that can be re-run.

Attachments And Menu Relations

  • In the source there is no T_FILE WIKI_ASSET relation, and the body has relative image references. Because they could not be connected to the source files, the attachments were not transferred. The text samples have no images.
  • T_MENU candidates that match the three selected pages and the URL were found, but MODULE_PAGE_UUID differs from the T_WIKI_PAGE UUID in every case. The role link could not be verified either, so the menu link was not copied.

Access Control Verification Result

  • The permissions and Page Rules of the Guests group are empty. On an anonymous request the home page moved to the login, and the Client document and administrator paths returned 403.
  • With four temporary Client 1/2 Reader and Publisher accounts, each own-Client page and cross-Client page was requested. All four accounts also received Unauthorized for their own pages, and no document body was returned. The accounts were deleted after the verification.
  • The group permissions and Page Rules are stored per Client path. However, the singleByPath lookup of Wiki.js 2.5.315 checks the manage:pages or delete:pages permission. Giving that to Reader/Publisher would create broader rights such as move/delete, so it was not given. The current CTC copies are visible to administrators only.

Next Pass Conditions

  1. Obtain a safe modification or a version that supports real document reading by the read-only group.
  2. Test again whether, in the four roles, reading/publishing their own Client is allowed and cross-Client reading, searching and attaching is blocked.
  3. Then check the image sources, the internal links and the menu roles, and automate the re-import of the samples and the duplicate/edit-conflict checks.

This page and the transferred copies are not the canonical CTC operations manual. They are not used as real Client deployment material until the Wiki.js side is fixed.