Edit
Editing simulator
The client journey, reproduced in the page: the key, the overlay, the editing gestures, publishing, the conflict. Nothing is written anywhere.
Scenarios
Fully simulated: nothing is sent anywhere, no repository exists, and the draft is stored in
your browser — as in the real tool. The demo key is boulangerie-2026.
What to try
One minute
The normal journey
Enter the key, click the big heading, change it, change its size and colour, then publish. Watch the Server panel while publishing: that is the real order of checks.
Two minutes
What goes wrong
Tick “Someone publishes while you edit”, then publish: the conflict message is the one the client will see. Your changes are kept.
Thirty seconds
Brute force
On the entry screen, type five wrong keys in a row. On the sixth attempt the message changes: that is rate limiting, the project's most critical security point.
One minute
Pasting from a word processor
Copy a formatted paragraph from a word processor and paste it into the intent paragraph. Fonts, sizes and colours vanish: only the text, the bold and the italic remain.
One minute
A list
Hover a review: duplicate it, move it, delete one. Watch the ids in the Content panel — a deleted id is never reassigned.
Thirty seconds
The draft
Change a text without publishing, then reload this page. A banner offers to pick up where you left off: nothing is lost if the browser closes.
What the simulator reproduces faithfully
- The five style settings, drawn from the same lists as the schema — impossible to leave the theme.
- The four rich-text commands, and nothing else: exactly the allowed tags.
- Complete overwriting of formatting on paste.
- Reading a YouTube or Vimeo address, in all its forms.
- Mandatory confirmation when deleting a list item.
- The local draft and its resume banner.
- The server-side order of checks: rate, size, identity, schema, lock, write.
- The optimistic lock and its conflict message, in plain language.
- The limit of five key attempts per quarter of an hour.
- The message shown on small screens, rather than a degraded interface.
How it differs from the real tool
| Here | For real |
|---|---|
| The fake site page is built by the browser. | It is built by Astro at build time: all content is in the served HTML. |
| The key is compared in the page. | It goes to /api/auth and is compared server-side only, in constant time, against an argon2id hash. |
| Publishing writes to a variable. | It produces a commit in the repository, then a site rebuild in 30 to 60 seconds. |
| The image stays in your browser. | It is cropped and converted in the browser, then checked from its bytes, renamed and stored by the function. |
| The Content panel is on display. | The client never sees the JSON, nor any tree: that is a project rule. |
| The attempt counter lives in the tab. | It lives in storage shared between function instances. |
For real, in ten minutes and with no repository: Local setup.