fix(cms): enforce public publication contract

src/app/(frontend)/[[...slug]]/page.tsx

@@ -11,6 +11,7 @@ import { normalizeFooterData, normalizeHeaderData } from '@/spa/cmsNavigation'
 import type { CmsRouteCollection, CmsRouteDoc } from '@/spa/cmsRoute'
 import { normalizeNewsletterFormData, type SpaNewsletterFormData } from '@/spa/newsletterForm'
 import { normalizeSiteSettings, type SpaSiteSettingsData } from '@/spa/siteSettings'
+import { getPublicationQueryOptions } from '@/utilities/publicationQuery'
 
 export const dynamic = 'force-dynamic'
 
@@ -43,8 +44,7 @@ async function findRouteDoc(payload: Awaited<ReturnType<typeof getPayload>>, pat
   const result = await payload.find({
     collection: target.collection,
     depth: 1,
-    draft,
-    overrideAccess: draft,
+    ...getPublicationQueryOptions(draft),
     limit: 1,
     pagination: false,
     where: {
@@ -63,8 +63,7 @@ async function findList(payload: Awaited<ReturnType<typeof getPayload>>, collect
   const result = await payload.find({
     collection,
     depth: 1,
-    draft,
-    overrideAccess: draft,
+    ...getPublicationQueryOptions(draft),
     limit: 300,
     pagination: false,
     ...(collection === 'partners' || collection === 'jury-mitglieder' ? { sort: 'sortOrder' } : {}),
@@ -77,8 +76,7 @@ async function findSupportPages(payload: Awaited<ReturnType<typeof getPayload>>,
   const result = await payload.find({
     collection: 'pages',
     depth: 1,
-    draft,
-    overrideAccess: draft,
+    ...getPublicationQueryOptions(draft),
     limit: 10,
     pagination: false,
     where: {

src/utilities/publicationQuery.ts

@@ -0,0 +1,22 @@
+export type PublicationQueryOptions = Readonly<{
+  draft: boolean
+  overrideAccess: boolean
+}>
+
+const publicPublicationQuery = Object.freeze({
+  draft: false,
+  overrideAccess: false,
+}) satisfies PublicationQueryOptions
+
+const previewPublicationQuery = Object.freeze({
+  draft: true,
+  overrideAccess: true,
+}) satisfies PublicationQueryOptions
+
+/**
+ * Keeps public Local API reads access-controlled while allowing the authenticated
+ * Next.js draft-mode route to intentionally load the latest draft versions.
+ */
+export function getPublicationQueryOptions(isPreview: boolean): PublicationQueryOptions {
+  return isPreview ? previewPublicationQuery : publicPublicationQuery
+}