docs/architecture/key-files.md

@@ -3,7 +3,7 @@ type: architecture
 title: Key Files Index
 description: One-line responsibility for every important source file in the repository.
 tags: [architecture, index, key-files]
-timestamp: 2026-07-21T18:28:00Z
+timestamp: 2026-07-21T18:45:54Z
 ---
 
 # Backend
@@ -116,8 +116,8 @@ timestamp: 2026-07-21T18:28:00Z
 | `frontend/src/app/core/services/auth.session-storage.ts` | Pure `sessionStorage` helpers (`readStoredSession`, `writeStoredSession`, `clearStoredSession`) under key `hipctf.auth.v1`. |
 | `frontend/src/app/core/services/bootstrap.service.ts` | Fetches `/api/v1/bootstrap`, applies theme tokens to CSS; `load()` / `ready()` deduplicate the in-flight fetch. |
 | `frontend/src/app/core/services/admin.service.ts`  | `GET /api/v1/admin/users` returning `AdminUser[]`.                            |
-| `frontend/src/app/core/services/markdown.service.ts` | `MarkdownService` (Angular) wraps `DomSanitizer.bypassSecurityTrustHtml` around the rendered Markdown. |
-| `frontend/src/app/core/services/markdown.pure.ts`   | Pure `renderMarkdownToHtml` helper using `marked` + `DOMPurify` (kept in its own file so it can be unit-tested without Angular's ESM-only runtime). |
+| `frontend/src/app/core/services/markdown.service.ts` | Thin Angular `MarkdownService.render(md): string` that forwards to `renderMarkdownToHtml`. The DOMPurify sanitization happens inside `renderMarkdownToHtml` so Angular's `[innerHTML]` binding receives a sanitized plain string — no `DomSanitizer.bypassSecurityTrustHtml` wrapper is required. |
+| `frontend/src/app/core/services/markdown.pure.ts`   | Pure `renderMarkdownToHtml` helper using `marked` + `DOMPurify` (kept in its own file so it can be unit-tested without Angular's ESM-only runtime and so the sanitization boundary is shared between production and tests). |
 | `frontend/src/app/core/guards/auth.guard.ts`        | Async `CanActivateFn`; awaits bootstrap + auth hydration, delegates to `decideAuthRedirect`. |
 | `frontend/src/app/core/guards/auth.guard.decision.ts` | Pure decision function for the auth guard (returns `true` or a redirect `UrlTree`). |
 | `frontend/src/app/core/guards/admin.guard.ts`       | Async `CanActivateFn` for admin-only routes; awaits bootstrap + auth hydration, delegates to `decideAdminGuard`. |
@@ -126,7 +126,7 @@ timestamp: 2026-07-21T18:28:00Z
 | `frontend/src/app/core/guards/landing.guard.decision.ts` | Pure decision: returns `true` to render the landing page, or `UrlTree` to `/bootstrap` (not initialized) or `/` (already authenticated). |
 | `frontend/src/app/core/interceptors/auth.interceptor.ts` | Attaches Bearer header.                                                     |
 | `frontend/src/app/core/interceptors/csrf.interceptor.ts` | Attaches `X-CSRF-Token` on unsafe methods.                                  |
-| `frontend/src/app/features/landing/landing.component.{ts,html,css}` | Public landing page (logo, page title, rendered `welcomeMarkdown`, login button, blog list) + modal containing the login and registration forms (toggled by the same `mode` signal). |
+| `frontend/src/app/features/landing/landing.component.{ts,html,css}` | Public landing page (logo, page title, rendered `welcomeMarkdown`, login button, blog list) + modal containing the login and registration forms (toggled by the same `mode` signal). The template binds the welcome card via `[innerHTML]="welcomeHtml()"` (the computed signal **invoked**); binding the raw `welcomeHtml` signal object would render the runtime helper source — see `tests/frontend/landing-welcome.spec.ts`. |
 | `frontend/src/app/features/landing/landing.service.ts` | Fetches `GET /api/v1/blog/posts`, exposes `posts`/`loading`/`error` signals, `refresh()`. |
 | `frontend/src/app/features/landing/login-modal.service.ts` | Pure `buildLoginFailureMessage` helper that maps `{code,message}` into user-facing copy (handles `INVALID_CREDENTIALS`, `RATE_LIMITED`, `CSRF_INVALID`, `USERNAME_TAKEN`, `WEAK_PASSWORD`, `REGISTRATIONS_DISABLED`, `VALIDATION_FAILED`). |
 | `frontend/src/app/features/admin/admin-users.component.ts` | Admin-only user list (signals: `loading`, `error`, `users`).           |
@@ -150,6 +150,7 @@ timestamp: 2026-07-21T18:28:00Z
 | `tests/frontend/guard-bootstrap-race.spec.ts` | Pins `decideAuthRedirect` so a refresh on a deep link never flashes `/bootstrap` or `/login` while auth is hydrating. |
 | `tests/frontend/landing-guard.spec.ts`        | Pins `decideLandingGuard` for the not-initialized / authenticated / anonymous branches. |
 | `tests/frontend/landing-markdown.spec.ts`     | Pins `renderMarkdownToHtml` (sanitization of raw `<script>` payloads, script URL schemes, etc.). |
+| `tests/frontend/landing-welcome.spec.ts`     | Regression test for the landing welcome binding — asserts the bootstrap payload's `welcomeMarkdown` produces the expected sanitized HTML (h1 + paragraph) and never the Angular runtime helper source string, including for null/empty/hostile payloads. |
 | `tests/frontend/landing-modal.spec.ts`       | Pins `buildLoginFailureMessage` (`INVALID_CREDENTIALS`, `RATE_LIMITED` with retry-seconds extraction, `CSRF_INVALID`, `USERNAME_TAKEN`, `WEAK_PASSWORD`, `REGISTRATIONS_DISABLED`, `VALIDATION_FAILED`, default fallback). |
 | `tests/backend/auth-register.spec.ts`         | Backend integration tests for `POST /api/v1/auth/register` (happy path, disabled flag, duplicate username, weak password, rate limit). |
 | `tests/backend/blog-public.spec.ts`           | Backend integration tests for `GET /api/v1/blog/posts` (only published rows, descending order). |

docs/guides/landing-page.md

@@ -3,7 +3,7 @@ type: guide
 title: Landing Page
 description: How the public landing page renders, how the login + registration modal is opened, and what each form does.
 tags: [guide, landing, login, register, ui]
-timestamp: 2026-07-21T18:28:00Z
+timestamp: 2026-07-21T18:45:54Z
 ---
 
 # What you see
@@ -20,9 +20,13 @@ On a fresh visit the page shows, in order:
 2. **Page title** — `<h1 data-testid="landing-title">` rendered from
    `BootstrapService.payload().pageTitle` (defaults to `HIPCTF`).
 3. **Welcome card** — `<article data-testid="landing-welcome">` whose
-   `innerHTML` is the sanitized render of
+   `innerHTML` is bound to the computed signal `welcomeHtml()`, i.e. the
+   sanitized HTML render of
    `BootstrapService.payload().welcomeMarkdown` (via
-   `MarkdownService.render` → `marked` + `DOMPurify`).
+   `MarkdownService.render` → `renderMarkdownToHtml` → `marked` +
+   `DOMPurify`). The binding **must** invoke the signal (`welcomeHtml()`),
+   not the signal object — see [Key Files Index](/architecture/key-files.md)
+   for the `landing.component.html` entry that pins this.
 4. **Login button** — `<button data-testid="landing-open-login">`.
 5. **Blog list** — `<section data-testid="landing-blog">` listing every
    row returned by `GET /api/v1/blog/posts` (only `status='published'`

docs/index.md

@@ -11,7 +11,7 @@ scoreboard, an event window with a public countdown, theming, and admin
 controls.
 
 The docs below are organized by purpose so agents can pull just the slice
-they need. Last regenerated 2026-07-21T18:28:00Z.
+they need. Last regenerated 2026-07-21T18:45:54Z.
 
 # Architecture