# NFR Requirements Questions — Unit 3: frontend-cms-page

Please answer each question by filling in the letter after the `[Answer]:` tag.  
If none of the options match, choose the last option (Other) and describe your preference.

---

## Question 1
How strict should the URL validation be for the `url` field in `AddCmsInstanceDialog`?

Context: `z.string().url()` (Zod strict) rejects bare IPs without protocol (`192.168.1.5:8080`) and rejects `localhost:5000`. CMS slave instances may live on a local network or development machine.

A) **Strict** — `z.string().url()`. Enforces a valid HTTP/HTTPS URL. User must enter `http://192.168.1.5:8080`. Backend already validates anyway; this prevents obvious typos.

B) **Lenient** — `z.string().min(1)`. Any non-empty string is accepted. Backend is the authoritative validator; client only ensures the field is not empty.

C) **Custom** — Must start with `http://` or `https://`, but the rest is not validated (`z.string().regex(/^https?:\/\//)`). Prevents protocol-less entries without being as strict as full URL parsing.

D) Other (please describe after [Answer]: tag below)

[Answer]: A

---

## Question 2
What test scope applies to the new components and hooks?

A) **Page integration only** — `CmsPage.test.tsx` tests the main flows end-to-end (load list, open Add dialog, set status). Individual components are not tested separately. Keeps the test suite lean.

B) **Hooks + page integration** — Dedicated tests for `useCmsInstances`, `useAddCmsInstance`, `useUpdateCmsInstanceStatus` using `renderHook` + MSW. Page integration test covers the UI flows. Consistent with existing `useUsers` pattern.

C) **Hooks + page + component tests** — In addition to B, dedicated tests for `AddCmsInstanceDialog` and `SetStatusDialog` (error state, DisableMessage conditional, etc.). Matches the `InviteUserDialog.test.tsx` precedent in this project.

D) Other (please describe after [Answer]: tag below)

[Answer]: C

---

## Question 3
How should the `ApiKey` input field behave in `AddCmsInstanceDialog`?

The user copies the API key from the slave CMS admin panel and pastes it here. It is an infrastructure credential, not a user password.

A) **`type="password"`** — Hidden by default. Safe against shoulder surfing. The existing `PasswordField` component with show/hide toggle can be reused.

B) **`type="text"`** — Visible. Easier to verify the pasted value is correct. Acceptable since this is a one-time setup action performed by an Owner in a secure context.

C) Other (please describe after [Answer]: tag below)

[Answer]: A