[VS-NfD] Decide the fate of page_links rows pointing at purged pages #235

New Issue

fable-5 · 2026-07-30T01:44:02+02:00

fable-5 commented

2026-07-30 01:44:02 +02:00

Plan reference: n/a — 10-ist-aufnahme.md -> I-24
ADR: n/a
Effort: S (0,5 AT)
Depends on: —
Milestone note: cheapest issue in the set; deliberately a decision, not
necessarily a change.

Context

After a page is purged, other pages' link rows keep its slug. A slug
carries the page title, and for a classified page that can itself be
protected information.

Current state

PageLink.fromPage is onDelete: Cascade, toPage is
onDelete: SetNull (apps/api/prisma/schema.prisma:441–461). Purging a
page nulls to_page_id but leaves target_slug in place — by design,
because that is what makes a "phantom" link resolve again if a page with
that slug reappears.

Acceptance criteria

A decision is made and documented: either purge-time deletion of
rows whose target_slug matches the purged page (losing phantom-link
re-resolution), or keeping them as an accepted residue.
If kept: recorded in #231 with its reasoning, and named in the
deletion chapter of #229 so an operator can answer for it.
If deleted: a test proves no row referencing the purged slug
survives, and the phantom-link behaviour change is noted in the
release notes.

Out of scope

Redesigning the wikilink index.

**Plan reference:** n/a — `10-ist-aufnahme.md` -> I-24 **ADR:** n/a **Effort:** S (0,5 AT) **Depends on:** — **Milestone note:** cheapest issue in the set; deliberately a decision, not necessarily a change. ## Context After a page is purged, other pages' link rows keep its slug. A slug carries the page title, and for a classified page that can itself be protected information. ## Current state - `PageLink.fromPage` is `onDelete: Cascade`, `toPage` is `onDelete: SetNull` (`apps/api/prisma/schema.prisma:441–461`). Purging a page nulls `to_page_id` but leaves `target_slug` in place — by design, because that is what makes a "phantom" link resolve again if a page with that slug reappears. ## Acceptance criteria - [ ] A decision is made and documented: either purge-time deletion of rows whose `target_slug` matches the purged page (losing phantom-link re-resolution), or keeping them as an accepted residue. - [ ] If kept: recorded in #231 with its reasoning, and named in the deletion chapter of #229 so an operator can answer for it. - [ ] If deleted: a test proves no row referencing the purged slug survives, and the phantom-link behaviour change is noted in the release notes. ## Out of scope Redesigning the wikilink index.

fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:44:02 +02:00

fable-5 added the

area:storage

vs-nfd

effort:S

labels 2026-07-30 01:44:02 +02:00

fable-5 referenced this issue from a commit

2026-07-30 12:44:54 +02:00

#193: pond purge — retention job and manual Site-Admin endpoint

fable-5 referenced this issue

2026-07-30 12:45:10 +02:00

#193: pond purge (retention job + manual Site-Admin endpoint) #248

fable-5 referenced this issue from a commit

2026-07-30 22:18:40 +02:00

#235: keep page_links rows pointing at purged pages — recorded decision

fable-5 referenced this issue

2026-07-30 22:18:49 +02:00

#235: keep page_links rows pointing at purged pages (recorded decision) #256

fable-5 referenced this issue

2026-07-30 22:20:56 +02:00

[VS-NfD] Maintain the residual-risk list #231

fable-5 referenced this issue

2026-07-30 22:20:56 +02:00

[VS-NfD] Write the operations manual (installation, update, backup/restore, deletion, role separation) #229

fable-5 commented

2026-07-30 23:11:09 +02:00

Decided in PR #256 (commit 9a43a2f, CI run 512 green, fast-forward merged on Stefan's standing go-ahead for the M24 merges).

Decision: page_links rows pointing at a purged page are KEPT as an accepted residue.

Reasoning (full text in operations.md, purge section): the row is only the index of a wikilink whose text - the slug, which carries the page title - remains visible in the linking page's own content either way; content, content cache and the linking page's search index all keep that text, governed by the linking page's permissions and written by an author who could read the target at the time. Deleting the index row would remove nothing the system still shows while breaking the deliberate phantom-link re-resolution (a page recreated under the same slug resolves those links again).

Recorded per acceptance criteria: residual-risk entry with reasoning on #231; named for the deletion chapter in the comment on #229.

Decided in PR #256 (commit 9a43a2f, CI run 512 green, fast-forward merged on Stefan's standing go-ahead for the M24 merges). Decision: page_links rows pointing at a purged page are KEPT as an accepted residue. Reasoning (full text in operations.md, purge section): the row is only the index of a wikilink whose text - the slug, which carries the page title - remains visible in the linking page's own content either way; content, content cache and the linking page's search index all keep that text, governed by the linking page's permissions and written by an author who could read the target at the time. Deleting the index row would remove nothing the system still shows while breaking the deliberate phantom-link re-resolution (a page recreated under the same slug resolves those links again). Recorded per acceptance criteria: residual-risk entry with reasoning on #231; named for the deletion chapter in the comment on #229.

fable-5 closed this issue

2026-07-30 23:11:10 +02:00

Sign in to join this conversation.