Claude Opus 5
3310ae3926
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 7m19s
CI / Build container images (pull_request) Successful in 1m23s
CI / Auth e2e pack (pull_request) Successful in 8m55s
CI / Import/export fidelity gate (pull_request) Successful in 57s
CD / Build and push images (push) Successful in 14s
CD / Deploy to Test (push) Successful in 16s
CD / Smoke tests against Test (push) Successful in 1m28s
CD / Promote to Int (push) Successful in 13s
CI / Lint, typecheck, test (push) Successful in 6m52s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 9m6s
CI / Import/export fidelity gate (push) Successful in 58s
Deleting a pond already had a strict prompt — typing the pond name, stricter than a confirm dialog. That was never the gap. The gap is that the person who deletes it loses access the moment they do: the pond leaves their view, only a Site Admin can bring it back, and the export is no longer reachable for them. So the archive is offered INSIDE the deletion flow, before the button. What it contains, and why it is not the existing export: - Every page the requester may read, as Markdown, as before. - **Every attachment of the pond**, not only the embedded ones. An attachment nobody put on a page would otherwise vanish unnoticed — which is the whole reason this issue exists. - `manifest.json`: pond settings (EFFECTIVE, defaults filled in — a preservation format must not require its reader to know Dorfteich's defaults), labels, the page hierarchy and sort keys, comments, and attachment metadata including the #199 hash so a reader can verify bytes. It extends the #210 manifest rather than adding a second descriptor, and carries an explicit `formatVersion`. - `README.txt`, because the manifest is for machines: whoever unpacks a folder of Markdown a year from now must not believe they hold a one-click restore. Decisions worth naming: - **"Complete" describes the RESULT, not the route.** A pond admin who may read every page gets `complete: true`; only an archive that actually leaves pages out is incomplete. The Site-Admin route skips the read filter (an archive taken before an irreversible purge must not depend on which ponds the operator happens to be a member of) — those are two different questions and the first version of this conflated them. - **The omission is named before the download**, with its number, in the UI and in the manifest. An archive silently missing content is worse than no archive, because it ends the search. - **Not downloading stays allowed.** A pond of test pages should not require one, and the server cannot tell whether a file arrived anyway — so the finality is stated in text instead of enforced. - **A plain link, not fetch-into-a-blob.** The api streams the ZIP; buffering a whole pond in the tab to draw a progress bar would trade memory for cosmetics. The browser reports progress and completion; what it cannot say — that the archive is being BUILT — is announced in a live region. - Read trail unchanged in kind (ADR 0023): one `export` event per classified page before any classified byte enters the stream. Attachments never travel without their page, so the same events cover them. - New audit action `pond.archived` (catalogue v1.7) with page and attachment counts, omitted pages, and completeness. Format documented in `docs/architecture/pond-archive-format.md`, including what is deliberately NOT in it (history, permissions, trash). Verified by hand, not only asserted: a real pond's archive downloaded and unpacked — README, manifest, three page files, the media file; the manifest's effective settings, per-page classification, the VS-NfD frontmatter and marking preserved in the classified page's Markdown, and the attachment's sha256 present. Plus six api tests (including that an unembedded attachment travels and that a Site Admin gets a complete archive without membership) and the a11y pack 11/11 in both schemes, which now also scans the pond settings screen. Not done, because there is nothing to attach it to: the Site Admin's purge dialog (#193) exists only as an api endpoint — there is no pond-trash UI in the web app. The api half is here and tested, so it becomes a link when that screen is built.
72 lines
3.4 KiB
TypeScript
72 lines
3.4 KiB
TypeScript
/**
|
|
* The audit event catalogue (issue #201): every action id the trail may
|
|
* carry, with the severity the stdout line is stamped with. This const is
|
|
* the CODE half of the published catalogue in
|
|
* `docs/architecture/audit-events.md` — `audit-catalogue.test.ts` fails
|
|
* whenever the two drift, so an id cannot be added, renamed, or removed
|
|
* without its documentation moving in the same commit.
|
|
*
|
|
* Compatibility promise (the reason this exists): ids are never repurposed.
|
|
* New events may be added (minor catalogue version); an id that stops being
|
|
* emitted is retired in the catalogue document, its meaning frozen forever —
|
|
* so an operator's SIEM rules survive our releases.
|
|
*/
|
|
export const AUDIT_EVENTS = {
|
|
'api.token_created': { severity: 'info' },
|
|
'api.token_revoked': { severity: 'info' },
|
|
'api.write': { severity: 'info' },
|
|
'audit.pruned': { severity: 'info' },
|
|
'auth.email_verified': { severity: 'info' },
|
|
'auth.identity_linked': { severity: 'notice' },
|
|
'auth.login_failed': { severity: 'warning' },
|
|
'auth.login_succeeded': { severity: 'info' },
|
|
'auth.password_reset': { severity: 'notice' },
|
|
'auth.proxy_rejected': { severity: 'warning' },
|
|
'auth.signup': { severity: 'info' },
|
|
'backup.restore_requested': { severity: 'warning' },
|
|
'backup.run_triggered': { severity: 'info' },
|
|
'backup.settings_changed': { severity: 'notice' },
|
|
'file.integrity_failed': { severity: 'critical' },
|
|
'grant.created': { severity: 'notice' },
|
|
'grant.deleted': { severity: 'notice' },
|
|
'job.triggered': { severity: 'info' },
|
|
'member.added': { severity: 'notice' },
|
|
'member.removed': { severity: 'notice' },
|
|
'member.role_changed': { severity: 'notice' },
|
|
'page.classification_lowered': { severity: 'warning' },
|
|
'page.classification_raised': { severity: 'notice' },
|
|
'plugin.installed': { severity: 'notice' },
|
|
'plugin.rejected': { severity: 'warning' },
|
|
'plugin.mode_set': { severity: 'notice' },
|
|
'plugin.pond_toggled': { severity: 'info' },
|
|
'plugin.uninstalled': { severity: 'notice' },
|
|
'pond.archived': { severity: 'notice' },
|
|
'pond.purged': { severity: 'notice' },
|
|
'quota.override_cleared': { severity: 'notice' },
|
|
'quota.override_set': { severity: 'notice' },
|
|
'read_trail.pruned': { severity: 'info' },
|
|
'settings.changed': { severity: 'notice' },
|
|
'branding.changed': { severity: 'notice' },
|
|
'font.uploaded': { severity: 'notice' },
|
|
'font.deleted': { severity: 'notice' },
|
|
'setup.admin_created': { severity: 'notice' },
|
|
'setup.completed': { severity: 'info' },
|
|
'setup.preseeded': { severity: 'info' },
|
|
'setup.smtp_stored': { severity: 'info' },
|
|
'user.deleted': { severity: 'notice' },
|
|
'user.disabled_set': { severity: 'notice' },
|
|
'user.pseudonymized': { severity: 'notice' },
|
|
'user.site_admin_set': { severity: 'notice' },
|
|
'user.verification_resent': { severity: 'info' },
|
|
} as const satisfies Record<string, { severity: AuditSeverity }>;
|
|
|
|
/** Severity vocabulary of the catalogue — syslog-inspired, four levels are
|
|
* enough for rule routing (critical pages someone, warning feeds detection,
|
|
* notice is configuration drift, info is lifecycle noise). */
|
|
export type AuditSeverity = 'info' | 'notice' | 'warning' | 'critical';
|
|
|
|
/** A catalogued action id — the ONLY thing {@link AuditService.record}
|
|
* accepts, so an uncatalogued event cannot be emitted (compile-time), and
|
|
* the doc fence keeps the catalogue document in step (test-time). */
|
|
export type AuditAction = keyof typeof AUDIT_EVENTS;
|