Randall Stillwell 336a5890a8 feat(audit): append-only audit_log, workspace archive cascade + restore, audit view

Soft-delete cascade was the missing half of archive: stamping
workspaces.archived_at alone left objects visible to anyone with a
direct id. The cascade runs in one transaction so the partial state
isn't reachable, and restore inverts it for any archived row in the
workspace — provenance-blind on purpose until we have a use case
that needs to distinguish per-workspace from per-object archives.

audit_log keeps the keyset index on (workspace_id, created_at) and
the actor_user_id FK with onDelete set null. recordAudit() refuses
to write a null actor without a metadata.system_actor label so the
audit view always has something to render. workspaces and invites
mutations call recordAudit on success; objects-router instrumentation
and the markdown importer's system-actor flow are filed as P2
follow-ups because each needs a thoughtful "what's audit-worthy?"
pass, not mechanical wiring.

Settings → Audit log lives at /<slug>/settings/audit, owner-gated,
keyset-paginated. ACTION_LABELS is small on purpose; new actions
fall back to their raw key so missing a label degrades gracefully.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-06-02 15:35:16 -05:00

1.5 KiB

Raw Blame History

kind	slug	title	plan_slug	epic_slug	status	priority	tenant_id	owner	cursor_todo_id	updated_at
task	audit-instrument-markdown-importer	Audit-instrument the markdown-backlog importer	multitenant-saas-hardening	tenant-lifecycle	draft	P2	global	unassigned	null	2026-06-02

Task summary

The markdown-backlog importer runs as a file-watcher process (see packages/database/src/markdown-backlog/) and writes to markdown_backlog_items outside of any tRPC procedure context. Right now those writes leave no audit trail.

recordAudit() already supports system actors (actorUserId = null with a metadata.system_actor string), so the importer just needs to call it on its meaningful state changes.

Subtasks

Decide which importer events are audit-worthy:
- markdown_backlog.import_run_start — once per sync sweep, metadata { files_changed: N }.
- markdown_backlog.item_create / item_update / item_archive — per row.
- The first option is concise; the second is granular. Pick one.
Wire recordAudit calls from the importer.
Verify the audit-view UI handles actor_user_id = null cleanly (it does today; it renders "system: markdown-importer" when metadata.system_actor is set).

Acceptance criteria

Importer writes at least one audit row per sync sweep.
The audit view shows those rows with a "system: markdown-importer" actor label.

1.5 KiB Raw Blame History

Task summary

Subtasks

Acceptance criteria

Links

1.5 KiB

Raw Blame History