forest_admin_agent 1.44.0 → 1.44.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 765a7dfcd6479eadd50782c2d72e2fa6d14e2f0cd5858cd56b53279fb319f52d
-  data.tar.gz: 869b66b6a89dcbaf78887428fc8b9d5dd823629204c1c25cc6e7a3bf6645c0be
+  metadata.gz: 7685f99576db0d5421c02e2ccd0024cbdf8cdae97c50b81c273347058d01919c
+  data.tar.gz: ca1838fe30e5619908f3aa9364a2f98181d78bd86078c49fb4f3202b3dc606af
 SHA512:
-  metadata.gz: ef2ffa8474a150773b31add6d108ea351d4be7aac9f176e14967576f0718998d7a025d82d894d53c82736115165f92dd50f655e43afc1cb579b41b2cdd054f2f
-  data.tar.gz: f34499524fc80e0194f2341e14c0e5b373beca8a95fa1d4ae46a912bea35747d34d21819170acfee83f082b67703656bee4a7d152c08f2b834b5fb4916fecb5a
+  metadata.gz: c0eb71e1942b23f47f48c1bc211a2fbfdfd7eebe11e9c8e724feea421bca97df3864490a7d5d5f57bae497eff2705334026210d365131e6e41b79aa9ee62cd1f
+  data.tar.gz: 87e7c2a7af1f695f6cd92f61e8d71f21962ca16db50b6085525395bc920c9256cf78b2405702b7eeb9ac124bfa6ac00191b790edab8a9168f6013b2ec99c5970

data/AUDIT_TRAIL.md

@@ -190,6 +190,30 @@ A record that no longer exists keeps its history: only a record that still exist
 caller's permission scope is refused (404). Inspecting what was deleted is much of the point of an
 audit trail, and the delete event itself is the last thing recorded.
 
+Those rows still carry the column values captured while the record existed, and a scope that can no
+longer be evaluated against the record is evaluated against the values instead: a `delete` row keeps
+its `previousValues` only if they match the scope, a `create` row its `newValues`, and an `update`
+row — whose two sides are a partial diff — is tested side by side, so each is kept only if its own
+values match. Action rows hold a submitted form and a result summary, not column values, so they are
+untouched. The row itself is always returned: what happened, by whom and when stays visible either way.
+
+A snapshot only answers for the writable columns it captured, so a scope reaching for anything else — a
+read-only column, a relation, a value stored redacted — is not evaluated against it at all and the values
+are withheld: `nil` there is a missing answer, not a passing one. Primary keys are the exception, read
+back from the row's own id, so a scope on the id still matches the record it belongs to. This is also
+what makes an update's partial diff safe to test: a diff that never carried the scoped column answers for
+neither side, so both are withheld.
+
+The record is read twice: once before the rows are fetched, to refuse a record that exists outside the
+caller's scope without touching the audit database, and once after, so the answer that decides the
+withholding is never older than the rows it applies to — a record deleted in between would otherwise have
+answered "present and in scope" for rows that already carry its delete. The second read is skipped when no
+scope is in effect.
+
+**This covers the history route only.** `/state` reconstructs a gone record from the same rows and serves
+it unfiltered, and the correlation routes check the record but not the values, so a caller the withholding
+above protects against can still read those values one request away. Closing that is tracked separately.
+
 ### State route
 
 `GET /forest/_audit-trail/{collection}/{recordId}/state?timestamp=…` returns the record as it stood at

data/lib/forest_admin_agent/routes/resources/audit_trail.rb

@@ -39,7 +39,7 @@ module ForestAdminAgent
         def handle_request(args = {})
           context = build(args)
           context.permissions.can?(:read, context.collection)
-          assert_record_in_scope(context, context.collection, args[:params]['id'])
+          withholding_scope = assert_record_in_scope(context, context.collection, args[:params]['id'])
 
           skip, limit = parse_pagination(args)
           filters = {
@@ -54,9 +54,14 @@ module ForestAdminAgent
           # `count` reflects the active filters (not the absolute total) and is independent of the page.
           count = store.count_by_record(**filters)
 
+          # Asked again now: the check above ran before these rows were read, so a record deleted in between
+          # answered "present and in scope" for rows that already carry its delete.
+          withholding_scope ||= scope_if_gone_since(context, args)
+          data = withhold_out_of_scope_values(history, withholding_scope, context)
+
           {
             name: args[:params]['collection_name'],
-            content: { data: history.map { |record| serialize_record(record) }, meta: meta(args, filters, count) }
+            content: { data: data.map { |record| serialize_record(record) }, meta: meta(args, filters, count) }
           }
         end
 
@@ -85,6 +90,77 @@ module ForestAdminAgent
 
         private
 
+        # Second read of the record, once the rows are in hand, so the answer that decides the withholding is
+        # never older than what it decides on. Skipped without a scope in effect — there is nothing to withhold
+        # then, and nothing to ask. A record moved out of scope rather than deleted raises the 404 it would
+        # raise for a request starting a moment later.
+        def scope_if_gone_since(context, args)
+          return nil if context.permissions.get_scope(context.collection).nil?
+
+          assert_record_in_scope(context, context.collection, args[:params]['id'])
+        end
+
+        # A record that is gone for good bypasses the scope check — there is nothing left to check it against
+        # — but its rows still carry the column values captured while it existed. When those values would
+        # themselves have failed the caller's scope, withhold them; the row itself stays visible either way,
+        # so that it happened, by whom and when still reads.
+        def withhold_out_of_scope_values(entries, scope, context)
+          return entries if scope.nil?
+
+          entries.map { |entry| withhold(entry, scope, context) }
+        end
+
+        def withhold(entry, scope, context)
+          case entry.operation
+          # `delete`'s previous_values and `create`'s new_values both capture every writable column.
+          when 'delete'
+            in_scope?(entry, entry.previous_values, scope, context) ? entry : blank(entry, :previous_values)
+          when 'create'
+            in_scope?(entry, entry.new_values, scope, context) ? entry : blank(entry, :new_values)
+          when 'update'
+            withhold_each_side(entry, scope, context)
+          # `action`/`action_failed` rows hold a submitted form and a result summary, not column values, so
+          # the scope doesn't apply to them.
+          else
+            entry
+          end
+        end
+
+        # An update's two sides are a partial diff, so each is tested against its own values: a diff that never
+        # carried the scoped column answers for neither and is withheld by `in_scope?` anyway. Gating the sides
+        # separately releases the ones that can be proven in scope — "it used to be X" can't escape through a
+        # row whose new value is out of scope, since that side is tested on its own.
+        def withhold_each_side(entry, scope, context)
+          kept = in_scope?(entry, entry.previous_values, scope, context) ? entry : blank(entry, :previous_values)
+
+          in_scope?(kept, kept.new_values, scope, context) ? kept : blank(kept, :new_values)
+        end
+
+        # Only a snapshot that answers every field the scope asks about, with what was really stored, is worth
+        # matching. The capture keeps the writable columns, so a scope on anything else — a read-only column, a
+        # relation — reads as nil there and would answer for a value the row never held: `status != 'private'`
+        # would match, and an ordered operator would raise on the nil. A redacted value answers no better.
+        def in_scope?(entry, values, scope, context)
+          snapshot = with_primary_keys(entry, values, context.collection)
+          answerable = scope.projection.all? do |field|
+            snapshot.key?(field) && snapshot[field] != ::ForestAdminAgent::AuditTrail::Recording::REDACTED
+          end
+
+          answerable && scope.match(snapshot, context.collection, context.caller.timezone)
+        end
+
+        # A read-only primary key never lands in the snapshot, so a scope on the id would redact a row that is
+        # squarely in scope. The row's own packed id carries those values.
+        def with_primary_keys(entry, values, collection)
+          keys = entry.record_id.nil? ? {} : Utils::Id.unpack_id(collection, entry.record_id, with_key: true)
+
+          keys.merge(values || {})
+        end
+
+        def blank(entry, *fields)
+          entry.dup.tap { |copy| fields.each { |field| copy[field] = {} } }
+        end
+
         # `availableUsers` rides along on the first fetch only — the front keeps the list it saw — and lists the
         # distinct authors of the entries the current filters match, whatever page was asked for. The identity
         # comes from the rows, so someone since renamed or removed still reads as they were when they acted.

data/lib/forest_admin_agent/routes/resources/audit_trail_route.rb

@@ -9,10 +9,16 @@ module ForestAdminAgent
       module AuditTrailRoute
         include ForestAdminDatasourceToolkit::Components::Query
 
+        # The caller's scope when the record is gone for good, nil otherwise — no scope in effect, or a record
+        # still there and in scope. A scope can't be evaluated against a record that no longer exists, so its
+        # history is served, but the values its rows captured while it existed still have to be tested against
+        # that scope before being handed back.
         def assert_record_in_scope(context, collection, packed_id)
-          scoped_record(context, collection, packed_id)
+          return nil if scoped_record(context, collection, packed_id)
 
-          nil
+          # Nothing there: gone for good, since an out-of-scope record raised above. Without a scope in
+          # effect this reads nil, which is the same answer.
+          context.permissions.get_scope(collection)
         end
 
         # The record as it stands, read through the caller's permission scope. nil when it no longer exists

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.44.0"
+        LIANA_VERSION = "1.44.1"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.44.0"
+  VERSION = "1.44.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.44.0
+  version: 1.44.1
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-15 00:00:00.000000000 Z
+date: 2026-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport