forest_admin_agent 1.44.1 → 1.44.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7685f99576db0d5421c02e2ccd0024cbdf8cdae97c50b81c273347058d01919c
-  data.tar.gz: ca1838fe30e5619908f3aa9364a2f98181d78bd86078c49fb4f3202b3dc606af
+  metadata.gz: eb144d36d50f4763b0b8f2e61e701ee5fbfb7a97b66b4a9a6f67aaff26b8ac5d
+  data.tar.gz: c6f7817f4a8507b703c604b8c4c643884eb57b8d0902cd90437e6ffe1b201238
 SHA512:
-  metadata.gz: c0eb71e1942b23f47f48c1bc211a2fbfdfd7eebe11e9c8e724feea421bca97df3864490a7d5d5f57bae497eff2705334026210d365131e6e41b79aa9ee62cd1f
-  data.tar.gz: 87e7c2a7af1f695f6cd92f61e8d71f21962ca16db50b6085525395bc920c9256cf78b2405702b7eeb9ac124bfa6ac00191b790edab8a9168f6013b2ec99c5970
+  metadata.gz: c76840f3a4d7823a6395b6926e5ba60cb018f8acc30f6166773334ce6e966292b410001ad262a26cf0ca36580bf08dfcd0c0451821f52552919c37ec242083a7
+  data.tar.gz: fd08b9086757654dd821a909376648fa0f1a7274b18118cf734573bfc99f1818fabc063f085c72d1bccd7d94a8852f299aa0cd23703a3588d55f81a33a12f03b

data/AUDIT_TRAIL.md

@@ -199,8 +199,21 @@ untouched. The row itself is always returned: what happened, by whom and when st
 
 A snapshot only answers for the writable columns it captured, so a scope reaching for anything else — a
 read-only column, a relation, a value stored redacted — is not evaluated against it at all and the values
-are withheld: `nil` there is a missing answer, not a passing one. Primary keys are the exception, read
-back from the row's own id, so a scope on the id still matches the record it belongs to. This is also
+are withheld: `nil` there is a missing answer, not a passing one, and a redacted value answers no better.
+Primary keys are the exception: the packed id fills in whatever the snapshot cannot answer — a read-only key
+it never captured, or a writable one the trail redacts — so a scope on the id still matches the record it
+belongs to. It fills in only what is missing: where a side captured the key itself, that value is the one
+that was true there. Each side of an update is read against the id it was filed under, the row's own id and,
+for the previous side of an update that moved the key, the id it moved from. A `pending` row is filed under
+the id the record had *before* the write, which may not have landed, so its new side is given no id to fill
+from and answers with what it captured or not at all.
+
+Neither failure this can meet is fatal, and each costs only what it actually broke. An id that stopped
+decoding when the primary key changed shape costs the keys it would have filled and nothing more, so a scope
+that never asks about the id is still answered from the columns the row captured. A column captured as `nil`
+that an ordered operator cannot compare withholds that row. Uncaught, either would have failed the whole
+page, and only for the callers a scope applies to, since an unscoped caller never reaches this test. Both
+are logged, and the row keeps its operation, author and timestamp. This is also
 what makes an update's partial diff safe to test: a diff that never carried the scoped column answers for
 neither side, so both are withheld.
 

data/lib/forest_admin_agent/routes/resources/audit_trail.rb

@@ -114,9 +114,9 @@ module ForestAdminAgent
           case entry.operation
           # `delete`'s previous_values and `create`'s new_values both capture every writable column.
           when 'delete'
-            in_scope?(entry, entry.previous_values, scope, context) ? entry : blank(entry, :previous_values)
+            in_scope?(entry.previous_values, entry.record_id, scope, context) ? entry : blank(entry, :previous_values)
           when 'create'
-            in_scope?(entry, entry.new_values, scope, context) ? entry : blank(entry, :new_values)
+            in_scope?(entry.new_values, entry.record_id, scope, context) ? entry : blank(entry, :new_values)
           when 'update'
             withhold_each_side(entry, scope, context)
           # `action`/`action_failed` rows hold a submitted form and a result summary, not column values, so
@@ -131,30 +131,61 @@ module ForestAdminAgent
         # separately releases the ones that can be proven in scope — "it used to be X" can't escape through a
         # row whose new value is out of scope, since that side is tested on its own.
         def withhold_each_side(entry, scope, context)
-          kept = in_scope?(entry, entry.previous_values, scope, context) ? entry : blank(entry, :previous_values)
+          # An update that moved a writable primary key files its row under the id the record ended up with,
+          # and keeps the one it had on `previous_record_id`. Each side is tested against the id it was true
+          # of, or the new state's id would decide whether the old state is in scope.
+          before = entry.previous_record_id || entry.record_id
+          kept = in_scope?(entry.previous_values, before, scope, context) ? entry : blank(entry, :previous_values)
 
-          in_scope?(kept, kept.new_values, scope, context) ? kept : blank(kept, :new_values)
+          in_scope?(kept.new_values, after_id(kept), scope, context) ? kept : blank(kept, :new_values)
+        end
+
+        # A pending row is filed under the id the record had *before* the write, since the write may not have
+        # landed: it says nothing about the state the update was moving to, so the new side gets no id to fill
+        # from and falls back on what it captured itself.
+        def after_id(entry)
+          entry.status == ::ForestAdminAgent::AuditTrail::Recording::PENDING ? nil : entry.record_id
         end
 
         # Only a snapshot that answers every field the scope asks about, with what was really stored, is worth
         # matching. The capture keeps the writable columns, so a scope on anything else — a read-only column, a
         # relation — reads as nil there and would answer for a value the row never held: `status != 'private'`
         # would match, and an ordered operator would raise on the nil. A redacted value answers no better.
-        def in_scope?(entry, values, scope, context)
-          snapshot = with_primary_keys(entry, values, context.collection)
-          answerable = scope.projection.all? do |field|
-            snapshot.key?(field) && snapshot[field] != ::ForestAdminAgent::AuditTrail::Recording::REDACTED
-          end
-
-          answerable && scope.match(snapshot, context.collection, context.caller.timezone)
+        def in_scope?(values, packed_id, scope, context)
+          snapshot = answerable_snapshot(values, packed_id, context.collection)
+          return false unless scope.projection.all? { |field| snapshot.key?(field) }
+
+          scope.match(snapshot, context.collection, context.caller.timezone)
+        rescue StandardError => e
+          # Key presence is not answerability: a column captured as nil has its key, and an ordered operator
+          # raises on it. Uncaught that would fail the whole page, and only for the callers a scope applies
+          # to. One withheld row is the smaller loss, and the same answer the field would have got had it
+          # been missing outright.
+          Facades::Container.logger&.log('Warn', "[ForestAdmin] Audit row not scope-checkable: #{e.message}")
+
+          false
         end
 
-        # A read-only primary key never lands in the snapshot, so a scope on the id would redact a row that is
-        # squarely in scope. The row's own packed id carries those values.
-        def with_primary_keys(entry, values, collection)
-          keys = entry.record_id.nil? ? {} : Utils::Id.unpack_id(collection, entry.record_id, with_key: true)
+        # What this side of the row can answer about. A redacted value answers nothing, so it is dropped rather
+        # than matched against the placeholder — leaving the field unanswered, which withholds. The packed id
+        # then fills in the primary keys: a read-only one never lands in the snapshot at all, and a writable one
+        # the trail redacts was just dropped, while the id the row was filed under proves what the key was.
+        # It only fills what the snapshot cannot answer: on the side of a row that captured the key itself,
+        # that value is the one that was true there.
+        def answerable_snapshot(values, packed_id, collection)
+          answered = (values || {}).reject { |_, value| value == ::ForestAdminAgent::AuditTrail::Recording::REDACTED }
+          return answered if packed_id.nil?
 
-          keys.merge(values || {})
+          begin
+            Utils::Id.unpack_id(collection, packed_id, with_key: true).merge(answered)
+          rescue StandardError => e
+            # An id written under a primary key of another shape costs the keys it would have filled, and
+            # nothing else: the snapshot still answers for the columns it captured, so a scope that never
+            # asks about the id is unaffected.
+            Facades::Container.logger&.log('Warn', "[ForestAdmin] Audit row id not decodable: #{e.message}")
+
+            answered
+          end
         end
 
         def blank(entry, *fields)

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.44.1"
+        LIANA_VERSION = "1.44.2"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.44.1"
+  VERSION = "1.44.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.44.1
+  version: 1.44.2
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-23 00:00:00.000000000 Z
+date: 2026-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport