forest_admin_agent 1.45.1 → 1.46.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2757eb5bbc5c7a2bd1c7dc0a554460a9b75954a7bccd427589a291c78c8f3bcc
-  data.tar.gz: 333ee405b76b63bd287f66f04cab2e7a34792fed14c4ce0e55af4d920b3c9df6
+  metadata.gz: 1f60fdc1a8849851e0aeb16b6ac0f42eabe7a01ebc54b432ae75ef2ba3b9ba00
+  data.tar.gz: 68772b2ffdd8247f2de2308d231d4225b61e033deeb8508cfe686325d4e52f41
 SHA512:
-  metadata.gz: 578b2cafdbc0f60732f3af1e7f3e4457883d6e2b8a5838a6fe419ebe505353268646adf064a071658e223a7119a1e654db762b2cec88183e4fe2ae0a4fca0e01
-  data.tar.gz: 77deb1e0711c2534132aef6c9316b0c0a518546339a0a3670922474ee3a2c92cd38847a7efbbe491c679db103778f27796f4e656fd977e7f88149d17414d4cde
+  metadata.gz: 6b17eb054da746a8c13de4b164c8f3128b4b89f1d52bab2d7a5ba848c904f441afc70412c3e01a74090e7783cb2c9cc8ffff11ce31eca67828c3b5517befbecc
+  data.tar.gz: bbbbc65fcb9f9d0404de90f78c6f216561775ad7e4b36b85669b191c3c506d471feef4510c708f88b2a7b77c9a1de8dbb1656a439da665c8afb38838486beab1

data/AUDIT_TRAIL.md

@@ -13,8 +13,9 @@ Two parts, both internal:
   schema and creates/evolves the `audit_logs` table through versioned migrations, and reads the
   per-record history back for the routes below.
 
-Storage uses ActiveRecord: outside Rails, add `gem 'activerecord'` (and the adapter gem) to your
-Gemfile. Nothing is loaded and no connection is opened until the feature is configured.
+Storage uses ActiveRecord on a PostgreSQL database. The agent depends on `activerecord` and `pg`, so
+there is nothing to add to the Gemfile, even in an app whose main datasource is not SQL. Nothing is loaded
+and no connection is opened until the feature is configured.
 
 ## Turn it on
 
@@ -122,6 +123,7 @@ or removed still reads as they were when they acted. Optional filters (all combi
 | query param | format                           | effect                                          |
 | ----------- | -------------------------------- | ----------------------------------------------- |
 | `userIds`   | comma-separated integers `12,45` | keep only entries whose `user_id` is in the list |
+| `operations` | comma-separated, from `create`, `update`, `delete`, `action`, `action_failed` | keep only entries recorded under one of them |
 | `startDate` | `YYYY-MM-DD` or datetime (incl.) | keep entries from this lower bound onward       |
 | `endDate`   | `YYYY-MM-DD` or datetime (incl.) | keep entries up to this upper bound             |
 | `fields`    | comma-separated field names      | keep only entries whose diff touched one of them |
@@ -164,7 +166,9 @@ happens in SQL. Two shapes are accepted:
 
 Both bounds are **inclusive**. Defensive parsing: non-numeric `userIds` tokens are dropped
 (`12,abc,45` → `12,45`), and a `startDate` / `endDate` matching no accepted format returns **HTTP
-400** (`ValidationError`); an invalid `timezone` likewise returns **400**.
+400** (`ValidationError`); an invalid `timezone` likewise returns **400**. An unrecognized
+`operations` value returns **400** rather than being dropped: a silently ignored filter would hand back
+unfiltered rows into a list the caller believes is filtered.
 
 Pagination follows JSON:API: `page[number]` is 1-based (default `1`), `page[size]` defaults to `20`
 and is capped at `100`; out-of-bound or non-numeric values fall back to the defaults rather than
@@ -180,21 +184,10 @@ the merge tiebreaker.
 Inside the value objects: a record's column names pass through untouched, while an action answer's keys are
 Forest's own and so are camelCase (`mimeType`, not `mime_type`) — the agent transforms them on write.
 
-**A record that was renamed keeps one timeline** — on this agent. The Node agent files an update under the
-record's new id too, but has no `previous_record_id` and so cannot walk back past the rename: the same record
-shows a complete chain here and a history beginning at the rename there, until that column is ported.
- An update that moves a writable primary key files its row
-under the record's new id — the id later lookups use — and remembers the one it left. Both the history and the
-state routes walk that back, so asking for the current id returns everything the record has ever been filed
-under, rather than starting the story at the rename.
-
-Each earlier id counts only **up to the moment it was left**, because a primary key a record abandons can be
-taken by another record afterwards, and those rows are none of this record's business. What the trail cannot
-separate is the opposite case: rows written under an id *before* the record that holds it now arrived — a
-reused key, or a delete followed by a recreate — since the packed id is the only identity the trail has. That
-is deliberate for delete/recreate (the state reconstruction walks into an earlier life on purpose) and the
-same limitation for a reused key. Telling those apart needs a lineage of its own on every row, which is a
-bigger change than this one.
+**A record whose primary key moved starts its history at the move**, as on the Node agent. An update that
+moves a writable primary key files its row under the record's new id, and the rows written before stay under
+the id they were true of; the history and state routes read the requested id only. Migration `002` drops the
+`previous_record_id` column an earlier version kept for this.
 
 A record that no longer exists keeps its history: only a record that still exists *outside* the
 caller's permission scope is refused (404). Inspecting what was deleted is much of the point of an
@@ -213,10 +206,11 @@ are withheld: `nil` there is a missing answer, not a passing one, and a redacted
 Primary keys are the exception: the packed id fills in whatever the snapshot cannot answer — a read-only key
 it never captured, or a writable one the trail redacts — so a scope on the id still matches the record it
 belongs to. It fills in only what is missing: where a side captured the key itself, that value is the one
-that was true there. Each side of an update is read against the id it was filed under, the row's own id and,
-for the previous side of an update that moved the key, the id it moved from. A `pending` row is filed under
-the id the record had *before* the write, which may not have landed, so its new side is given no id to fill
-from and answers with what it captured or not at all.
+that was true there. The row's id answers only for the side it was filed under, as on the Node agent: a
+create, a delete, an update's new side. On an update's previous side it fills a key never captured (read-only,
+so it cannot have moved) but not a redacted one (writable, so it may have), and that side is withheld from a
+scope on a redacted key. A `pending` row is filed under the id the record had *before* the write, which may
+not have landed, so its new side is given no id to fill from and answers with what it captured or not at all.
 
 Neither failure this can meet is fatal, and each costs only what it actually broke. An id that stopped
 decoding when the primary key changed shape costs the keys it would have filled and nothing more, so a scope
@@ -246,9 +240,17 @@ read it, that is a **404**, the same as for a request starting a moment later; i
 life's values stay withheld all the same. The second read is skipped when no scope is in effect, and on the
 correlation routes when the answer holds no rows.
 
-Where the delete and the recreation both happened *before* the request, both reads see the live record and
-its history is served whole, earlier lives included — the documented delete/recreate behaviour, and a
-separate question from the one above.
+**An id freed and taken since has two lives.** Where the delete and the recreation both happened *before*
+the request, both reads see the live record, and a live record in the caller's scope says nothing about the
+rows filed under its id before it took the id: they are an earlier record's. The boundary is the id's latest
+confirmed `delete` (the earlier record's last row) or `create` (the current record's first), whichever is
+later; the `create` covers an id freed with no confirmed `delete`, by a primary-key move or a delete that was
+never confirmed. A `pending` row marks no boundary, since it may never have landed. The rows before the
+boundary go through the same withholding as a record gone for good — on the history route (with `search` and
+`fields` matched against the served values, so the count and the authors cannot leak them either), on the
+correlation routes, and on `/state`, whose reconstruction at an instant **strictly before** the boundary is
+tested against the scope: at the boundary's own instant the state already includes a replacement `create`
+sharing it. The lookup runs only for a scoped caller on a live record. Same rule as the Node agent.
 
 **Every route that serves captured values applies this**, since a rule only one of them applies is one
 lookup away from being no rule at all. The two correlation routes withhold row by row exactly as the history
@@ -278,6 +280,34 @@ Walking back stops being able to help where the trail stops: only audited (writa
 reconstructed, and a `create` means the record did not exist before it, while a `delete` restores the whole
 row it recorded and the walk carries on into any earlier life of the same id.
 
+### Timeline route
+
+`GET /forest/_audit-trail` is the project-level timeline: the audit rows of every collection the caller can
+read, in one walk, for the project's Activity Logs page. It mirrors the Node agent's route, and the capability
+payload announces it as `canUseAuditTrailTimeline` and `canSortAuditTrailTimeline`, both true wherever the
+trail is configured.
+
+```json
+{ "data": [...], "meta": { "cursor": { "before": "2026-01-02T03:04:05.000Z", "excludeIds": [42] },
+                           "availableUsers": [...] } }
+```
+
+- Values follow the per-record history's rule: a caller who can read a collection reads its rows' values,
+  whatever their permission level. Who may open the page at all is the team's Activity Logs setting, enforced
+  by Forest, not by the agent.
+- A collection the caller sees only through a record-level scope is left out entirely: a scope cannot be
+  evaluated across the whole timeline, and a row alone would say that a record they cannot read was touched.
+- `sort=timestamp` walks oldest first; anything else newest first. Ties follow `id` in the same direction.
+- Paged by cursor, not page number, since the front merges this walk with the activity logs and no count spans
+  both. `before` (newest first) or `after` (oldest first) is an **inclusive** ISO instant, and `excludeIds`
+  drops the rows already served at it; the other direction's bound is ignored, and a bound that is not an ISO
+  instant is a **400**. The bound and the date filter on its side combine, the tighter winning. `meta.cursor`
+  is `null` on the last page, and when the walk would not progress.
+- `page[size]` as on the history route. `userIds`, `operations`, `startDate`, `endDate`, `timezone` and
+  `search` as on the history route; no `fields`, since a column name means nothing across collections.
+- `meta.availableUsers` on the first page only (neither `before` nor `after`): the distinct authors the
+  filters match across the readable collections. Later pages omit the key.
+
 ### Correlation route
 
 `GET /forest/_audit-trail/correlation/{correlationKey}` returns `{ "data": [...] }` — the
@@ -370,7 +400,6 @@ one table nobody deletes from.
 | `operation`       | `create` / `update` / `delete`                              |
 | `collection`      | audited collection name                                     |
 | `record_id`       | packed record id (primary keys joined by `\|`), TEXT and nullable — a create's pending row has none yet, and a composite id outgrows a varchar |
-| `previous_record_id` | set only on an update that moved a writable primary key: the id the row was filed under before |
 | `user_id`         | the Forest user who made the change                         |
 | `user_first_name`, `user_last_name`, `user_email` | denormalised from the caller at write time: who acted then, not whoever holds that id today |
 | `action_name`     | smart-action rows only                                       |

data/forest_admin_agent.gemspec

@@ -33,6 +33,7 @@ admin work on any Ruby application."
   spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency "activerecord", ">= 6.1"
   spec.add_dependency "activesupport", ">= 6.1"
   spec.add_dependency "base64"
   spec.add_dependency "benchmark"
@@ -52,6 +53,7 @@ admin work on any Ruby application."
   spec.add_dependency "ld-eventsource", "~> 2.2"
   spec.add_dependency "mono_logger", "~> 1.1"
   spec.add_dependency "openid_connect", "~> 2.2"
+  spec.add_dependency "pg", "~> 1.1"
   spec.add_dependency "rake", "~> 13.0"
   spec.add_dependency "rack-cors", "~> 3.0"
   spec.add_dependency "zeitwerk", "~> 2.3"

data/lib/forest_admin_agent/audit_trail/audit_record.rb

@@ -7,7 +7,7 @@ module ForestAdminAgent
     # follows the write protocol — inserted as {Recording::PENDING} before the write and confirmed
     # {Recording::DONE} after, so a row left pending means the write may or may not have landed.
     AuditRecord = Struct.new(
-      :id, :timestamp, :operation, :collection, :record_id, :previous_record_id, :status,
+      :id, :timestamp, :operation, :collection, :record_id, :status,
       :user_id, :user_first_name, :user_last_name, :user_email, :action_name,
       :correlation_key, :previous_values, :new_values,
       keyword_init: true

data/lib/forest_admin_agent/audit_trail/capture.rb

@@ -136,14 +136,8 @@ module ForestAdminAgent
           if delta[:new_values].empty?
             empty << pending[:ids][index]
           else
-            before_id = record_id(record, pks)
-            after_id = record_id(after, pks)
-
             confirm(pending[:ids][index],
-                    record_id: after_id,
-                    # Only when the key actually moved, so a history query can walk back to the rows filed
-                    # under the id this record used to have.
-                    previous_record_id: after_id == before_id ? nil : before_id,
+                    record_id: record_id(after, pks),
                     previous_values: redacted(target[:name], delta[:previous_values]),
                     new_values: redacted(target[:name], delta[:new_values]))
           end

data/lib/forest_admin_agent/audit_trail/sql/audit_connection_base.rb

@@ -1,8 +1,4 @@
-begin
-  require 'active_record'
-rescue LoadError
-  raise LoadError, 'config.audit_trail needs the activerecord gem: add `gem "activerecord"` to your Gemfile.'
-end
+require 'active_record'
 
 module ForestAdminAgent
   module AuditTrail

data/lib/forest_admin_agent/audit_trail/sql/migrations.rb

@@ -1,10 +1,9 @@
 module ForestAdminAgent
   module AuditTrail
     module Sql
-      # The audit table's schema, as an ordered, append-only list. Nothing has shipped yet, so this is still a
-      # single entry; once a release is out, never edit one — add another, since a database out there has
-      # already recorded the earlier ones as applied. Every statement tolerates being replayed
-      # (`if_not_exists`), which is what makes a lost race harmless.
+      # The audit table's schema, as an ordered, append-only list. Never edit a released entry — add another,
+      # since a database out there has already recorded the earlier ones as applied. Every statement tolerates
+      # being replayed (`if_not_exists` / `if_exists`), which is what makes a lost race harmless.
       module Migrations
         ALL = [
           {
@@ -26,8 +25,7 @@ module ForestAdminAgent
                 t.text :user_first_name
                 t.text :user_last_name
                 t.text :user_email
-                # Set only on an update that moved a writable primary key: the id the row was filed under
-                # before. What lets a history query follow a record across a rename.
+                # Dropped by 002.
                 t.text :previous_record_id
                 # Smart-action rows only.
                 t.text :action_name
@@ -45,6 +43,25 @@ module ForestAdminAgent
               connection.add_index(table, :correlation_key, name: "#{base}_correlation_key", if_not_exists: true)
               connection.add_index(table, :user_id, name: "#{base}_user_id", if_not_exists: true)
             end
+          },
+          {
+            # The agent no longer follows a record across a primary-key move, so nothing writes or reads the
+            # column. No released version wrote it to a row a client relies on.
+            name: '002-drop-previous-record-id',
+            up: lambda do |connection, table|
+              # Checked first as well: older ActiveRecord versions accept `if_exists` here but ignore it.
+              next unless connection.column_exists?(table, :previous_record_id)
+
+              connection.remove_column(table, :previous_record_id, if_exists: true)
+            end
+          },
+          {
+            # The timeline pages the whole table in (timestamp, id) order, which no other index serves.
+            name: '003-index-timestamp-id',
+            up: lambda do |connection, table|
+              connection.add_index(table, %i[timestamp id], name: "#{table.split(".").last}_timestamp_id",
+                                                            if_not_exists: true)
+            end
           }
         ].freeze
       end

data/lib/forest_admin_agent/audit_trail/store.rb

@@ -11,7 +11,7 @@ module ForestAdminAgent
     class Store
       DEFAULT_SCHEMA = 'forest'.freeze
       DEFAULT_TABLE = 'audit_logs'.freeze
-      COLUMNS = %i[timestamp operation collection record_id previous_record_id status user_id user_first_name
+      COLUMNS = %i[timestamp operation collection record_id status user_id user_first_name
                    user_last_name user_email action_name correlation_key previous_values new_values].freeze
       AUTHOR_COLUMNS = %i[user_id user_first_name user_last_name user_email].freeze
 
@@ -73,13 +73,14 @@ module ForestAdminAgent
         model.where(id: ids).delete_all unless ids.empty?
       end
 
-      def list_by_record(collection:, record_id:, skip: 0, limit: nil, user_ids: nil, start_timestamp: nil,
-                         end_timestamp: nil, fields: nil, search: nil, order: 'asc', after: nil)
+      def list_by_record(collection:, record_id:, skip: 0, limit: nil, user_ids: nil, operations: nil,
+                         start_timestamp: nil, end_timestamp: nil, fields: nil, search: nil, order: 'asc', after: nil)
         descending = order.to_s == 'desc'
         # `id` (insertion order) breaks ties on equal timestamps in both directions, keeping pages
         # deterministic and stable.
-        relation = scope(collection, record_id, user_ids: user_ids, start_timestamp: start_timestamp,
-                                                end_timestamp: end_timestamp, fields: fields, search: search)
+        relation = scope(collection, record_id, user_ids: user_ids, operations: operations,
+                                                start_timestamp: start_timestamp, end_timestamp: end_timestamp,
+                                                fields: fields, search: search)
                    .order(timestamp: descending ? :desc : :asc, id: :asc)
                    .offset(skip || 0)
         relation = relation.where(*past_row_condition(after, descending)) if after
@@ -88,42 +89,52 @@ module ForestAdminAgent
         relation.map { |row| from_row(row) }
       end
 
-      def count_by_record(collection:, record_id:, user_ids: nil, start_timestamp: nil,
+      def count_by_record(collection:, record_id:, user_ids: nil, operations: nil, start_timestamp: nil,
                           end_timestamp: nil, fields: nil, search: nil)
-        scope(collection, record_id, user_ids: user_ids, start_timestamp: start_timestamp,
+        scope(collection, record_id, user_ids: user_ids, operations: operations, start_timestamp: start_timestamp,
                                      end_timestamp: end_timestamp, fields: fields, search: search).count
       end
 
       # The distinct authors of the entries the current filters match, whatever page is being asked for. The
       # identity comes from the rows themselves, so a user who has since been renamed or removed still reads
       # as they were when they acted.
-      def authors_by_record(collection:, record_id:, user_ids: nil, start_timestamp: nil,
+      def authors_by_record(collection:, record_id:, user_ids: nil, operations: nil, start_timestamp: nil,
                             end_timestamp: nil, fields: nil, search: nil)
-        scope(collection, record_id, user_ids: user_ids, start_timestamp: start_timestamp,
-                                     end_timestamp: end_timestamp, fields: fields, search: search)
-          .where.not(user_id: nil)
-          .distinct
-          .pluck(*AUTHOR_COLUMNS)
-          .map { |values| AUTHOR_COLUMNS.zip(values).to_h }
-          .uniq { |author| author[:user_id] }
+        authors(scope(collection, record_id, user_ids: user_ids, operations: operations,
+                                             start_timestamp: start_timestamp, end_timestamp: end_timestamp,
+                                             fields: fields, search: search))
       end
 
-      # The ids this record was renamed from, each with the moment it stopped being that id. Walking those back
-      # is what lets a history query reach rows written before a rename — they stay under the id they were
-      # written with, since that is the id they were true of — and the moment bounds how far: the id it left may
-      # have been taken by another record afterwards, whose rows are none of this record's business.
-      def renamed_from(collection:, record_id:)
-        model.where(collection: collection, record_id: record_id)
-             .where.not(previous_record_id: nil)
-             .pluck(:previous_record_id, :timestamp, :id)
-             .group_by(&:first)
-             .map do |id, rows|
-               # The row id comes along as the tie-breaker: the trail orders itself by (timestamp, id), so a
-               # bound that knew only the timestamp would mean something slightly different from "before".
-               _, at, row = rows.max_by { |(_, timestamp, row_id)| [timestamp, row_id] }
-
-               { id: id, until: as_iso(at), until_row: row }
-             end
+      # The project-level timeline across `collections`, the ones the caller may read: newest first, or oldest
+      # first with `order: 'asc'`, ties broken by id in the same direction. `before` / `after` are the cursor's
+      # inclusive bound and `exclude_ids` the rows already served at it.
+      def list_timeline(collections:, limit:, order: 'desc', **filters)
+        return [] if collections.empty?
+
+        direction = order.to_s == 'asc' ? :asc : :desc
+
+        timeline_scope(collections, **filters).order(timestamp: direction, id: direction).limit(limit)
+                                              .map { |row| from_row(row) }
+      end
+
+      # The distinct authors of the timeline the filters match, whatever the cursor.
+      def timeline_users(collections:, **filters)
+        return [] if collections.empty?
+
+        authors(timeline_scope(collections, **filters))
+      end
+
+      # The id's latest confirmed `delete` or `create`, in the trail's (timestamp, id) order: where the life of
+      # the record holding the id now began. A pending row may never have landed, so it marks nothing. Nil when
+      # the id has had one life only — no boundary at all, or a `create` with nothing filed before it — so a
+      # record created through Forest does not pay for the earlier-life withholding it can never need.
+      def life_boundary_of(collection:, record_id:)
+        rows = model.where(collection: collection, record_id: record_id)
+        row = rows.where(operation: %w[delete create], status: Recording::DONE).order(timestamp: :desc, id: :desc).first
+        return nil if row.nil?
+        return nil if row.operation == 'create' && !rows.where(*before_row_condition(row)).exists?
+
+        from_row(row)
       end
 
       # Entries recorded strictly after `timestamp`, newest first: what a state reconstruction has to undo.
@@ -135,7 +146,7 @@ module ForestAdminAgent
       # cannot act on them.
       def list_since(collection:, record_id:, timestamp:)
         model.where(collection: collection, status: Recording::DONE)
-             .where(*segments_condition(record_id))
+             .where(record_id: record_id)
              .where('timestamp > ?', as_time(timestamp))
              .order(timestamp: :desc, id: :desc)
              .map { |row| from_row(row) }
@@ -155,12 +166,28 @@ module ForestAdminAgent
 
       private
 
-      # Every filter is an AND, so the count matches exactly what a page of this history holds.
-      def scope(collection, record_id, user_ids: nil, start_timestamp: nil, end_timestamp: nil,
-                fields: nil, search: nil)
-        relation = model.where(collection: collection).where(*segments_condition(record_id))
-        relation = relation.where(user_id: user_ids) if user_ids
+      def scope(collection, record_id, fields: nil, **filters)
+        relation = filtered(model.where(collection: collection, record_id: record_id), **filters)
         relation = relation.where(Sql::FieldFilter.new(model.connection).condition(fields)) if fields&.any?
+        relation
+      end
+
+      # Each cursor bound and the date filter on its side are both inclusive, so the tighter one wins.
+      def timeline_scope(collections, before: nil, after: nil, exclude_ids: nil, start_timestamp: nil,
+                         end_timestamp: nil, **filters)
+        relation = filtered(model.where(collection: collections),
+                            start_timestamp: [start_timestamp, after].compact.max_by { |bound| as_time(bound) },
+                            end_timestamp: [end_timestamp, before].compact.min_by { |bound| as_time(bound) },
+                            **filters)
+        relation = relation.where.not(id: exclude_ids) if exclude_ids&.any?
+        relation
+      end
+
+      # The filters the per-record history and the timeline share, so they cannot drift apart. Every one is an
+      # AND, so the count matches exactly what a page holds.
+      def filtered(relation, user_ids: nil, operations: nil, search: nil, start_timestamp: nil, end_timestamp: nil)
+        relation = relation.where(user_id: user_ids) if user_ids
+        relation = relation.where(operation: operations) if operations
         relation = relation.where(Sql::TextSearch.new(model.connection).condition(search)) if search
         # Compare as Time so ActiveRecord casts the bound to the datetime column's storage format
         # (raw ISO strings with a `Z` would compare lexically against the cast rows and never match).
@@ -169,6 +196,21 @@ module ForestAdminAgent
         relation
       end
 
+      def authors(relation)
+        relation.where.not(user_id: nil)
+                .distinct
+                .pluck(*AUTHOR_COLUMNS)
+                .map { |values| AUTHOR_COLUMNS.zip(values).to_h }
+                .uniq { |author| author[:user_id] }
+      end
+
+      # Rows strictly before `row` in the trail's (timestamp, id) order.
+      def before_row_condition(row)
+        at = as_time(row.timestamp)
+
+        ['timestamp < ? OR (timestamp = ? AND id < ?)', at, at, row.id]
+      end
+
       # Rows strictly past `row` in the history's own order, so a scan keyed on the last row it read neither
       # repeats nor skips one when entries are written between its reads, as an offset would.
       def past_row_condition(row, descending)
@@ -182,34 +224,6 @@ module ForestAdminAgent
         value.is_a?(::Time) ? value : ::Time.iso8601(value.to_s)
       end
 
-      def as_iso(value)
-        value.respond_to?(:iso8601) ? value.iso8601(3) : value.to_s
-      end
-
-      # One record's history is its current id plus every id it was renamed from, each earlier one only up to
-      # the rename: `record_id = '7' OR (record_id = '1' AND timestamp <= …)`. A plain `IN` would hand over the
-      # rows of whichever record holds that id now.
-      #
-      # Takes an id, several, or segments — `{ id:, until: }` — so a caller that has no rename to care about
-      # simply passes the id.
-      def segments_condition(record_id)
-        binds = []
-        sql = Array(record_id).map { |value| value.is_a?(Hash) ? value : { id: value, until: nil } }.map do |segment|
-          binds << segment[:id]
-          next 'record_id = ?' unless segment[:until]
-
-          binds << as_time(segment[:until])
-          # Same millisecond as the rename, and the id says which side of it a row falls on: another record
-          # taking the abandoned key that fast would otherwise land in this record's history.
-          next '(record_id = ? AND timestamp <= ?)' unless segment[:until_row]
-
-          binds << as_time(segment[:until]) << segment[:until_row]
-          '(record_id = ? AND (timestamp < ? OR (timestamp = ? AND id <= ?)))'
-        end
-
-        [sql.join(' OR '), *binds]
-      end
-
       def model
         ensure_ready
         @model

data/lib/forest_admin_agent/auth/oidc_client_manager.rb

@@ -1,4 +1,3 @@
-require 'filecache'
 require 'openid_connect'
 require_relative 'oauth2/oidc_config'
 require_relative 'oauth2/forest_provider'
@@ -25,7 +24,7 @@ module ForestAdminAgent
       private
 
       def setup_cache(env_secret, config_agent)
-        cache = FileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
+        cache = ForestAdminAgent::Utils::SafeFileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
         cache.get_or_set env_secret do
           oidc_config = retrieve_config(config_agent[:forest_server_url])
           credentials = register(

data/lib/forest_admin_agent/http/router.rb

@@ -50,12 +50,14 @@ module ForestAdminAgent
           { name: 'charts', handler: -> { Charts::Charts.new.routes } },
           { name: 'collections', handler: -> { Capabilities::Collections.new.routes } },
           { name: 'native_query', handler: -> { Resources::NativeQuery.new.routes } },
-          # Both must come before the routes matching on `:collection_name`: Rails matches in
+          # All three must come before the routes matching on `:collection_name`: Rails matches in
           # definition order, so `/_audit-trail/correlations` would otherwise be read as
-          # `/:collection_name/:id` and 404 on a collection named `_audit-trail`. Correlation first, so
+          # `/:collection_name/:id`, and the timeline's `/_audit-trail` as `/:collection_name`, and both 404 on a
+          # collection named `_audit-trail`. Correlation first, so
           # `/_audit-trail/correlations` wins over the per-record `/_audit-trail/:collection_name/:id`.
           { name: 'audit_trail_correlation', handler: -> { Resources::AuditTrailCorrelation.new.routes } },
           { name: 'audit_trail', handler: -> { Resources::AuditTrail.new.routes } },
+          { name: 'audit_trail_timeline', handler: -> { Resources::AuditTrailTimeline.new.routes } },
           { name: 'count', handler: -> { Resources::Count.new.routes } },
           { name: 'delete', handler: -> { Resources::Delete.new.routes } },
           { name: 'csv', handler: -> { Resources::Csv.new.routes } },

data/lib/forest_admin_agent/routes/action/actions.rb

@@ -48,11 +48,11 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           context = build(args)
+          ensure_served_action(context)
           args = middleware_custom_action_approval_request_data(args)
           filter_for_caller = get_record_selection(args, context)
-          get_record_selection(args, context, include_user_scope: false)
 
-          context.permissions.can_smart_action?(args, context.collection, filter_for_caller)
+          context.permissions.can_smart_action?(args, context.collection, filter_for_caller, action_name: @action_name)
 
           raw_data = args.dig(:params, :data, :attributes, :values)
 
@@ -82,6 +82,7 @@ module ForestAdminAgent
 
         def handle_hook_request(args = {})
           context = build(args)
+          ensure_served_action(context)
           forest_fields = args.dig(:params, :data, :attributes, :fields)
           data = (if forest_fields
                     Schema::ForestValueConverter.make_form_data_from_fields(context.datasource,
@@ -117,6 +118,14 @@ module ForestAdminAgent
 
         private
 
+        def ensure_served_action(context)
+          served_index = @route_collection.schema[:actions].keys.index(@action_name)
+          return if context.collection.schema[:actions].keys.index(@action_name) == served_index
+
+          raise ForestAdminAgent::Http::Exceptions::BadRequestError,
+                "The collection #{context.collection.name} does not have this smart action"
+        end
+
         # Recorded as pending before the action runs and confirmed after, so an action that takes the process
         # down with it still leaves evidence that it started. A failed run is worth recording too — "who tried
         # to run this" is usually the interesting part — and an action answering with an Error result failed
@@ -211,11 +220,11 @@ module ForestAdminAgent
           )[0])
         end
 
-        def get_record_selection(args, context, include_user_scope: true)
+        def get_record_selection(args, context)
           attributes = args.dig(:params, :data, :attributes)
 
           # Match user filter + search + scope? + segment
-          scope = include_user_scope ? context.permissions.get_scope(context.collection) : nil
+          scope = context.permissions.get_scope(context.collection)
           filter = Filter.new(
             condition_tree: ConditionTreeFactory.intersect(
               [

data/lib/forest_admin_agent/routes/capabilities/collections.rb

@@ -69,6 +69,10 @@ module ForestAdminAgent
                 canUseProjectionViaHeaderOnList: true,
                 canUseMultipleFieldsProjectionOnRelation: true,
                 canUseAuditTrail: audit_trail_enabled?,
+                # The store always lists the timeline, both ways, so the cross-collection route is mounted
+                # wherever the trail is.
+                canUseAuditTrailTimeline: audit_trail_enabled?,
+                canSortAuditTrailTimeline: audit_trail_enabled?,
                 checksRelationReadPermissions: !skip_relation_read_permissions?
               }
             },