forest_admin_agent 1.45.1 → 1.46.0

data/lib/forest_admin_agent/routes/resources/audit_trail.rb

@@ -10,13 +10,9 @@ module ForestAdminAgent
       class AuditTrail < AbstractAuthenticatedRoute
         include ForestAdminAgent::Utils
         include AuditTrailRoute
+        include AuditTrailQueryParams
 
-        DEFAULT_PAGE_SIZE = 20
-        MAX_PAGE_SIZE = 100
         SCAN_BATCH_SIZE = 500
-        DATE_ONLY = /\A\d{4}-\d{2}-\d{2}\z/
-        # Wall-clock datetime, `T` or space separator, seconds optional: `YYYY-MM-DD[T ]HH:mm[:ss]`.
-        DATE_TIME = /\A(\d{4}-\d{2}-\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?\z/
 
         def setup_routes
           return self unless store
@@ -46,9 +42,8 @@ module ForestAdminAgent
 
           filters = {
             collection: context.collection.name,
-            # args[:params]['id'] is already Forest's packed id, the form the audit store keys on — plus any id
-            # this record was filed under before a rename, each bounded by when it stopped being that id.
-            record_id: record_segments(context.collection, args[:params]['id']),
+            # Already Forest's packed id, the form the audit store keys on.
+            record_id: args[:params]['id'],
             **parse_filters(args)
           }
 
@@ -81,7 +76,7 @@ module ForestAdminAgent
           timestamp = parse_state_timestamp(args)
           entries = store.list_since(
             collection: context.collection.name,
-            record_id: record_segments(context.collection, args[:params]['id']),
+            record_id: args[:params]['id'],
             timestamp: timestamp
           )
           # Fully qualified: inside this class, `AuditTrail` is the route itself.
@@ -89,15 +84,24 @@ module ForestAdminAgent
           # Asked again now, for the same reason the history route asks, and the same way: the record read
           # above can be deleted — or an id that was gone then be taken by somebody else's record — while the
           # audit read is in flight.
-          withholding_scope = withholding_scope_for(context, context.collection, args[:params]['id'],
-                                                    gone_at_check)
+          withholding = withholding_of(context, context.collection, args[:params]['id'], gone_at_check)
 
           { name: args[:params]['collection_name'],
-            content: { data: answerable_state(state, withholding_scope, context, args[:params]['id']) } }
+            content: { data: answerable_state(state, state_scope(withholding, timestamp), context,
+                                              args[:params]['id']) } }
         end
 
         private
 
+        # The whole reconstruction belongs to an earlier record when it stands strictly before the boundary. At
+        # the boundary's own instant it already reflects every row there, a replacement `create` sharing it
+        # included, so it is the current record's.
+        def state_scope(withholding, timestamp)
+          return withholding.scope if withholding.boundary.nil?
+
+          withholding.scope if ::Time.iso8601(timestamp) < ::Time.iso8601(withholding.boundary.timestamp.to_s)
+        end
+
         # The history route withholds a gone record's captured values from a caller whose scope they fail, and
         # this route is nothing but those values reassembled: without the same test they come back one request
         # away. A reconstruction the scope cannot answer withholds too — absent is not the same as passing.
@@ -125,11 +129,6 @@ module ForestAdminAgent
           (page.is_a?(Hash) ? page['number'].to_i : 0) <= 1
         end
 
-        def available_user(author)
-          { id: author[:user_id], firstName: author[:user_first_name],
-            lastName: author[:user_last_name], email: author[:user_email] }
-        end
-
         def history_matched_in_store(context, args, filters, gone_at_check)
           skip, limit = parse_pagination(args)
           history = store.list_by_record(**filters, skip: skip, limit: limit, order: parse_sort(args))
@@ -137,8 +136,8 @@ module ForestAdminAgent
           count = store.count_by_record(**filters)
           withholding = withholding_for(context, args, gone_at_check)
 
-          # Gone between the check and the read: this answer withholds, so the rows, count and authors matched
-          # in SQL above must not decide what is served either.
+          # Gone between the check and the read, or carrying an earlier record's rows: this answer withholds, so
+          # the rows, count and authors matched in SQL above must not decide what is served either.
           if withholding.scope && filters.slice(:search, :fields).any?
             return history_matched_after_withholding(context, args, filters, gone_at_check, withholding)
           end
@@ -149,7 +148,8 @@ module ForestAdminAgent
         # Matched in SQL, `search` and `fields` would test the values as captured, so which rows come back, the
         # count and the authors would still say what the withholding hides — one probe per character. They are
         # matched against what is served instead, which means scanning the whole history here, in batches, so
-        # only the page asked for is kept. Only for a gone record: one in scope was the caller's to read whole.
+        # only the page asked for is kept. Whenever a withholding scope applies: a gone record, or the rows an earlier
+        # record filed under a live one's id. Otherwise the history was the caller's to read whole.
         def history_matched_after_withholding(context, args, filters, gone_at_check, withholding = nil)
           skip, limit = parse_pagination(args)
           value_filters = filters.slice(:search, :fields)
@@ -192,10 +192,7 @@ module ForestAdminAgent
         # Asked again now, because the check above ran before these rows were read: a record deleted in
         # between answered "present and in scope" for rows that already carry its delete.
         def withholding_for(context, args, gone_at_check)
-          withholding_scope = withholding_scope_for(context, context.collection, args[:params]['id'],
-                                                    gone_at_check)
-
-          Withholding.new(context.collection, withholding_scope, context.caller.timezone)
+          withholding_of(context, context.collection, args[:params]['id'], gone_at_check)
         end
 
         def matches_value_filters?(entry, search: nil, fields: nil)
@@ -256,105 +253,15 @@ module ForestAdminAgent
           args.dig(:params, 'sort').to_s == 'timestamp' ? 'asc' : 'desc'
         end
 
-        # JSON:API pagination: 1-based page[number] (default 1) and page[size] (default 20, capped at
-        # 100). Out-of-bound or non-numeric values fall back to the defaults rather than erroring.
+        # JSON:API pagination: 1-based page[number] (default 1) and page[size]. Out-of-bound or non-numeric
+        # values fall back to the defaults rather than erroring.
         def parse_pagination(args)
-          # `?page=foo` reaches us as a bare String, which `dig` refuses to walk into.
-          page = args.dig(:params, 'page')
-          page = {} unless page.is_a?(Hash)
-
-          size = page['size'].to_i
-          size = DEFAULT_PAGE_SIZE if size < 1
-          size = MAX_PAGE_SIZE if size > MAX_PAGE_SIZE
-
-          number = page['number'].to_i
+          size = parse_page_size(args)
+          number = page_param(args)['number'].to_i
           number = 1 if number < 1
 
           [(number - 1) * size, size]
         end
-
-        def request_timezone(args)
-          timezone = args.dig(:params, 'timezone').to_s
-
-          timezone.empty? ? 'UTC' : timezone
-        end
-
-        def parse_filters(args)
-          timezone = request_timezone(args)
-
-          {
-            user_ids: parse_user_ids(args.dig(:params, 'userIds')),
-            fields: parse_fields(args.dig(:params, 'fields')),
-            search: parse_search(args.dig(:params, 'search')),
-            start_timestamp: parse_date_boundary(args.dig(:params, 'startDate'), timezone, :start),
-            end_timestamp: parse_date_boundary(args.dig(:params, 'endDate'), timezone, :end)
-          }.compact
-        end
-
-        # Free text, trimmed; blank means no filter rather than a term that matches everything.
-        def parse_search(raw)
-          term = raw.to_s.strip
-
-          term.empty? ? nil : term
-        end
-
-        # Comma-separated field names, kept verbatim (a name may hold a dot). Empty after parsing → no filter.
-        def parse_fields(raw)
-          return nil if raw.nil?
-
-          names = (raw.is_a?(Array) ? raw : raw.to_s.split(',')).map { |name| name.to_s.strip }.reject(&:empty?)
-          names.empty? ? nil : names
-        end
-
-        # Comma-separated integer ids; non-numeric tokens are dropped. Empty after parsing → no filter.
-        def parse_user_ids(raw)
-          return nil if raw.nil? || raw.to_s.empty?
-
-          ids = raw.to_s.split(',').map(&:strip).grep(/\A\d+\z/).map(&:to_i)
-          ids.empty? ? nil : ids
-        end
-
-        # `startDate`/`endDate` accept a bare day (`YYYY-MM-DD`) or a wall-clock datetime
-        # (`YYYY-MM-DD[T ]HH:mm[:ss]`), read as local time in the request timezone and returned as a UTC
-        # ISO instant the store can compare against stored timestamps.
-        def parse_date_boundary(raw, timezone, boundary)
-          return nil if raw.nil? || raw.to_s.empty?
-
-          zone = Time.find_zone(timezone)
-          raise Http::Exceptions::ValidationError, "Invalid timezone: \"#{timezone}\"" if zone.nil?
-
-          instant = begin
-            local_instant(zone, raw.to_s, boundary)
-          rescue ArgumentError
-            nil
-          end
-
-          if instant.nil?
-            raise Http::Exceptions::ValidationError,
-                  "Invalid date: \"#{raw}\" (expected YYYY-MM-DD or YYYY-MM-DDTHH:mm)"
-          end
-
-          instant.utc.iso8601(3)
-        end
-
-        def local_instant(zone, raw, boundary)
-          if DATE_ONLY.match?(raw)
-            day = zone.parse(raw)
-            # Bare day → start (00:00:00.000) or end (23:59:59.999) of that local day.
-            boundary == :end ? day.end_of_day : day.beginning_of_day
-          elsif (match = DATE_TIME.match(raw))
-            date, hours, minutes, seconds = match.captures
-            base = zone.parse("#{date}T#{hours}:#{minutes}")
-            if seconds
-              base.change(sec: seconds.to_i, usec: 0)
-            elsif boundary == :end
-              # Minutes-only end boundary stays inclusive to :59.999; start stays at :00.000.
-              base.change(sec: 59, usec: 999_000)
-            else
-              base
-            end
-          end
-        end
       end
     end
   end

data/lib/forest_admin_agent/routes/resources/audit_trail_correlation.rb

@@ -74,9 +74,7 @@ module ForestAdminAgent
           # An empty answer has nothing to withhold, so it does not earn a second read of the record.
           return history if history.empty?
 
-          scope = withholding_scope_for(context, collection, record_id, gone_at_check)
-
-          withhold_out_of_scope_values(history, Withholding.new(collection, scope, context.caller.timezone))
+          withhold_out_of_scope_values(history, withholding_of(context, collection, record_id, gone_at_check))
         end
 
         def assert_scope(args)

data/lib/forest_admin_agent/routes/resources/audit_trail_query_params.rb

@@ -0,0 +1,131 @@
+module ForestAdminAgent
+  module Routes
+    module Resources
+      # The query params every audit-trail listing reads the same way, the per-record history and the
+      # cross-collection timeline alike, so a filter cannot mean one thing on one route and another on the
+      # other. Mirrors the Node agent's `audit-trail/query-params.ts`.
+      module AuditTrailQueryParams
+        DEFAULT_PAGE_SIZE = 20
+        MAX_PAGE_SIZE = 100
+        DATE_ONLY = /\A\d{4}-\d{2}-\d{2}\z/
+        # Wall-clock datetime, `T` or space separator, seconds optional: `YYYY-MM-DD[T ]HH:mm[:ss]`.
+        DATE_TIME = /\A(\d{4}-\d{2}-\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?\z/
+        OPERATIONS = %w[create update delete action action_failed].freeze
+
+        private
+
+        # `?page=foo` reaches us as a bare String, which `dig` refuses to walk into.
+        def page_param(args)
+          page = args.dig(:params, 'page')
+
+          page.is_a?(Hash) ? page : {}
+        end
+
+        # page[size] defaults to 20 and is capped at 100.
+        def parse_page_size(args)
+          size = page_param(args)['size'].to_i
+
+          size < 1 ? DEFAULT_PAGE_SIZE : [size, MAX_PAGE_SIZE].min
+        end
+
+        def request_timezone(args)
+          timezone = args.dig(:params, 'timezone').to_s
+
+          timezone.empty? ? 'UTC' : timezone
+        end
+
+        def parse_filters(args)
+          timezone = request_timezone(args)
+
+          {
+            user_ids: parse_user_ids(args.dig(:params, 'userIds')),
+            operations: parse_operations(args.dig(:params, 'operations')),
+            fields: parse_fields(args.dig(:params, 'fields')),
+            search: parse_search(args.dig(:params, 'search')),
+            start_timestamp: parse_date_boundary(args.dig(:params, 'startDate'), timezone, :start),
+            end_timestamp: parse_date_boundary(args.dig(:params, 'endDate'), timezone, :end)
+          }.compact
+        end
+
+        # Free text, trimmed; blank means no filter rather than a term that matches everything.
+        def parse_search(raw)
+          term = raw.to_s.strip
+
+          term.empty? ? nil : term
+        end
+
+        # Comma-separated field names, kept verbatim (a name may hold a dot). Empty after parsing → no filter.
+        def parse_fields(raw)
+          return nil if raw.nil?
+
+          names = (raw.is_a?(Array) ? raw : raw.to_s.split(',')).map { |name| name.to_s.strip }.reject(&:empty?)
+          names.empty? ? nil : names
+        end
+
+        # Comma-separated, from a closed set. An unrecognized value is rejected rather than dropped: a silently
+        # ignored filter returns unfiltered rows into a list the caller believes is filtered.
+        def parse_operations(raw)
+          tokens = raw.to_s.split(',').map(&:strip).reject(&:empty?)
+          unknown = tokens.find { |token| !OPERATIONS.include?(token) }
+
+          if unknown
+            raise Http::Exceptions::ValidationError,
+                  "Invalid operation: \"#{unknown}\" (expected one of #{OPERATIONS.join(", ")})"
+          end
+
+          tokens.empty? ? nil : tokens
+        end
+
+        # Comma-separated integer ids; non-numeric tokens are dropped. Empty after parsing → no filter.
+        def parse_user_ids(raw)
+          return nil if raw.nil? || raw.to_s.empty?
+
+          ids = raw.to_s.split(',').map(&:strip).grep(/\A\d+\z/).map(&:to_i)
+          ids.empty? ? nil : ids
+        end
+
+        # `startDate`/`endDate` accept a bare day (`YYYY-MM-DD`) or a wall-clock datetime
+        # (`YYYY-MM-DD[T ]HH:mm[:ss]`), read as local time in the request timezone and returned as a UTC
+        # ISO instant the store can compare against stored timestamps.
+        def parse_date_boundary(raw, timezone, boundary)
+          return nil if raw.nil? || raw.to_s.empty?
+
+          zone = Time.find_zone(timezone)
+          raise Http::Exceptions::ValidationError, "Invalid timezone: \"#{timezone}\"" if zone.nil?
+
+          instant = begin
+            local_instant(zone, raw.to_s, boundary)
+          rescue ArgumentError
+            nil
+          end
+
+          if instant.nil?
+            raise Http::Exceptions::ValidationError,
+                  "Invalid date: \"#{raw}\" (expected YYYY-MM-DD or YYYY-MM-DDTHH:mm)"
+          end
+
+          instant.utc.iso8601(3)
+        end
+
+        def local_instant(zone, raw, boundary)
+          if DATE_ONLY.match?(raw)
+            day = zone.parse(raw)
+            # Bare day → start (00:00:00.000) or end (23:59:59.999) of that local day.
+            boundary == :end ? day.end_of_day : day.beginning_of_day
+          elsif (match = DATE_TIME.match(raw))
+            date, hours, minutes, seconds = match.captures
+            base = zone.parse("#{date}T#{hours}:#{minutes}")
+            if seconds
+              base.change(sec: seconds.to_i, usec: 0)
+            elsif boundary == :end
+              # Minutes-only end boundary stays inclusive to :59.999; start stays at :00.000.
+              base.change(sec: 59, usec: 999_000)
+            else
+              base
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/routes/resources/audit_trail_route.rb

@@ -71,54 +71,31 @@ module ForestAdminAgent
         # merging pages ordered by (timestamp, id). Value hashes keep the keys they were stored with: a record's
         # own column names, or an action answer's camelCase Forest names.
         def serialize_record(record)
-          # `previous_record_id` stays out: it is how the agent follows a record across a rename, not something
-          # the payload contract carries.
-          record.to_h.except(:previous_record_id).transform_keys { |key| key.to_s.camelize(:lower) }
+          record.to_h.transform_keys { |key| key.to_s.camelize(:lower) }
         end
 
         def store
           ::ForestAdminAgent::AuditTrail.store
         end
 
-        # Every id this record has been filed under, each with the moment it stopped being that id. Rows
-        # written before an update moved a writable primary key stay under the id they were true of, so a
-        # history query that asked for the current id alone would start at the rename and call that the whole
-        # story — and one that asked for the bare ids would sweep up whatever record holds an abandoned id now.
-        #
-        # Breadth-first, and no depth limit: every hop adds an id not already seen and there are finitely many
-        # of those, so skipping what we hold is both the cycle guard and the terminator. A cap would have
-        # truncated a record renamed often enough, which reads exactly like missing history.
-        def record_segments(collection, packed_id)
-          segments = [{ id: packed_id, until: nil, until_row: nil }]
-          queue = segments.dup
-
-          until queue.empty?
-            segment = queue.shift
-
-            store.renamed_from(collection: collection.name, record_id: segment[:id]).each do |previous|
-              next if segments.any? { |seen| seen[:id] == previous[:id] }
-
-              # Bounded by its own rename and by everything walked through to reach it: an id abandoned twice
-              # only belongs to this record up to the earlier of them.
-              found = earlier_bound(previous, segment).merge(id: previous[:id])
-              segments << found
-              queue << found
-            end
-          end
-
-          segments
-        end
+        # How to withhold the rows served for this id. A record gone at either look has all its rows tested
+        # against the caller's scope. A live one in scope still has the rows filed before it took the id: a
+        # delete frees an id, and a confirmed `create` marks where a record took one freed without a confirmed
+        # delete — a primary-key move, or a delete that never confirmed. Those rows are another record's, which
+        # the current one's scope says nothing about.
+        def withholding_of(context, collection, packed_id, gone_at_check)
+          gone_scope = withholding_scope_for(context, collection, packed_id, gone_at_check)
+          return Withholding.new(collection, gone_scope, context.caller.timezone) if gone_scope
 
-        # Bounds compare as the trail orders, (timestamp, row id); nil is "no bound yet", which is later than
-        # any of them. Through `<=>`, since Array is not Comparable and `<=` on one raises.
-        def earlier_bound(one, other)
-          return other.slice(:until, :until_row) if one[:until].nil?
-          return one.slice(:until, :until_row) if other[:until].nil?
+          scope = context.permissions.get_scope(collection)
+          boundary = scope && store.life_boundary_of(collection: collection.name, record_id: packed_id)
 
-          pair = ->(bound) { [bound[:until], bound[:until_row].to_i] }
-          earlier = (pair[one] <=> pair[other]) <= 0 ? one : other
+          Withholding.new(collection, boundary && scope, context.caller.timezone, boundary)
+        end
 
-          earlier.slice(:until, :until_row)
+        def available_user(author)
+          { id: author[:user_id], firstName: author[:user_first_name],
+            lastName: author[:user_last_name], email: author[:user_email] }
         end
 
         # What the audit trail actually records: primary keys, so a state can be identified, plus the writable

data/lib/forest_admin_agent/routes/resources/audit_trail_timeline.rb

@@ -0,0 +1,96 @@
+module ForestAdminAgent
+  module Routes
+    module Resources
+      # The project-level timeline, mirroring the Node agent's `GET /_audit-trail`: every readable collection's
+      # audit rows in one walk, paged by an inclusive cursor rather than by page number, since the front merges
+      # it with the activity logs and no count spans both.
+      #
+      # Values are served as on the per-record history: a caller who can read a collection reads its rows'
+      # values. Who may open the project's Activity Logs page at all is Forest's to decide, not the agent's.
+      class AuditTrailTimeline < AbstractAuthenticatedRoute
+        include AuditTrailRoute
+        include AuditTrailQueryParams
+
+        def setup_routes
+          return self unless store
+
+          add_route('forest_audit_trail_timeline', 'get', '/_audit-trail', ->(args) { handle_request(args) })
+
+          self
+        end
+
+        def handle_request(args = {})
+          context = build(args)
+          order = args.dig(:params, 'sort').to_s == 'timestamp' ? 'asc' : 'desc'
+          limit = parse_page_size(args)
+          cursor = parse_cursor(args, order)
+          # Parsed before the permission sweep, so a malformed filter reads as a 400 whatever the caller may
+          # see. No `fields`: a column name means nothing across collections.
+          filters = parse_filters(args).except(:fields)
+          collections = readable_collections(context).map(&:name)
+
+          # One row over the page: the only way to know whether a further page exists without a count.
+          fetched = store.list_timeline(**filters, **cursor, order: order, collections: collections,
+                                                             limit: limit + 1)
+          page = fetched.first(limit)
+          meta = { cursor: fetched.size > limit ? next_cursor(page, cursor, order) : nil }
+          # Authors on the first page only, like the per-record route: they do not change along the walk, and
+          # later pages omit the key rather than send `[]`.
+          if cursor[:before].nil? && cursor[:after].nil?
+            meta[:availableUsers] = store.timeline_users(**filters, collections: collections)
+                                         .map { |author| available_user(author) }
+          end
+
+          { content: { data: page.map { |record| serialize_record(record) }, meta: meta } }
+        end
+
+        private
+
+        # A record-level scope cannot be evaluated across a whole timeline without fetching every record it
+        # mentions, so a collection the caller only sees through one is left out entirely rather than served
+        # unfiltered: the row alone would say that a record they cannot read exists and was touched.
+        def readable_collections(context)
+          context.permissions.allowed_collections(:read, context.datasource.collections.values)
+                 .select { |collection| context.permissions.get_scope(collection).nil? }
+        end
+
+        # `before` (`after` oldest first) is an inclusive bound, so the rows sharing the last row's timestamp are
+        # carried as `excludeIds` rather than skipped. When the previous page ended on the same timestamp its
+        # exclusions still apply, so a timestamp holding more rows than one page walks on instead of looping.
+        # Nil when the walk would not progress: staying on the same timestamp must exclude at least one more id.
+        def next_cursor(page, previous, order)
+          bound = order == 'asc' ? :after : :before
+          last = page.last
+          same_boundary = previous[bound] && same_instant?(previous[bound], last.timestamp)
+          carried = same_boundary ? previous[:exclude_ids] : []
+          tied = page.select { |row| same_instant?(row.timestamp, last.timestamp) }.map(&:id)
+          exclude_ids = (carried + tied).uniq
+
+          return nil if same_boundary && exclude_ids.size == carried.size
+
+          { bound => last.timestamp, excludeIds: exclude_ids }
+        end
+
+        def same_instant?(one, other)
+          Time.iso8601(one.to_s) == Time.iso8601(other.to_s)
+        end
+
+        # The bound is the timestamp of a row this route served, so it is an ISO instant; only the one for the
+        # walk's direction is read.
+        def parse_cursor(args, order)
+          bound = order == 'asc' ? :after : :before
+          raw = args.dig(:params, bound.to_s).to_s
+          exclude_ids = args.dig(:params, 'excludeIds').to_s.split(',').map(&:strip).grep(/\A\d+\z/).map(&:to_i)
+
+          { bound => raw.empty? ? nil : parse_instant(raw), exclude_ids: exclude_ids }
+        end
+
+        def parse_instant(raw)
+          Time.iso8601(raw).utc.iso8601(3)
+        rescue ArgumentError
+          raise Http::Exceptions::ValidationError, "Invalid cursor: \"#{raw}\" (expected an ISO 8601 instant)"
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/routes/resources/audit_trail_withholding.rb

@@ -7,9 +7,10 @@ module ForestAdminAgent
       # since a rule only one of them applies is one lookup away from being no rule at all.
       module AuditTrailWithholding
         # Everything a withholding decision needs, and nothing a request context would drag along: the
-        # collection the rows belong to, the scope to test them against, and the timezone its date
-        # comparisons read in.
-        Withholding = Struct.new(:collection, :scope, :timezone)
+        # collection the rows belong to, the scope to test them against, the timezone its date comparisons read
+        # in, and — for a live record whose id another record held before — the row where its own life began,
+        # so only the rows before it are tested. No boundary means every row is.
+        Withholding = Struct.new(:collection, :scope, :timezone, :boundary)
 
         NULL_EXCLUDING_OPERATORS = [
           ForestAdminDatasourceToolkit::Components::Query::ConditionTree::Operators::NOT_EQUAL,
@@ -24,7 +25,16 @@ module ForestAdminAgent
         def withhold_out_of_scope_values(entries, withholding)
           return entries if withholding.scope.nil?
 
-          entries.map { |entry| withhold(entry, withholding) }
+          entries.map { |entry| of_withheld_life?(entry, withholding.boundary) ? withhold(entry, withholding) : entry }
+        end
+
+        # A boundary `delete` is the earlier record's last row, a boundary `create` the current record's first.
+        def of_withheld_life?(entry, boundary)
+          return true if boundary.nil?
+          return boundary.operation == 'delete' if entry.id == boundary.id
+
+          ([::Time.iso8601(entry.timestamp.to_s), entry.id.to_i] <=>
+            [::Time.iso8601(boundary.timestamp.to_s), boundary.id.to_i]).negative?
         end
 
         def withhold(entry, withholding)
@@ -48,11 +58,15 @@ module ForestAdminAgent
         # separately releases the ones that can be proven in scope — "it used to be X" can't escape through a
         # row whose new value is out of scope, since that side is tested on its own.
         def withhold_each_side(entry, withholding)
-          # An update that moved a writable primary key files its row under the id the record ended up with,
-          # and keeps the one it had on `previous_record_id`. Each side is tested against the id it was true
-          # of, or the new state's id would decide whether the old state is in scope.
-          before = entry.previous_record_id || entry.record_id
-          kept = in_scope?(entry.previous_values, before, withholding) ? entry : blank(entry, :previous_values)
+          # The row is filed under the id the record ended up with, which says nothing about a writable key the
+          # update may have moved: on the previous side the id answers only for a key never captured, read-only
+          # and so unmoved. A redacted key stays unanswered, which over-withholds an update that kept its key —
+          # the safe side of a move the trail cannot see.
+          kept = if in_scope?(entry.previous_values, entry.record_id, withholding, id_answers_for_keys: false)
+                   entry
+                 else
+                   blank(entry, :previous_values)
+                 end
 
           in_scope?(kept.new_values, after_id(kept), withholding) ? kept : blank(kept, :new_values)
         end

data/lib/forest_admin_agent/routes/resources/list.rb

@@ -61,13 +61,14 @@ module ForestAdminAgent
         def handle_search_decorator(search_value, records, collection)
           decorator = { decorators: [] }
           unless search_value.nil?
+            search_value = search_value.downcase
             records.each_with_index do |entry, index|
               decorator[:decorators][index] = { id: Utils::Id.pack_id(collection, entry), search: [] }
               # attributes method is defined on ActiveRecord::Base model
               attributes = entry.respond_to?(:attributes) ? entry.attributes : entry
 
               attributes.each do |field_key, field_value|
-                if !field_value.is_a?(Array) && field_value.to_s.downcase.include?(search_value.downcase)
+                if !field_value.is_a?(Array) && field_value.to_s.downcase.include?(search_value)
                   decorator[:decorators][index][:search] << field_key
                 end
               end

data/lib/forest_admin_agent/routes/security/scope_invalidation.rb

@@ -18,7 +18,8 @@ module ForestAdminAgent
 
         def handle_request(args)
           build(args)
-          Permissions.invalidate_cache('forest.rendering')
+          rendering_id = args.dig(:params, 'renderingId')
+          Permissions.invalidate_rendering_cache(rendering_id.to_s.strip.empty? ? nil : rendering_id)
 
           { content: nil, status: 204 }
         end