#280: Manual purge tab — instance-wide admin trash listing + purge, slot-leak fix (v0.6.49) #283

Merged

Cordy merged 4 commits from feat/trash280 into main

2026-08-19 19:44:52 +00:00

Cordy commented

2026-08-19 19:41:39 +00:00

Owner

Second child of epic #278, per the signed-off mockup. Also carries the fix for the v0.6.48 dogfood finding.

Backend

internal/storage/trash/admin.go (new): ListTrashAll walks every user's personal trash plus every space trash, newest first, each entry annotated with owner, eligible, hold, keepUntil — legal holds and retention windows computed server-side. AdminPurge(owner, id) is owner-aware (space entries resolve via their namespaced id), refuses held or retained entries with ErrRetention, and returns the original path for auditing. Both hard-require an operator on top of the HTTP gate.
GET /api/v1/admin/trash + POST /api/v1/admin/trash/purge under requireAdmin, registered only when trash + admin are both configured. Each purge audited as manual-purge — the feed #281's Purge log will read.
Driver tests on the existing memDriver harness: non-admin refusal, hold/retention blocks, personal + space purge round trips.

Frontend

Slot-leak fix: adm-slot-trash joins renderAdminTopic's explicit hide-all ID list — the Deleted files slot no longer leaks into Retention & holds (or any other topic).
Manual purge tab: summary bar (n deleted files · size across o owners — e eligible), "Purge all eligible (n)" with two-step arm/confirm, card rows with mono original path, owner/space + deleted-by + date, hold/"retention until" badges with the Purge button disabled, inline per-row confirm strip (no confirm() popup), audit-note hint.

Second child of epic #278, per the signed-off mockup. Also carries the fix for the v0.6.48 dogfood finding. **Backend** - `internal/storage/trash/admin.go` (new): `ListTrashAll` walks every user's personal trash plus every space trash, newest first, each entry annotated with `owner`, `eligible`, `hold`, `keepUntil` — legal holds and retention windows computed server-side. `AdminPurge(owner, id)` is owner-aware (space entries resolve via their namespaced id), refuses held or retained entries with `ErrRetention`, and returns the original path for auditing. Both hard-require an operator on top of the HTTP gate. - `GET /api/v1/admin/trash` + `POST /api/v1/admin/trash/purge` under `requireAdmin`, registered only when trash + admin are both configured. Each purge audited as `manual-purge` — the feed #281's Purge log will read. - Driver tests on the existing memDriver harness: non-admin refusal, hold/retention blocks, personal + space purge round trips. **Frontend** - **Slot-leak fix**: `adm-slot-trash` joins renderAdminTopic's explicit hide-all ID list — the Deleted files slot no longer leaks into Retention & holds (or any other topic). - Manual purge tab: summary bar (`n deleted files · size across o owners — e eligible`), "Purge all eligible (n)" with two-step arm/confirm, card rows with mono original path, owner/space + deleted-by + date, hold/"retention until" badges with the Purge button disabled, inline per-row confirm strip (no `confirm()` popup), audit-note hint.

Cordy added 4 commits

2026-08-19 19:41:40 +00:00