Admin UI for audit log, legal holds, retention and read-only spaces #79

New issue

Closed

opened 2026-07-30 04:28:10 +00:00 by Cordy · 0 comments

Cordy commented

2026-07-30 04:28:10 +00:00

Owner

The v0.3.15–v0.3.17 public-sector features (#61 audit, #62 share policy, #63 retention/hold, #64 read-only spaces) all shipped API-only. An operator can't see or use any of them from the browser today, which makes them effectively invisible in a demo.

Four pieces:

Audit viewer — dialog listing events newest-first from GET /api/v1/admin/audit, with user and path-prefix filters. Time, user, action, path, and a badge when result != "ok".
Legal-holds manager — list from GET /api/v1/admin/holds, place via POST (path + optional note), lift via DELETE. Show who placed it and when.
Retention editor — currently only settable by hand-editing settings JSON. A path = duration textarea in the Settings panel mapping to settings.retentionPeriods.
Viewer badge for read-only spaces — needs a small server change first: add "readOnly": ro to the list response in internal/api/api.go via an optional ReadOnly(ctx, path) bool interface assertion on the store (the scope driver already implements it). The UI then disables mkdir/upload and shows a "View only" chip. The server stays the enforcer — this only stops offering actions that would be refused anyway.

Design decisions already made (so this doesn't get re-litigated):

Entry points live inside the existing Settings dialog, which is already admin-gated, rather than in the avatar menu. Cheaper and avoids fragile patch anchoring on menu markup.
All strings need the usual four locales (en/de/fr/it).

Implementation note. A first attempt failed before running: the patch workflow embedded multi-line HTML at column 0 inside a run: | block, which is invalid YAML — the same trap that broke renewal-patch.yml earlier. Either indent embedded blocks to the block indent and strip in Python (line[10:]), or better, commit the new dialog markup as its own file on the branch and have the script splice it in.

The v0.3.15–v0.3.17 public-sector features (#61 audit, #62 share policy, #63 retention/hold, #64 read-only spaces) all shipped **API-only**. An operator can't see or use any of them from the browser today, which makes them effectively invisible in a demo. Four pieces: 1. **Audit viewer** — dialog listing events newest-first from `GET /api/v1/admin/audit`, with user and path-prefix filters. Time, user, action, path, and a badge when `result != "ok"`. 2. **Legal-holds manager** — list from `GET /api/v1/admin/holds`, place via POST (path + optional note), lift via DELETE. Show who placed it and when. 3. **Retention editor** — currently only settable by hand-editing settings JSON. A `path = duration` textarea in the Settings panel mapping to `settings.retentionPeriods`. 4. **Viewer badge for read-only spaces** — needs a small server change first: add `"readOnly": ro` to the list response in `internal/api/api.go` via an optional `ReadOnly(ctx, path) bool` interface assertion on the store (the scope driver already implements it). The UI then disables mkdir/upload and shows a "View only" chip. The server stays the enforcer — this only stops offering actions that would be refused anyway. **Design decisions already made** (so this doesn't get re-litigated): - Entry points live *inside* the existing Settings dialog, which is already admin-gated, rather than in the avatar menu. Cheaper and avoids fragile patch anchoring on menu markup. - All strings need the usual four locales (en/de/fr/it). **Implementation note.** A first attempt failed before running: the patch workflow embedded multi-line HTML at column 0 inside a `run: |` block, which is invalid YAML — the same trap that broke `renewal-patch.yml` earlier. Either indent embedded blocks to the block indent and strip in Python (`line[10:]`), or better, commit the new dialog markup as its own file on the branch and have the script splice it in.