Admin UI: audit viewer, legal-holds manager, read-only viewer badge (#79) #81

Merged

Cordy merged 5 commits from feat/admin-ui into main

2026-07-30 04:41:27 +00:00

Cordy commented

2026-07-30 04:40:07 +00:00

Owner

Three of the four parts of #79. Deliberately not closing the issue — see below.

Audit viewer (#61) — dialog reachable from Settings, lists events newest-first from GET /api/v1/admin/audit with user and path-prefix filters, and flags any event whose result != "ok".

Legal-holds manager (#63) — list, place (path + optional note), lift. Shows who placed each hold and when.

Read-only viewer badge (#64) — internal/api/api.go now adds "readOnly" to the list response via an optional ReadOnly(ctx, path) bool interface assertion on the store, so the change is inert for any store that doesn't implement it. The client disables mkdir/upload and shows a "View only" chip. Advisory only: the scope driver remains the enforcer, this just stops offering actions that would be refused.

All strings in en/de/fr/it. The script block uses its own small adminFetch helper rather than assuming the shape of an existing wrapper.

What's not here, and why. The retention editor is missing because splicing it revealed something worse: trashAutoPurge does not appear anywhere in index.html. The v0.3.19 auto-purge backend is real and tested, but the Settings controls I described in that changelog entry never landed — an earlier patch step must have aborted before applying them and I didn't verify the UI half. So there is currently no way to enable auto-purge from the browser. Retention and auto-purge both belong in the same Settings block, so they should be done together, against the now-known anchors (set-save at line 426, its handler at 1745) rather than guessed ones. Tracked as a follow-up; #79 stays open for it.

Three of the four parts of #79. Deliberately **not** closing the issue — see below. **Audit viewer** (#61) — dialog reachable from Settings, lists events newest-first from `GET /api/v1/admin/audit` with user and path-prefix filters, and flags any event whose `result != "ok"`. **Legal-holds manager** (#63) — list, place (path + optional note), lift. Shows who placed each hold and when. **Read-only viewer badge** (#64) — `internal/api/api.go` now adds `"readOnly"` to the list response via an optional `ReadOnly(ctx, path) bool` interface assertion on the store, so the change is inert for any store that doesn't implement it. The client disables mkdir/upload and shows a "View only" chip. Advisory only: the scope driver remains the enforcer, this just stops offering actions that would be refused. All strings in en/de/fr/it. The script block uses its own small `adminFetch` helper rather than assuming the shape of an existing wrapper. **What's not here, and why.** The retention editor is missing because splicing it revealed something worse: `trashAutoPurge` does not appear anywhere in `index.html`. The v0.3.19 auto-purge backend is real and tested, but the Settings controls I described in that changelog entry never landed — an earlier patch step must have aborted before applying them and I didn't verify the UI half. So there is currently no way to enable auto-purge from the browser. Retention and auto-purge both belong in the same Settings block, so they should be done together, against the now-known anchors (`set-save` at line 426, its handler at 1745) rather than guessed ones. Tracked as a follow-up; #79 stays open for it.

Cordy added 5 commits

2026-07-30 04:40:09 +00:00