claude code agent 227
8d8ecaed82
Agent suggestion-edits (comments with suggestedText, #315) piled up: Apply auto-resolved the thread, cluttering the resolved tab, and the anchors stayed in the document. Make them ephemeral: resolving (Apply OR the new Dismiss) makes the comment DISAPPEAR — hard-delete + remove the Yjs `comment` mark — UNLESS the thread has replies, in which case resolve it (preserve the discussion). Manual Resolve is unchanged. Scope: only comments with `suggestedText`. Server: - New collab event `deleteCommentMark` (collaboration.handler) mirroring resolveCommentMark, wiring the existing removeYjsMarkByAttribute to strip the anchor from the doc. - `finalizeAppliedSuggestion` forks on `hasChildren`: replies → apply + resolve (outcome 'resolved'); none → apply + hard-delete + mark removal (outcome 'deleted'). - New `dismissSuggestion` (validates top-level + suggestedText + not applied/not resolved) with the same fork; permission `canComment` (NOT canEdit — dismiss doesn't change page text); audit COMMENT_SUGGESTION_DISMISSED. New POST /comments/dismiss-suggestion; apply stays canEdit. - Both return `{ outcome: 'deleted' | 'resolved' }` so the client picks the optimistic action. Data-integrity (review F1): the shared `deleteEphemeralSuggestion` removes the anchor mark FIRST and FATALLY, then deletes the DB row only on success. The row delete is irreversible, so a mark-removal failure — including the COLLAB_DISABLE_REDIS "no live instance" hard-error — must abort the whole operation (→ 5xx, repeatable) rather than swallow the error and leave a permanent orphan anchor pointing at a deleted comment. `deleteCommentMark` is no longer best-effort (unlike resolve, where the row is kept and a failed mark is recoverable). Client: - `canShowDismiss` (canComment) alongside `canShowApply` (canEdit); a "Dismiss" button next to Apply in the suggestion block. - `useApplySuggestionMutation`/`useDismissSuggestionMutation` reconcile the cache on `outcome` ('deleted' → remove; 'resolved' → relocate to the resolved tab). - Idempotent races (review F2): BOTH apply and dismiss onError reduce 404/400 to success (comment already gone/resolved), dropping it from the cache instead of a red error — restores the #315 apply idempotency the ephemeral delete would otherwise break. - i18n Dismiss / "Не применять" (ru/en). Not done (flagged): deleteCommentMark on the normal /comments/delete path — left out (would change every non-suggestion delete + needs gateway injection; the interactive client already strips the mark via unsetComment). Out of scope per the issue. Tests: server — apply/dismiss delete-vs-resolve fork, all four dismiss state guards, the deleteCommentMark handler, controller authz (dismiss=canComment, apply=canEdit), AND a mark-removal-failure test proving the row is NOT deleted + the error propagates (F1). client — Dismiss show-conditions, outcome cache reconciliation, and 404 idempotent race for BOTH dismiss and apply (F2). Verified: server tsc clean; comment+collaboration jest 144 passed. client tsc clean; vitest 905 passed | 1 expected-fail. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
160 lines
4.6 KiB
TypeScript
160 lines
4.6 KiB
TypeScript
export const AuditEvent = {
|
|
// Workspace
|
|
WORKSPACE_CREATED: 'workspace.created',
|
|
WORKSPACE_UPDATED: 'workspace.updated',
|
|
WORKSPACE_INVITE_CREATED: 'workspace.invite_created',
|
|
WORKSPACE_INVITE_RESENT: 'workspace.invite_resent',
|
|
WORKSPACE_INVITE_REVOKED: 'workspace.invite_revoked',
|
|
|
|
// User
|
|
USER_CREATED: 'user.created',
|
|
USER_DELETED: 'user.deleted',
|
|
USER_LOGIN: 'user.login',
|
|
USER_LOGOUT: 'user.logout',
|
|
USER_ROLE_CHANGED: 'user.role_changed',
|
|
USER_PASSWORD_CHANGED: 'user.password_changed',
|
|
USER_PASSWORD_RESET: 'user.password_reset',
|
|
USER_UPDATED: 'user.updated',
|
|
USER_DEACTIVATED: 'user.deactivated',
|
|
USER_ACTIVATED: 'user.activated',
|
|
|
|
// API Keys
|
|
API_KEY_CREATED: 'api_key.created',
|
|
API_KEY_UPDATED: 'api_key.updated',
|
|
API_KEY_DELETED: 'api_key.deleted',
|
|
|
|
// SCIM Tokens
|
|
SCIM_TOKEN_CREATED: 'scim_token.created',
|
|
SCIM_TOKEN_UPDATED: 'scim_token.updated',
|
|
SCIM_TOKEN_DELETED: 'scim_token.deleted',
|
|
|
|
// Space
|
|
SPACE_CREATED: 'space.created',
|
|
SPACE_UPDATED: 'space.updated',
|
|
SPACE_DELETED: 'space.deleted',
|
|
SPACE_MEMBER_ADDED: 'space.member_added',
|
|
SPACE_MEMBER_REMOVED: 'space.member_removed',
|
|
SPACE_MEMBER_ROLE_CHANGED: 'space.member_role_changed',
|
|
|
|
// Group
|
|
GROUP_CREATED: 'group.created',
|
|
GROUP_UPDATED: 'group.updated',
|
|
GROUP_DELETED: 'group.deleted',
|
|
GROUP_MEMBER_ADDED: 'group.member_added',
|
|
GROUP_MEMBER_REMOVED: 'group.member_removed',
|
|
|
|
// Comment
|
|
COMMENT_CREATED: 'comment.created',
|
|
COMMENT_DELETED: 'comment.deleted',
|
|
|
|
// Comment updates / resolve
|
|
COMMENT_UPDATED: 'comment.updated',
|
|
COMMENT_RESOLVED: 'comment.resolved',
|
|
COMMENT_REOPENED: 'comment.reopened',
|
|
COMMENT_SUGGESTION_APPLIED: 'comment.suggestion_applied',
|
|
COMMENT_SUGGESTION_DISMISSED: 'comment.suggestion_dismissed',
|
|
|
|
// Page
|
|
PAGE_CREATED: 'page.created',
|
|
PAGE_TRASHED: 'page.trashed',
|
|
PAGE_DELETED: 'page.deleted',
|
|
PAGE_RESTORED: 'page.restored',
|
|
PAGE_MOVED_TO_SPACE: 'page.moved_to_space',
|
|
PAGE_DUPLICATED: 'page.duplicated',
|
|
// Page permission
|
|
PAGE_RESTRICTED: 'page.restricted',
|
|
PAGE_RESTRICTION_REMOVED: 'page.restriction_removed',
|
|
PAGE_PERMISSION_ADDED: 'page.permission_added',
|
|
PAGE_PERMISSION_REMOVED: 'page.permission_removed',
|
|
// Page verification
|
|
PAGE_VERIFICATION_CREATED: 'page.verification_created',
|
|
PAGE_VERIFICATION_UPDATED: 'page.verification_updated',
|
|
PAGE_VERIFICATION_REMOVED: 'page.verification_removed',
|
|
PAGE_VERIFIED: 'page.verified',
|
|
PAGE_APPROVAL_REQUESTED: 'page.approval_requested',
|
|
PAGE_APPROVAL_REJECTED: 'page.approval_rejected',
|
|
PAGE_MARKED_OBSOLETE: 'page.marked_obsolete',
|
|
|
|
// Share
|
|
SHARE_CREATED: 'share.created',
|
|
SHARE_DELETED: 'share.deleted',
|
|
|
|
// Import / Export
|
|
PAGE_IMPORTED: 'page.imported',
|
|
PAGE_EXPORTED: 'page.exported',
|
|
SPACE_EXPORTED: 'space.exported',
|
|
|
|
// SSO provider management
|
|
SSO_PROVIDER_CREATED: 'sso.provider_created',
|
|
SSO_PROVIDER_UPDATED: 'sso.provider_updated',
|
|
SSO_PROVIDER_DELETED: 'sso.provider_deleted',
|
|
|
|
// MFA
|
|
USER_MFA_ENABLED: 'user.mfa_enabled',
|
|
USER_MFA_DISABLED: 'user.mfa_disabled',
|
|
USER_MFA_BACKUP_CODE_GENERATED: 'user.mfa_backup_code_generated',
|
|
|
|
// License
|
|
LICENSE_ACTIVATED: 'license.activated',
|
|
LICENSE_REMOVED: 'license.removed',
|
|
|
|
// Attachment
|
|
ATTACHMENT_UPLOADED: 'attachment.uploaded',
|
|
// ATTACHMENT_DELETED: 'attachment.deleted',
|
|
} as const;
|
|
|
|
export type AuditEventType = (typeof AuditEvent)[keyof typeof AuditEvent];
|
|
|
|
export const EXCLUDED_AUDIT_EVENTS: Set<string> = new Set([
|
|
AuditEvent.PAGE_CREATED,
|
|
AuditEvent.PAGE_MOVED_TO_SPACE,
|
|
AuditEvent.PAGE_DUPLICATED,
|
|
AuditEvent.COMMENT_CREATED,
|
|
AuditEvent.COMMENT_UPDATED,
|
|
AuditEvent.COMMENT_RESOLVED,
|
|
AuditEvent.COMMENT_REOPENED,
|
|
AuditEvent.ATTACHMENT_UPLOADED
|
|
]);
|
|
|
|
export const AuditResource = {
|
|
WORKSPACE: 'workspace',
|
|
USER: 'user',
|
|
PAGE: 'page',
|
|
SPACE: 'space',
|
|
SPACE_MEMBER: 'space_member',
|
|
GROUP: 'group',
|
|
COMMENT: 'comment',
|
|
SHARE: 'share',
|
|
API_KEY: 'api_key',
|
|
SCIM_TOKEN: 'scim_token',
|
|
SSO_PROVIDER: 'sso_provider',
|
|
WORKSPACE_INVITATION: 'workspace_invitation',
|
|
ATTACHMENT: 'attachment',
|
|
LICENSE: 'license',
|
|
} as const;
|
|
|
|
export type AuditResourceType =
|
|
(typeof AuditResource)[keyof typeof AuditResource];
|
|
|
|
export type ActorType = 'user' | 'system' | 'api_key';
|
|
|
|
export interface AuditLogPayload {
|
|
event: AuditEventType;
|
|
resourceType: AuditResourceType;
|
|
resourceId?: string;
|
|
spaceId?: string;
|
|
changes?: {
|
|
before?: Record<string, any>;
|
|
after?: Record<string, any>;
|
|
};
|
|
metadata?: Record<string, any>;
|
|
}
|
|
|
|
export interface AuditLogData extends AuditLogPayload {
|
|
workspaceId: string;
|
|
actorId?: string;
|
|
actorType: ActorType;
|
|
ipAddress?: string;
|
|
userAgent?: string;
|
|
}
|