ab6d41ba0e
Some checks failed
Caterium QA / qa (push) Has been cancelled
Owners/admins can now see, on the Аккаунт settings tab, a tamper-proof journal of who created, edited or deleted each order and when — including employees who have orders.* permissions. It is written from inside sun_save_app_state itself (which already diffs orders server-side for permission checks), so it can't be spoofed or wiped by the client, unlike the old per-browser 'История изменений' list which only covered the current device and had a 'Clear history' button anyone could press. - New table public.sun_order_audit_log (workspace, order id, action, actor, summary, details), locked down to security-definer writes only — no client insert/update/delete policy exists. - New RPC sun_list_order_audit(workspace, limit), admin-only. - New settings card 'Журнал заказов' reading it, admin-only, classified into the existing Аккаунт settings tab. - Verified end-to-end against a local PGlite instance: create/edit/ delete each produce one correctly-attributed row, and a non-admin member is denied read access. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api | ||
| catalog | ||
| core | ||
| demo | ||
| fonts | ||
| help | ||
| legacy | ||
| offer-gallery | ||
| offer-templates | ||
| vendor | ||
| .htaccess | ||
| app-runtime.js | ||
| caterium-login-logo.png | ||
| caterium-mark-light.svg | ||
| index.html | ||
| manifest.webmanifest | ||
| pwa-icon-192.png | ||
| pwa-icon-512.png | ||
| refresh-login-20260912.html | ||
| service-worker.js | ||
| sun-logo.png | ||
