ab6d41ba0e
Some checks failed
Caterium QA / qa (push) Has been cancelled
Owners/admins can now see, on the Аккаунт settings tab, a tamper-proof journal of who created, edited or deleted each order and when — including employees who have orders.* permissions. It is written from inside sun_save_app_state itself (which already diffs orders server-side for permission checks), so it can't be spoofed or wiped by the client, unlike the old per-browser 'История изменений' list which only covered the current device and had a 'Clear history' button anyone could press. - New table public.sun_order_audit_log (workspace, order id, action, actor, summary, details), locked down to security-definer writes only — no client insert/update/delete policy exists. - New RPC sun_list_order_audit(workspace, limit), admin-only. - New settings card 'Журнал заказов' reading it, admin-only, classified into the existing Аккаунт settings tab. - Verified end-to-end against a local PGlite instance: create/edit/ delete each produce one correctly-attributed row, and a non-admin member is denied read access. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 20260917150000_fresh_caterium.sql | ||
| 20260917193000_account_sidebar_brand.sql | ||
| 20260917221500_import_order_history.sql | ||
| 20260918000000_conflict_http_status.sql | ||
| 20260918010000_trial_demo_catalog.sql | ||
| 20260918060000_trial_banquet.sql | ||
| 20260918083000_trial_extras.sql | ||
| 20260920104500_workspace_sidebar_brand.sql | ||
| 20260922110319_public_basic_signup.sql | ||
| 20260922110544_public_signup_policy_security.sql | ||
| 20260922120000_order_audit_log.sql | ||