ab6d41ba0e
Some checks failed
Caterium QA / qa (push) Has been cancelled
Owners/admins can now see, on the Аккаунт settings tab, a tamper-proof journal of who created, edited or deleted each order and when — including employees who have orders.* permissions. It is written from inside sun_save_app_state itself (which already diffs orders server-side for permission checks), so it can't be spoofed or wiped by the client, unlike the old per-browser 'История изменений' list which only covered the current device and had a 'Clear history' button anyone could press. - New table public.sun_order_audit_log (workspace, order id, action, actor, summary, details), locked down to security-definer writes only — no client insert/update/delete policy exists. - New RPC sun_list_order_audit(workspace, limit), admin-only. - New settings card 'Журнал заказов' reading it, admin-only, classified into the existing Аккаунт settings tab. - Verified end-to-end against a local PGlite instance: create/edit/ delete each produce one correctly-attributed row, and a non-admin member is denied read access. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| functions | ||
| migrations | ||
| config.toml | ||