cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(email): record draft persistence evidence
CI and Deploy / test (pull_request) Successful in 4m16s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-10 09:58:34 +02:00
parent 14b396a452
commit 10740fd8c3
6 changed files with 39 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/decisions.md
+10
View File
@@ -529,3 +529,13 @@
- **Consequences:** Free users retain non-AI email. Durable/new-message drafts require an owner-filtered database model, bounded API, export/deletion coverage and rollback migration as a separate cohesive increment. Future AI assistance remains Pro/privacy gated.
- **User approval required:** No; this is repository-local verification and a safety boundary inside approved MAIL-001.
- **Reversible:** The regression test can be reverted with `7f41cb2`; no runtime/schema state changed. Adding a Pro gate later would be an explicit product change.
## DEC-054 — Make draft persistence inert before exposing private content
- **Date:** 2026-08-10
- **Decision:** Add an owner-filtered, revisioned `EmailDraft` tied by cascade to an owned job, with explicit SQLite/MariaDB migration paths, but expose no draft API or UI until readable export and complete deletion implications are covered.
- **Reason/evidence:** refresh recovery needs server-side ownership, while browser storage and recruiter-message fields violate privacy/domain boundaries. A real-SQLite two-owner test proves isolation and job cascade; backend 625/625, model-current and dual-provider up/down SQL checks pass.
- **Alternatives considered:** ship schema/API/UI together; use local storage; reuse correspondence or recruiter drafts; persist provider tokens or idempotency attempts in the draft. These make a larger private-data boundary harder to review, expose shared-browser content or conflate delivery state with editable content.
- **Consequences:** migration `20260810075206_AddEmailDrafts` is additive and reversible, but production must not expose drafts until export/deletion coverage and a bounded owner/job-validating API are verified. A full blank SQLite migration rehearsal remains blocked by the pre-existing JT-019 historical-chain defect, not this migration.
- **User approval required:** No; MAIL-001 authorizes repository-local durable drafts and no production migration/provider action occurred.
- **Reversible:** Downgrade the migration before reverting `14b396a`. No reachable application behavior exists in this increment.