cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(email): record draft API evidence
CI and Deploy / test (pull_request) Successful in 4m15s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-10 10:06:58 +02:00
parent a9bb22e530
commit 108440d361
6 changed files with 32 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/decisions.md
+10
View File
@@ -549,3 +549,13 @@
- **Consequences:** daily JSON exports now contain draft bodies under the same filesystem-at-rest protections and retention policy as correspondence. SEC-009 must explicitly delete live drafts and define backup/export retention; no export schema version was broken because the collection is additive.
- **User approval required:** No; this is a repository-local privacy prerequisite using synthetic data and existing export authority.
- **Reversible:** Revert `2fa4e38`; stored drafts remain unchanged, but draft UI/API must not ship without another readable export path.
## DEC-056 — Keep draft saves incomplete, bounded and provider-inert
- **Date:** 2026-08-10
- **Decision:** Expose local-authenticated draft CRUD under `/api/email/drafts`. Require an owned job and registered provider at creation, allow incomplete recipient/subject/body for autosave, keep provider/thread/job immutable, and require a matching revision for updates/deletes.
- **Reason/evidence:** refresh recovery must preserve work before send fields are complete, while provider/thread provenance must not silently change. Atomic revision predicates prevent last-write-wins loss; explicit owner clauses plus global filters deny foreign job and direct draft IDs in real SQLite tests.
- **Alternatives considered:** require send-valid content on every save; contact the provider during save; allow provider/thread changes; use unconditional updates; hide foreign rows only in UI. These break autosave/offline recovery, add side effects, weaken provenance, lose concurrent edits or fail authorization.
- **Consequences:** saving never sends or checks connection state. Send still uses the separate explicit-confirmed/idempotent boundary and revalidates all fields/provider consent. UI must surface revision conflicts and treat bodies as untrusted plain text.
- **User approval required:** No; this is approved local MAIL-001 work with synthetic data and no provider/production action.
- **Reversible:** Revert `a9bb22e`; the inert/exported schema remains for a later UI. Existing stored drafts are unaffected.