cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(email): record export lifecycle evidence
CI and Deploy / test (pull_request) Failing after 4m24s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-10 00:49:49 +02:00
parent aff34cc645
commit 3f0eba0525
7 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/decisions.md
+10
View File
@@ -469,3 +469,13 @@
- **Consequences:** users copy the draft or open Job email and review provider/from/recipient/content before sending. Old API callers receive an explicit terminal response and must migrate; no correspondence/follow-up date is falsely recorded as sent.
- **User approval required:** No; this is the smallest safe completion of the already active MAIL-001 programme and sends no email.
- **Reversible:** Yes by reverting `8fe3903`, but that reintroduces the unsafe SMTP bypass. Prefer forward migration of any remaining caller to `/api/email/send` with explicit confirmation.
## DEC-048 — Export delivery state, not content fingerprints
- **Date:** 2026-08-10
- **Decision:** Add one explicit send-attempt export record to both existing owner export surfaces. Include provider/request/status/provider-message/failure/timestamps, but omit the internal payload hash. Verify the existing job foreign-key cascade with real SQLite; leave complete identity/account deletion to SEC-009.
- **Reason/evidence:** users need readable delivery history, while the ledger intentionally stores no recipient, subject or body. The payload hash exists only for deduplication/conflict checks and is not meaningful portable data. Two-owner daily files and decrypted backup tests prove coverage/isolation; the cascade test proves one hard job deletion does not affect the other tenant.
- **Alternatives considered:** export the entity directly; include the payload hash; omit attempts; claim UserManager identity deletion is complete; add a second cleanup routine. These expose internal correlation data, lose audit history, overstate the current account lifecycle or duplicate the database cascade.
- **Consequences:** export schemas gain an additive `EmailSendAttempts` collection. Complete account/database/file/token/backup deletion remains an explicit SEC-009 release item rather than hidden in MAIL-001.
- **User approval required:** No; this is the approved MAIL-001 export/cascade requirement using synthetic local data only.
- **Reversible:** Yes. Revert `aff34cc`; no schema or stored data changes. Existing export files remain valid historical artifacts under their configured retention.