cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(storage): scope exports by owner
CI and Deploy / test (pull_request) Successful in 5m24s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-15 18:19:59 +02:00
parent 0d487123af
commit cdcc7163fa
17 changed files with 123 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/decisions.md
+10
View File
@@ -729,3 +729,13 @@
- **Consequences:** public claims stay stable across deployment-specific commercial configuration; Free users see honest locked states and retain manual/existing content; checkout terms remain inspectable at the payment boundary.
- **User approval required:** No; this implements the approved master-plan requirement without external billing action.
- **Reversible:** Revert the PRODUCT-001 presentation commit. Server entitlement and stored billing state are unchanged.
## DEC-074 — Attribute generated files through opaque owner roots
- **Date:** 2026-08-15
- **Decision:** Store new CV PDF and daily export files beneath a deterministic SHA-256 owner directory. Use a UUID as the stored PDF filename while preserving the friendly renderer name only for download. Retain support for pruning legacy date-root CV output without moving or assigning old files.
- **Reason/evidence:** SEC-009 cannot safely export or delete shared date/candidate-derived paths because no durable record attributes them to a user. A one-way owner directory is stable, avoids raw identity disclosure in paths and gives inventory/deletion an exact root.
- **Alternatives considered:** guess ownership from candidate/date filenames; add a database row for every ephemeral PDF; embed raw user IDs in paths; move all legacy outputs. These risk cross-user attribution, unnecessary schema, identity leakage or destructive migration.
- **Consequences:** all new generated outputs have an exact owner boundary and collision-resistant storage path. Existing legacy files age out under retention and remain excluded from user deletion unless independently attributed.
- **User approval required:** No; additive storage hardening within the requested account lifecycle, with no existing data mutation.
- **Reversible:** Restore shared date paths for future files. Existing owner-scoped files remain valid retention artifacts and must not be bulk-moved or deleted during rollback.