cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(email): record draft export evidence
CI and Deploy / test (pull_request) Successful in 4m22s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-08-10 10:01:48 +02:00
parent 2fa4e38ba9
commit fb7240f2ff
6 changed files with 31 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/decisions.md
+10
View File
@@ -539,3 +539,13 @@
- **Consequences:** migration `20260810075206_AddEmailDrafts` is additive and reversible, but production must not expose drafts until export/deletion coverage and a bounded owner/job-validating API are verified. A full blank SQLite migration rehearsal remains blocked by the pre-existing JT-019 historical-chain defect, not this migration.
- **User approval required:** No; MAIL-001 authorizes repository-local durable drafts and no production migration/provider action occurred.
- **Reversible:** Downgrade the migration before reverting `14b396a`. No reachable application behavior exists in this increment.
## DEC-055 — Export drafts through existing owner-scoped backup boundaries
- **Date:** 2026-08-10
- **Decision:** Include complete readable email drafts in the authenticated encrypted backup and per-owner daily export, using an explicit DTO and the owning job ID set. Do not add a separate export route.
- **Reason/evidence:** private draft data must be portable before it is user-reachable. Existing exports already own tenant isolation and readable user data; focused two-owner tests prove the on-demand payload and hashed daily files contain only their owner's draft.
- **Alternatives considered:** omit bodies; export only metadata; add a draft-only download; delay export until account deletion. These produce an incomplete user export, duplicate authorization or expose a reachable data category without portability.
- **Consequences:** daily JSON exports now contain draft bodies under the same filesystem-at-rest protections and retention policy as correspondence. SEC-009 must explicitly delete live drafts and define backup/export retention; no export schema version was broken because the collection is additive.
- **User approval required:** No; this is a repository-local privacy prerequisite using synthetic data and existing export authority.
- **Reversible:** Revert `2fa4e38`; stored drafts remain unchanged, but draft UI/API must not ship without another readable export path.