Close citation/source living-person leak; add on-demand tree purge
Two changes. 1. Privacy fix (NN#2/NN#3) — the citation and source list endpoints gated only on can_view_tree, so a non-member on a public/unlisted/site_members tree could enumerate citations and sources tied to a redacted living person, leaking that the person exists and has sourced facts (and possibly their name via a source title). #46 closed this for events/media/names/relationships but not citations/sources. Now citation_service.list_citations and source_service.{list_sources,get_source} delegate non-member reads to public_view_service, mirroring the #46 pattern: - citations: shown only when the cited fact resolves to FULL-visibility person(s) — covers the person_id, name_id, event_id (person or both-partner), and relationship_id (both-partner) target paths. - sources: shown only when they back at least one visible citation; a withheld source 404s (don't reveal it exists). Tests cover all four citation target types + source withholding + member-sees-all. 2. On-demand tree purge — owners can permanently delete a soft-deleted tree now instead of waiting out the 30-day auto-purge window. POST /trees/{id}/purge (owner-only): the tree must already be in the trash, and the caller retypes its name to confirm. Media objects are deleted from storage, then a single DELETE on trees cascades all tree-owned rows via the tree_id ON DELETE CASCADE; the audit entry survives (tree_id SET NULL). Frontend adds a "Delete forever" button to the Recently-deleted list. No migration. Suite: 102 passing. Signed-off-by: Justin Paul <justin@jpaul.me>
This commit is contained in:
@@ -53,6 +53,26 @@ export default function TreesPage() {
|
||||
await api.POST("/api/v1/trees/{tree_id}/restore", { params: { path: { tree_id: id } } });
|
||||
load();
|
||||
}
|
||||
async function purge(id: string, treeName: string) {
|
||||
const typed = window.prompt(
|
||||
`Permanently delete "${treeName}" and ALL its data (people, sources, media, …)?\n\n` +
|
||||
"This CANNOT be undone. Type the tree name to confirm:",
|
||||
);
|
||||
if (typed == null) return; // cancelled
|
||||
const { error, response } = await api.POST("/api/v1/trees/{tree_id}/purge", {
|
||||
params: { path: { tree_id: id } },
|
||||
body: { confirm_name: typed },
|
||||
});
|
||||
if (error) {
|
||||
window.alert(
|
||||
response.status === 403
|
||||
? "The name didn't match — nothing was deleted."
|
||||
: "Couldn't purge that tree.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
load();
|
||||
}
|
||||
// Optimistic visibility change so the dropdown reflects the pick immediately.
|
||||
async function setVisibility(id: string, visibility: NonNullable<Tree["visibility"]>) {
|
||||
setTrees((cur) => cur.map((t) => (t.id === id ? { ...t, visibility } : t)));
|
||||
@@ -139,15 +159,28 @@ export default function TreesPage() {
|
||||
<h2 className="font-serif text-base font-semibold text-[var(--muted)]">
|
||||
Recently deleted
|
||||
</h2>
|
||||
<p className="text-xs text-[var(--muted)]">
|
||||
Restorable for 30 days, after which they're purged automatically. Use
|
||||
Delete forever to purge one now.
|
||||
</p>
|
||||
<ul className="space-y-2">
|
||||
{deleted.map((tree) => (
|
||||
<li key={tree.id}>
|
||||
<Card>
|
||||
<CardContent className="flex items-center justify-between p-4">
|
||||
<span className="text-[var(--muted)]">{tree.name}</span>
|
||||
<CardContent className="flex items-center justify-between gap-2 p-4">
|
||||
<span className="min-w-0 flex-1 truncate text-[var(--muted)]">{tree.name}</span>
|
||||
<Button variant="outline" size="sm" onClick={() => restore(tree.id)}>
|
||||
Restore
|
||||
</Button>
|
||||
<Button
|
||||
variant="outline"
|
||||
size="sm"
|
||||
onClick={() => purge(tree.id, tree.name)}
|
||||
className="border-bronze/40 text-bronze hover:bg-bronze/10"
|
||||
title="Permanently delete this tree and all its data"
|
||||
>
|
||||
Delete forever
|
||||
</Button>
|
||||
</CardContent>
|
||||
</Card>
|
||||
</li>
|
||||
|
||||
Vendored
+59
@@ -293,6 +293,27 @@ export interface paths {
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/api/v1/trees/{tree_id}/purge": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path?: never;
|
||||
cookie?: never;
|
||||
};
|
||||
get?: never;
|
||||
put?: never;
|
||||
/**
|
||||
* Purge Tree
|
||||
* @description Permanently delete a soft-deleted tree and all its data — irreversible.
|
||||
* Owner-only; the tree must be in the trash and `confirm_name` must match.
|
||||
*/
|
||||
post: operations["purge_tree_api_v1_trees__tree_id__purge_post"];
|
||||
delete?: never;
|
||||
options?: never;
|
||||
head?: never;
|
||||
patch?: never;
|
||||
trace?: never;
|
||||
};
|
||||
"/api/v1/trees/{tree_id}/persons": {
|
||||
parameters: {
|
||||
query?: never;
|
||||
@@ -1977,6 +1998,11 @@ export interface components {
|
||||
/** @default private */
|
||||
visibility?: components["schemas"]["TreeVisibility"];
|
||||
};
|
||||
/** TreePurge */
|
||||
TreePurge: {
|
||||
/** Confirm Name */
|
||||
confirm_name: string;
|
||||
};
|
||||
/** TreeRead */
|
||||
TreeRead: {
|
||||
/**
|
||||
@@ -2655,6 +2681,39 @@ export interface operations {
|
||||
};
|
||||
};
|
||||
};
|
||||
purge_tree_api_v1_trees__tree_id__purge_post: {
|
||||
parameters: {
|
||||
query?: never;
|
||||
header?: never;
|
||||
path: {
|
||||
tree_id: string;
|
||||
};
|
||||
cookie?: never;
|
||||
};
|
||||
requestBody: {
|
||||
content: {
|
||||
"application/json": components["schemas"]["TreePurge"];
|
||||
};
|
||||
};
|
||||
responses: {
|
||||
/** @description Successful Response */
|
||||
204: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content?: never;
|
||||
};
|
||||
/** @description Validation Error */
|
||||
422: {
|
||||
headers: {
|
||||
[name: string]: unknown;
|
||||
};
|
||||
content: {
|
||||
"application/json": components["schemas"]["HTTPValidationError"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
list_persons_api_v1_trees__tree_id__persons_get: {
|
||||
parameters: {
|
||||
query?: {
|
||||
|
||||
@@ -710,6 +710,53 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/trees/{tree_id}/purge": {
|
||||
"post": {
|
||||
"tags": [
|
||||
"trees"
|
||||
],
|
||||
"summary": "Purge Tree",
|
||||
"description": "Permanently delete a soft-deleted tree and all its data \u2014 irreversible.\nOwner-only; the tree must be in the trash and `confirm_name` must match.",
|
||||
"operationId": "purge_tree_api_v1_trees__tree_id__purge_post",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "tree_id",
|
||||
"in": "path",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"type": "string",
|
||||
"format": "uuid",
|
||||
"title": "Tree Id"
|
||||
}
|
||||
}
|
||||
],
|
||||
"requestBody": {
|
||||
"required": true,
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/TreePurge"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"responses": {
|
||||
"204": {
|
||||
"description": "Successful Response"
|
||||
},
|
||||
"422": {
|
||||
"description": "Validation Error",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/HTTPValidationError"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/trees/{tree_id}/persons": {
|
||||
"post": {
|
||||
"tags": [
|
||||
@@ -7101,6 +7148,19 @@
|
||||
],
|
||||
"title": "TreeCreate"
|
||||
},
|
||||
"TreePurge": {
|
||||
"properties": {
|
||||
"confirm_name": {
|
||||
"type": "string",
|
||||
"title": "Confirm Name"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"required": [
|
||||
"confirm_name"
|
||||
],
|
||||
"title": "TreePurge"
|
||||
},
|
||||
"TreeRead": {
|
||||
"properties": {
|
||||
"id": {
|
||||
|
||||
Reference in New Issue
Block a user