marcel/familienarchiv
1
0
Fork 0
Code Issues 111 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

docs: record owner decisions on re-import authority and path-escape
All checks were successful
CI / Unit & Component Tests (pull_request) Successful in 4m5s
Details
CI / OCR Service Tests (pull_request) Successful in 20s
Details
CI / Backend Unit Tests (pull_request) Successful in 3m42s
Details
CI / fail2ban Regex (pull_request) Successful in 43s
Details
CI / Semgrep Security Scan (pull_request) Successful in 19s
Details
CI / Compose Bucket Idempotency (pull_request) Successful in 1m1s
Details

Browse Source 
- DEPLOYMENT §6: clarify re-import keeps person/tag scalar human edits but
  re-applies document sender/receivers/tags from the canonical export
  (canonical-authoritative), per owner sign-off.
- ADR-025: path-escape/symlink aborts the whole import (fail-closed) by
  deliberate owner decision, chosen over a per-file skip.

Refs #669
This commit was merged in pull request #674.
This commit is contained in:
Marcel
2026-05-27 11:20:39 +02:00
parent 151d6aa03f
commit e4a154406e
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/DEPLOYMENT.md
View File

@@ -592,7 +592,7 @@ closed (`IMPORT_ARTIFACT_INVALID`) if any is missing.
2. Make sure `IMPORT_HOST_DIR=<host-path>` is set in `.env.staging` / `.env.production` (the nightly/release workflows already write this — see §3). Compose refuses to start without it. 2. Make sure `IMPORT_HOST_DIR=<host-path>` is set in `.env.staging` / `.env.production` (the nightly/release workflows already write this — see §3). Compose refuses to start without it.
3. Redeploy the stack so the bind mount picks up — or, if the mount is already in place, skip to step 4. 3. Redeploy the stack so the bind mount picks up — or, if the mount is already in place, skip to step 4.
4. Call `POST /api/admin/trigger-import` (requires `ADMIN` permission), or click the "Import starten" button on `/admin/system`. 4. Call `POST /api/admin/trigger-import` (requires `ADMIN` permission), or click the "Import starten" button on `/admin/system`.
5. The import runs asynchronously — poll `GET /api/admin/import-status`, watch `/admin/system`, or tail the backend logs. Re-running is safe: the import is idempotent (upsert by `source_ref` / document `index`) and never overwrites a human-edited field. 5. The import runs asynchronously — poll `GET /api/admin/import-status`, watch `/admin/system`, or tail the backend logs. Re-running is safe and idempotent (upsert by `source_ref` / document `index`). Person and tag scalar fields you edited in the app are preserved on re-import; a document's sender/receivers/tags are **canonical-authoritative** — a re-import re-applies them to exactly match the export, so a link removed from the export is removed from the document (the raw sender/receiver cell text is always kept).
--- ---

5
docs/adr/025-canonical-import-and-single-migration-schema-foundation.md
View File

@@ -138,6 +138,11 @@ Settled sub-decisions:
the same state, so the operational recovery for a partial failure is simply to fix the the same state, so the operational recovery for a partial failure is simply to fix the
offending artifact and re-trigger the import — no manual cleanup of half-written data is offending artifact and re-trigger the import — no manual cleanup of half-written data is
required. A future maintainer must not assume all-or-nothing semantics. required. A future maintainer must not assume all-or-nothing semantics.
- **Path-escape aborts the whole import (fail-closed), by design.** A path-traversal or
symlink-escape in a row's file path is treated as an attack signal: the import aborts rather
than recording the row as a `SkippedFile` and continuing. This is a deliberate owner decision
(2026-05-27) over a per-file skip — a malicious path must surface loudly, not be silently
tolerated.
- **`PersonSummaryDTO` coupling.** `provisional` was added to the `PersonSummaryDTO` native - **`PersonSummaryDTO` coupling.** `provisional` was added to the `PersonSummaryDTO` native
interface projection; because the projection is backed by native SQL, the column had to be interface projection; because the projection is backed by native SQL, the column had to be
added to all three native `SELECT`s (`findAllWithDocumentCount`, `searchWithDocumentCount`, added to all three native `SELECT`s (`findAllWithDocumentCount`, `searchWithDocumentCount`,