Repository navigation
Commit d95dc2e
feat(isms): document versioning and history (CS-701) (#3361)
* feat(isms): document versioning and history (CS-701)
Bring ISMS documents onto the Policies versioning model. Approving a
document freezes an immutable published version (v1). Editing afterwards
creates a draft without touching the published version, which stays live
and exportable. Re-approving publishes the next version and moves the old
one into history. Rendered DOCX/PDF are retained per published version so
an auditor sampling v1 later downloads exactly what was approved.
- schema: IsmsDocument gains currentVersion/draftNarrative/draftSnapshot;
IsmsDocumentVersion gains contentSnapshot/changelog/publishedBy. Backfill
migration (pre-GA, flag-gated) moves the old single-version model over.
- api: new IsmsVersionService freezes a version at approval and renders +
uploads PDF/DOCX to S3 after the txn; lists history; serves a version's
export (stored file -> snapshot re-render -> live fallback). Editing an
approved document reverts status to draft but preserves the published
version. Drift baseline + draft narrative moved onto the document. New
GET /v1/isms/documents/:id/versions; optional versionId on export.
- app: version-history section on every document detail page with per-version
PDF/DOCX download, and a "Published vN / editing creates a new draft" signal.
- tests: 312 api + 119 app tests passing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CweXoSSEP89mX93u3Bdcp
* fix(isms): address CS-701 PR review — export integrity, download UX, org scoping
Fixes the real issues from the automated PR review:
- Versioned export never serves live/draft data (audit integrity): getVersionExport
now falls back to the immutable snapshot if a stored S3 object is missing, and
throws for a version with neither a file nor a snapshot instead of rendering
current live data.
- Default export of a clean approved document serves its retained published
artifact (byte-identical to approval); only in-progress drafts export the draft.
- Regenerating ("Generate from platform data") now invalidates approval, matching
every other edit path, so an approved doc can't silently diverge from its
published version.
- Version-history download buttons are gated on real availability (file or
snapshot); unavailable formats are hidden with a clear note.
- Version-history fetch passes the route org (X-Organization-Id), matching the
per-version download path.
- Approval success is separated from the best-effort post-approval refresh so a
revalidation hiccup no longer reports "Failed to approve".
- Version history retains the approver via the frozen snapshot metadata if the
approving member is later deleted.
Not changed (deliberate): approval stays committed if export rendering fails —
the immutable contentSnapshot makes every version reproducible and the AWS SDK
retries transient errors; throwing would strand a doc "approved but unretryable".
Tests: 316 api + 122 app ISMS tests passing; typecheck clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CweXoSSEP89mX93u3Bdcp
* fix(isms): second review pass — default export, download errors, tx isolation, a11y
Addresses the follow-up automated review on the fix commit:
- Default export (no versionId) now serves the current PUBLISHED version whenever
one exists — so v1 stays the live/exportable default while v2 is being drafted
(CS-701). Only a never-published document renders the live draft. (P1)
- Per-version downloads now catch export failures and surface a toast instead of
failing silently / as an unhandled rejection. (P2)
- The approve snapshot reads the org profile through the same transaction client
(threaded through resolveOrgProfile/loadOrgProfile) so profile + register rows
share one point-in-time. (P2)
- Version-history download buttons get version-specific accessible labels
("Download v2 as PDF") for screen-reader / voice-control users. (P3)
Tests: 318 api + 123 app ISMS tests passing; typecheck clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CweXoSSEP89mX93u3Bdcp
* fix(isms): third review pass — no snapshot-less published versions, download races
- Migration no longer promotes legacy approved docs to a published version. The
pre-CS-701 version row had no contentSnapshot, so serving it as currentVersion
would 404 on export (regression from the default-export + no-live-fallback
fixes). Legacy approved docs revert to draft and re-approve once to establish a
real v1; all legacy version rows are dropped. currentVersionId is now only ever
set by the approve flow, which always writes a contentSnapshot — so it can never
point at a snapshot-less version. (P1)
- Per-version download indicator clears only if the finishing request still owns
it, so starting a second download no longer clears the first's spinner early. (P3)
Not changed (deliberate, re-confirmed): approval stays committed if publishRenders
fails — createPublishedVersion always persists an immutable contentSnapshot, so the
version re-renders on demand (no lost export); forcing a throw would strand a doc
"approved but unretryable".
Tests: 318 api + 123 app ISMS tests passing; typecheck clean; migration SQL validated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CweXoSSEP89mX93u3Bdcp
* fix(isms): migration — preserve approvals, add FKs after legacy cleanup
Addresses the latest review on the CS-701 migration:
- Non-destructive: existing approved documents keep their approved status. The
migration no longer resets them to draft — it only drops the legacy (pre-CS-701,
snapshot-less) version rows and leaves currentVersionId null, so an approved doc
exports its current content on demand and captures a real versioned artifact on
its next approval. currentVersionId is only ever set by the approve flow, which
always writes a contentSnapshot. (P2)
- Defensive ordering: the legacy-row DELETE now runs BEFORE the foreign keys are
added, so FK validation can never trip on a stale publishedById. (In practice
publishedById was a dead/always-null column pre-migration, so it could not have
failed — but the ordering makes it robust regardless.) (P2)
Verified: migration applies cleanly from scratch (fresh DB, all migrations deploy);
318 api + 123 app ISMS tests passing; typecheck clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CweXoSSEP89mX93u3Bdcp
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>1 parent fe4394b commit d95dc2e
49 files changed
Lines changed: 2293 additions & 615 deletions
File tree
- apps
- api/src/isms
- documents
- dto
- utils
- app/src/app/(app)/[orgId]/documents/isms
- components
- __test-helpers__
- hooks
- packages/db/prisma
- migrations/20260707120000_isms_document_versioning
- schema
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
40 | 40 | | |
41 | 41 | | |
42 | 42 | | |
43 | | - | |
44 | | - | |
| 43 | + | |
45 | 44 | | |
46 | | - | |
| 45 | + | |
| 46 | + | |
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
| |||
132 | 132 | | |
133 | 133 | | |
134 | 134 | | |
135 | | - | |
| 135 | + | |
136 | 136 | | |
137 | 137 | | |
138 | | - | |
139 | | - | |
140 | | - | |
| 138 | + | |
| 139 | + | |
| 140 | + | |
| 141 | + | |
| 142 | + | |
141 | 143 | | |
142 | 144 | | |
143 | | - | |
| 145 | + | |
144 | 146 | | |
145 | | - | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
146 | 150 | | |
147 | 151 | | |
148 | 152 | | |
149 | 153 | | |
150 | 154 | | |
151 | | - | |
152 | | - | |
153 | | - | |
| 155 | + | |
| 156 | + | |
154 | 157 | | |
155 | 158 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
174 | 174 | | |
175 | 175 | | |
176 | 176 | | |
177 | | - | |
178 | | - | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
| 181 | + | |
| 182 | + | |
179 | 183 | | |
180 | | - | |
181 | | - | |
182 | | - | |
183 | | - | |
184 | | - | |
185 | | - | |
186 | | - | |
187 | | - | |
188 | | - | |
189 | | - | |
190 | | - | |
191 | | - | |
192 | | - | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
193 | 188 | | |
194 | 189 | | |
195 | 190 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
| 2 | + | |
2 | 3 | | |
3 | 4 | | |
4 | 5 | | |
| |||
29 | 30 | | |
30 | 31 | | |
31 | 32 | | |
| 33 | + | |
32 | 34 | | |
33 | 35 | | |
34 | 36 | | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
35 | 43 | | |
36 | 44 | | |
37 | | - | |
| 45 | + | |
38 | 46 | | |
39 | 47 | | |
40 | 48 | | |
41 | | - | |
| 49 | + | |
42 | 50 | | |
43 | 51 | | |
44 | 52 | | |
45 | 53 | | |
46 | 54 | | |
47 | 55 | | |
48 | | - | |
| 56 | + | |
49 | 57 | | |
50 | 58 | | |
51 | 59 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
2 | | - | |
| 1 | + | |
| 2 | + | |
3 | 3 | | |
4 | 4 | | |
5 | 5 | | |
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
12 | 21 | | |
0 commit comments