Compare commits
6 Commits
mai/hermes
...
mai/cronus
| Author | SHA1 | Date | |
|---|---|---|---|
| 5bb6df69e1 | |||
| 51fca9383f | |||
| 99c9d89daa | |||
| 7bc6fdb18a | |||
| 94a9e7e5fb | |||
| f55648944c |
@@ -220,6 +220,23 @@ func main() {
|
||||
Export: services.NewExportService(pool, branding.Name),
|
||||
}
|
||||
|
||||
// t-paliad-246 Slice A — Backup Mode runner. Wired only when
|
||||
// PALIAD_EXPORT_DIR is set (LocalDiskStore needs a target
|
||||
// directory). Without it the /admin/backups handlers return 503
|
||||
// in the same shape as Paliadin's gate. The directory is created
|
||||
// (0700) on first use; a malformed path fails fast at boot so
|
||||
// misconfig surfaces before the server starts taking traffic.
|
||||
if exportDir := strings.TrimSpace(os.Getenv("PALIAD_EXPORT_DIR")); exportDir != "" {
|
||||
store, err := services.NewLocalDiskStore(exportDir)
|
||||
if err != nil {
|
||||
log.Fatalf("PALIAD_EXPORT_DIR: %v", err)
|
||||
}
|
||||
svcBundle.Backup = services.NewBackupRunner(pool, svcBundle.Export, store)
|
||||
log.Printf("backup: LocalDiskStore at %s (/admin/backups active)", exportDir)
|
||||
} else {
|
||||
log.Println("PALIAD_EXPORT_DIR not set — /admin/backups will return 503")
|
||||
}
|
||||
|
||||
// t-paliad-219 Slice A3 — stitch DashboardService → ApprovalService
|
||||
// for the inbox-approvals widget. Done post-construction to avoid
|
||||
// a circular constructor dependency (ApprovalService doesn't need
|
||||
|
||||
570
docs/design-procedural-events-model-2026-05-25.md
Normal file
570
docs/design-procedural-events-model-2026-05-25.md
Normal file
@@ -0,0 +1,570 @@
|
||||
# Design — Procedural-Events Data Model (t-paliad-262)
|
||||
|
||||
**Author:** cronus (inventor)
|
||||
**Date:** 2026-05-25
|
||||
**Issue:** m/paliad#93 (mai task t-paliad-262)
|
||||
**Branch:** `mai/cronus/inventor-procedural`
|
||||
**Status:** DESIGN — read-only, no schema or code changes in this branch
|
||||
**Prior art read:**
|
||||
- `docs/design-deadline-data-model-2026-05-08.md` (einstein, t-paliad-158) — proposed `proceeding_event_types` + `proceeding_event_edges`; the **graph-shape recommendation has not been built** (no `proceeding_event*` tables exist in the live DB as of 2026-05-25, verified via `information_schema.tables`).
|
||||
- `docs/design-fristen-phase2-2026-05-15.md` (Phase 2/3 unified-rule columns — migs 078/079/091, **shipped**).
|
||||
- `docs/design-submission-generator-2026-05-19.md` and `docs/design-submission-page-2026-05-22.md` (Slice 1 → Slice A of the Schriftsätze stack — shipped on top of today's `deadline_rules`).
|
||||
|
||||
This doc names a single conflation in the schema and proposes a two-slice fix (cosmetic immediate, structural follow-up). It is intentionally narrower than einstein's 2026-05-08 graph proposal — it does **not** re-litigate the proceeding-as-DAG question.
|
||||
|
||||
---
|
||||
|
||||
## §0 TL;DR
|
||||
|
||||
`paliad.deadline_rules` today is **one row that wears three hats**:
|
||||
|
||||
1. **The procedural-event template** — `submission_code`, `name`, `name_en`, `description`, `event_type`, `primary_party`. This is "what kind of step is this in the proceeding": Rechtsbeschwerdebegründung, mündliche Verhandlung, Entscheidung, etc.
|
||||
2. **The legal-norm citation** — `legal_source`, `rule_code`, `alt_rule_code`, `rule_codes[]`. This is "the source-of-law anchor": § 102 PatG, UPC RoP R.220(1).
|
||||
3. **The sequencing rule** — `parent_id`, `trigger_event_id`, `duration_value`, `duration_unit`, `timing`, `alt_duration_*`, `combine_op`, `condition_expr`, `is_spawn`, `spawn_*`, `sequence_order`, `is_court_set`, `priority`, `anchor_alt`, `proceeding_type_id`. This is "how and when does it fire relative to other events".
|
||||
|
||||
The conflation surfaces most painfully in the submission-draft editor's variable sidebar (m's report 2026-05-25 15:02), where the lawyer sees field labels like `{{rule.submission_code}}` for what is plainly a *procedural-event code*, `{{rule.event_type}}` for what is plainly the *procedural-event kind*, and `{{rule.legal_source_pretty}}` for what is plainly the *legal norm* — all under a `rule.*` namespace that reads as if the lawyer were filling in arithmetic.
|
||||
|
||||
**Recommendation = Q1 option (C):**
|
||||
|
||||
- **Slice A (immediate, this design's coder shift):** cosmetic rename — placeholders, i18n labels, Go struct-comment naming, admin-UI page titles all shift to `procedural_event.*` as the canonical name. **Database schema, table name, column names, FK directions, JSON envelope keys on the wire all stay exactly as they are.** Old `{{rule.*}}` placeholders remain emitted in the variable bag as legacy aliases so existing Word templates and saved drafts keep working.
|
||||
- **Slice B (planned follow-up, separate mai task, separate slice plan):** structural rework — extract `paliad.procedural_events`, `paliad.sequencing_rules`, `paliad.legal_sources`, with a phased dual-write migration. **Not shipped here.** This doc defines the target shape (§4) and the migration shape (§5) so the eventual coder has a brief, not so the eventual coder is hired today.
|
||||
|
||||
**Umbrella term lock = Q2 option (R):** **"procedural event"** (DE: **"Verfahrensschritt"**) as the umbrella covering filings, hearings, decisions, orders. Justification in §2.
|
||||
|
||||
Both Slice A and the eventual Slice B preserve the Schriftsätze surface (t-paliad-238/242/243): the submissions list query changes its predicate from `dr.event_type = 'filing'` to `pe.event_kind IN ('filing', 'reply')` (Slice B only) — same rows, cleaner predicate.
|
||||
|
||||
---
|
||||
|
||||
## §1 Premises verified live (2026-05-25)
|
||||
|
||||
Every load-bearing claim was checked against the running paliad codebase + youpc Supabase. Numbers and schema facts are point-in-time as of 2026-05-25 15:30.
|
||||
|
||||
| Claim | Verification |
|
||||
|---|---|
|
||||
| `paliad.deadline_rules` carries the 38 columns listed in §0's three-hats decomposition. | `information_schema.columns WHERE table_schema='paliad' AND table_name='deadline_rules'` — 38 rows; columns confirmed verbatim. |
|
||||
| Live row count = 254. | `SELECT COUNT(*) FROM paliad.deadline_rules` → 254. |
|
||||
| 177 rows carry a `submission_code` (procedural-event identity); 158 distinct values. | `COUNT(*) FILTER (WHERE submission_code IS NOT NULL)` → 177; `COUNT(DISTINCT submission_code)` → 158. |
|
||||
| 102 rows carry a `legal_source`; 70 distinct citations. | Same query, `legal_source` column. |
|
||||
| 125 rows are linked to a `deadline_concepts` row via `concept_id`. | `COUNT(*) FILTER (WHERE concept_id IS NOT NULL)` → 125 (49 % of the corpus). |
|
||||
| `event_type` distribution: 130 `filing` · 77 NULL · 25 `decision` · 21 `hearing` · 1 `order`. | `SELECT event_type, count(*) GROUP BY event_type` — confirmed; the 77 NULL rows are structural / parent-only rows in the proceeding tree. |
|
||||
| 10 `submission_code` values appear on more than one row (jurisdictional / bilateral variants). | All 10 today are `_archived_litigation.*` codes (claimant/defendant splits + multi-stage hearing rows). Live non-archived codes are 1:1 with rows in the current corpus. |
|
||||
| `paliad.deadlines` joins to `deadline_rules` via column `rule_id` (uuid, FK). The text `rule_code` and free-text `custom_rule_text` (mig 122, t-paliad-258) are denormalized for display when the rule row is deleted. | `internal/services/deadline_service.go:69-127`; live column list confirms `rule_id`, `rule_code`, `custom_rule_text` — there is **no** `deadline_rule_id` column on deadlines (issue body called it `deadlines.deadline_rule_id` — that's a doc-side typo; the column is `rule_id`). |
|
||||
| `paliad.submission_drafts` keys to a procedural event via `submission_code` text — **no FK** to `deadline_rules`. | `information_schema.columns` for `submission_drafts`: `submission_code text` plus `(project_id, submission_code)` as the joint identifier. Confirms the Schriftsätze surface filters on the *text key*, not on `deadline_rules.id`. |
|
||||
| The Schriftsätze list (t-paliad-238) filters `deadline_rules` by `event_type='filing'` and `submission_code IS NOT NULL`. | `internal/handlers/submissions.go:193-211` — verbatim. |
|
||||
| The variable bag emits exactly 8 `rule.*` placeholders. | `internal/services/submission_vars.go:349-364` — `rule.submission_code`, `rule.name`, `rule.name_de`, `rule.name_en`, `rule.legal_source`, `rule.legal_source_pretty`, `rule.primary_party`, `rule.event_type`. Frontend i18n labels at `frontend/src/client/submission-draft.ts:158-185`. |
|
||||
| Admin rule-edit form binds the same `rule.X` fields. | `frontend/src/admin-rules-edit.tsx:74-110` + `frontend/src/client/admin-rules-edit.ts:253-278` — same eight columns surfaced as form inputs. |
|
||||
| The Fristenrechner client surface refers to `calc.rule.nameDE` / `calc.rule.nameEN`. | `frontend/src/client/fristenrechner.ts:1592,1655`. |
|
||||
| einstein's 2026-05-08 `proceeding_event_types` + `proceeding_event_edges` are **not** in the DB. | `SELECT table_name FROM information_schema.tables WHERE table_schema='paliad' AND table_name LIKE '%proceeding_event%'` → 0 rows. The graph-shape proposal was never built. |
|
||||
| `paliad.deadline_concepts` (57 rows in the original einstein audit; live count not directly queried this shift) still exists and is referenced via `deadline_rules.concept_id`. | `information_schema.tables` confirms `deadline_concepts`, `deadline_concept_event_types`, `deadline_event_types`, `event_types`, `trigger_events`, `event_categories` all still present — the deadline-knowledge graph from the einstein design lives on alongside the unified rule columns. |
|
||||
| Phase 2/3 columns (`priority`, `condition_expr`, `is_court_set`, `lifecycle_state`, `draft_of`, `published_at`, `rule_codes[]`) are live and load-bearing. | `internal/models/models.go:622-684` + mig 091. Slice B's structural rework must preserve every one of these on the new `sequencing_rules` table — they are not legacy. |
|
||||
| Live `paliad.deadlines` references to rules are sparse (1 row in prod). | `SELECT COUNT(*) FROM paliad.deadlines` → 1. The 4 `submission_drafts` rows reference a procedural event by `submission_code` text only. Tiny live FK surface → migrations can be aggressive without losing user data. |
|
||||
| Migration tracker is `paliad.paliad_schema_migrations`; next available number is 124 (mig 123 = Backup Mode Slice A, just shipped). | `internal/db/migrations/` directory listing; latest applied = 123. |
|
||||
|
||||
**Doc-side bug flagged for this issue's body:** the deliverable spec writes `paliad.deadlines.deadline_rule_id` in §3 (Q3 migration shape). The live column is `paliad.deadlines.rule_id`. Slice B's rename target is therefore `paliad.deadlines.procedural_event_id`, not `paliad.deadlines.procedural_event_id` after a non-existent `deadline_rule_id` step. Updating the issue body is m's call — flagged here so it doesn't propagate into a coder brief.
|
||||
|
||||
---
|
||||
|
||||
## §2 m's vocabulary call (Q2 — lock the umbrella term)
|
||||
|
||||
m proposed "procedural event" in the report. Options weighed:
|
||||
|
||||
| Option | Reads as | Collisions | Verdict |
|
||||
|---|---|---|---|
|
||||
| **"procedural event"** (DE: "Verfahrensschritt") | Umbrella that naturally covers filings, hearings, decisions, orders. Matches lawyer mental model: "the next thing that happens in the proceeding". | None — no `paliad.procedural_event*` table or column today (verified). | **(R) — adopt as canonical.** |
|
||||
| "submission" | Today the Schriftsätze surface uses this for *filings only* (`event_type='filing'`). Expanding the meaning would silently change Slice A's semantics for an existing UI. | Surface-level collision with the Schriftsätze nomenclature already in production. | Reject — would lose precision for an existing concept. |
|
||||
| "event" / "event_type" | Existing `deadline_rules.event_type` column. | **Hard collision** with `paliad.events` (audit feed, distinct table, distinct meaning). Renaming around it would be worse than the conflation we're trying to fix. | Reject. |
|
||||
| "Verfahrensschritt" only (no English) | Cleanest German but no English fallback. | Bilingual UI (DE primary, EN secondary per project CLAUDE.md) requires both. | Reject in isolation — but **adopt as the canonical German rendering** of "procedural event". |
|
||||
| "Verfahrensereignis" | Closer literal translation of "procedural event". | None. | Reject in favor of "Verfahrensschritt" — m's broader vocabulary uses "Schritt" (e.g. "Antragsschritt") more naturally than "Ereignis", which already maps to `paliad.events` in the audit-feed sense. |
|
||||
|
||||
**Lock:**
|
||||
|
||||
| Surface | Canonical |
|
||||
|---|---|
|
||||
| English | **procedural event** (lowercase except sentence-initial) |
|
||||
| German | **Verfahrensschritt** (m. — der Verfahrensschritt) |
|
||||
| Plural EN | procedural events |
|
||||
| Plural DE | Verfahrensschritte |
|
||||
| Code identifier (Go struct names, TS types) | `ProceduralEvent`, `ProceduralEventKind`, `ProceduralEventTemplate` |
|
||||
| Snake-case (DB columns, JSON keys, i18n keys, placeholders) | `procedural_event`, `procedural_event_kind`, `procedural_events` (table) |
|
||||
| Slice A: variable-bag placeholder namespace | `procedural_event.*` (with `rule.*` kept as legacy alias) |
|
||||
| Slice B: table name (if shipped) | `paliad.procedural_events` |
|
||||
|
||||
`event_type` (the column) becomes `event_kind` in Slice B — using "kind" rather than "type" to free up the word "type" for the proceeding-level taxonomy (`paliad.proceeding_types`, untouched) and to mirror the "event_type vs event_kind" disambiguation einstein hit in the 2026-05-08 doc. In Slice A the column stays `event_type` (no DB change).
|
||||
|
||||
**Q2 is locked by inventor recommendation.** It costs nothing structurally and clears noise across every downstream conversation. If m disagrees in the head round-trip, the only thing that flips is the term — Slice A's scope shape stays.
|
||||
|
||||
---
|
||||
|
||||
## §3 Scope decision (Q1 — A vs B vs C)
|
||||
|
||||
**Recommendation = (C) — cosmetic rename now, structural rework as a planned follow-up.**
|
||||
|
||||
### Why not (A) — cosmetic only and stop
|
||||
|
||||
(A) leaves the model wrong forever. The conflation isn't just a labelling annoyance — it makes future questions harder to answer cleanly:
|
||||
|
||||
- "How many distinct procedural events does paliad model?" Today: ambiguous (rows vs distinct `submission_code`s vs distinct `(submission_code, proceeding_type_id)` tuples).
|
||||
- "Where can we attach a per-procedural-event Word template that's independent of which proceeding it appears in?" Today: nowhere — the FK chain forces a per-row template registry, see `internal/handlers/files.go` template fallback.
|
||||
- "Show me every sequencing rule that triggers a given procedural event across all proceedings." Today: requires joining `deadline_rules` to itself on `submission_code` + `parent_id`, brittle.
|
||||
|
||||
If m signals (A) anyway — fine; the cosmetic-only slice is a strict subset of (C)'s Slice A and ships the same value (label clarity in the editor). But the recommendation is to write down the structural target now while the analysis is fresh.
|
||||
|
||||
### Why not (B) — restructure immediately
|
||||
|
||||
(B) means: one slice plan, one cutover. With:
|
||||
- 254 live rule rows,
|
||||
- 1 live `paliad.deadlines` row,
|
||||
- 4 live `submission_drafts` rows,
|
||||
- 12 Go services + 6 handlers touching `deadline_rules` + 8 placeholder strings on the wire + the admin rule-editor UI bound to the column shape,
|
||||
|
||||
…doing this in one cutover means a big-bang migration during a downtime window. m has granted exactly one such window in recent memory (2026-05-15 for mig 091's destructive drops), and that one was constrained to a 4-column drop. A four-table restructure has a meaningfully larger blast radius; it warrants its own task with its own slice plan and its own risk review.
|
||||
|
||||
### Why (C) — cosmetic-rename Slice A this design, structural Slice B as a separate task
|
||||
|
||||
Three properties of (C) make it the safe call:
|
||||
|
||||
1. **Slice A is reversible at any time** — every change is in i18n strings, Go struct comments, admin-UI page titles, and the variable-bag aliases. No DB migration. No drop. A revert is a `git revert` of the Slice A commit.
|
||||
2. **Slice B is fully designed but uncommitted** — §4 and §5 below define the target shape and migration plan, but the design doc itself ships in Slice A. m can read it, redirect it, or park it without pressure to ship it now.
|
||||
3. **The Schriftsätze surface doesn't care which slice we ship** — Slice A leaves it on `event_type='filing'`; Slice B flips it to `event_kind IN ('filing', 'reply')` over a dual-write window. Either way, the lawyer-facing behavior is unchanged.
|
||||
|
||||
### Slice A's deliverable boundary (what gets renamed, what stays)
|
||||
|
||||
**Renamed in Slice A:**
|
||||
|
||||
- **i18n keys** for the admin rule-editor field labels: `admin.rules.edit.field.submission_code` → `admin.rules.edit.field.procedural_event_code`, etc. (16 keys total — `name`, `name_en`, `description`, `submission_code`, `rule_code`, `legal_source`, `primary_party`, `event_type` × DE/EN — full list in §7.1.)
|
||||
- **Variable-bag placeholder labels** in `submission-draft.ts:158-185`: the *visible label* (`{ de: "Schriftsatz-Code", en: "Submission code" }`) is unchanged for filings (filings are still Schriftsätze on that surface), but the **namespace shown next to the placeholder string** changes: lawyer sees `{{procedural_event.code}}` in the placeholder column with the same Schriftsatz-Code label and same value. The old `{{rule.submission_code}}` stays in the catalog as an "(alt)" entry pointing at the same field.
|
||||
- **Variable-bag emission** (`internal/services/submission_vars.go:351-364`): the bag emits **both** key-names for every value, so any Word template / saved draft holding `{{rule.X}}` keeps working without a touch. New templates and the in-app catalog show the canonical `{{procedural_event.X}}` name.
|
||||
- **Admin page titles + section headings**: "Regel bearbeiten" → "Verfahrensschritt bearbeiten" (DE), "Edit rule" → "Edit procedural event" (EN). "Regeln verwalten" → "Verfahrensschritte verwalten" / "Procedural events". The URL path `/admin/rules` stays — URL renames have downstream cost (bookmarks, audit log entries) and would need their own redirect slice (out of scope here).
|
||||
- **Go struct comments + service docstrings + worker-facing log lines** that refer to "the rule" → "the procedural event" where the referent is the procedural-event aspect (not the sequencing-rule aspect). Function names, type names, table name stay (Slice B handles those).
|
||||
- **The "Submission Code / Einreichung-Kennung" label** itself stays (it's the lawyer's anchor — they recognize it). The framing around it changes: it now reads as "the code that identifies this *procedural event*", not "the code attached to this *rule*".
|
||||
|
||||
**Untouched in Slice A:**
|
||||
|
||||
- Database schema. Table name (`paliad.deadline_rules`). Column names. FK directions. Indexes. RLS policies. Triggers. Audit log column `rule_id`.
|
||||
- Go struct names: `DeadlineRule` stays. The renames here are *prose*, not *code*. Renaming `DeadlineRule` to `ProceduralEvent` couples Slice A to Slice B's table rename — keep them decoupled.
|
||||
- JSON envelope keys on the wire (`POST /api/admin/rules/:id` still accepts `submission_code` in the body — Slice B's API rename is a breaking change with its own deprecation window).
|
||||
- URL paths (`/admin/rules`, `/api/admin/rules/:id`, `/api/projects/:id/submissions` etc.).
|
||||
- `paliad.deadlines.rule_id` FK column name.
|
||||
- The variable-bag's legacy `{{rule.X}}` keys — kept forever as aliases (cheap, zero rot).
|
||||
- The `submission_drafts` table's `submission_code` text key.
|
||||
|
||||
This boundary makes Slice A a one-day coder shift: scoped, reversible, label-only.
|
||||
|
||||
### What Slice B inherits
|
||||
|
||||
Slice B inherits a codebase + a UI where every prose surface already speaks "procedural event". It also inherits a *legacy alias contract* (the dual emission in the variable bag) that gives it freedom to rename the JSON keys on the wire and the Go struct in two separate sub-slices without rushing.
|
||||
|
||||
---
|
||||
|
||||
## §4 Restructure schema (Q3 — if/when we ship Slice B)
|
||||
|
||||
This is the target the eventual Slice B coder would land. **Nothing here ships in this task.**
|
||||
|
||||
### §4.1 Three new tables (plus the rename of `deadline_rules`)
|
||||
|
||||
```sql
|
||||
-- 1. Procedural event templates — one row per (procedural-event identity)
|
||||
-- For now the live corpus is 1:1 with non-archived submission_codes
|
||||
-- (148 of the 158 distinct codes), so we get ~177 rows minus the 10
|
||||
-- multi-row codes' duplicates. Bilateral / jurisdictional variants
|
||||
-- are modeled at the sequencing_rules layer.
|
||||
CREATE TABLE paliad.procedural_events (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
code text NOT NULL UNIQUE, -- former submission_code
|
||||
name text NOT NULL, -- DE
|
||||
name_en text NOT NULL,
|
||||
description text,
|
||||
event_kind text NOT NULL, -- filing|reply|hearing|decision|order|other
|
||||
primary_party_default text, -- claimant|defendant|both|court
|
||||
legal_source_id uuid REFERENCES paliad.legal_sources(id),
|
||||
concept_id uuid REFERENCES paliad.deadline_concepts(id),
|
||||
lifecycle_state text NOT NULL DEFAULT 'published', -- draft|published|archived
|
||||
draft_of uuid REFERENCES paliad.procedural_events(id),
|
||||
published_at timestamptz,
|
||||
is_active boolean NOT NULL DEFAULT true,
|
||||
created_at timestamptz NOT NULL DEFAULT now(),
|
||||
updated_at timestamptz NOT NULL DEFAULT now()
|
||||
);
|
||||
```
|
||||
|
||||
```sql
|
||||
-- 2. Legal sources — the source-of-law citations the procedural event
|
||||
-- anchors against. ~70 distinct values today (live corpus).
|
||||
CREATE TABLE paliad.legal_sources (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
citation text NOT NULL UNIQUE, -- "DE.PatG.102", "UPC.RoP.220.1", …
|
||||
jurisdiction text NOT NULL, -- DE|UPC|EPA|DPMA|other
|
||||
pretty_de text NOT NULL, -- "§ 102 PatG"
|
||||
pretty_en text NOT NULL, -- "Section 102 PatG"
|
||||
notes text,
|
||||
created_at timestamptz NOT NULL DEFAULT now(),
|
||||
updated_at timestamptz NOT NULL DEFAULT now()
|
||||
);
|
||||
```
|
||||
|
||||
```sql
|
||||
-- 3. Sequencing rules — the timing / trigger / condition mechanics that
|
||||
-- today live alongside the procedural-event identity on deadline_rules.
|
||||
-- One row per (procedural_event × proceeding × variant). The 10
|
||||
-- "_archived_litigation.*" codes that today have 2-5 rows become
|
||||
-- 2-5 sequencing_rules rows for the same procedural_events row.
|
||||
CREATE TABLE paliad.sequencing_rules (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
procedural_event_id uuid NOT NULL REFERENCES paliad.procedural_events(id),
|
||||
proceeding_type_id integer REFERENCES paliad.proceeding_types(id),
|
||||
parent_id uuid REFERENCES paliad.sequencing_rules(id), -- structural tree, today's parent_id
|
||||
trigger_event_id bigint REFERENCES paliad.trigger_events(id), -- event-rooted variant
|
||||
duration_value integer NOT NULL DEFAULT 0,
|
||||
duration_unit text NOT NULL DEFAULT 'months',
|
||||
timing text DEFAULT 'after',
|
||||
alt_duration_value integer,
|
||||
alt_duration_unit text,
|
||||
alt_rule_code text, -- legacy free-text alt citation, retained
|
||||
anchor_alt text,
|
||||
combine_op text, -- max|min
|
||||
condition_expr jsonb,
|
||||
primary_party text, -- per-rule override of the procedural_event default
|
||||
sequence_order integer NOT NULL DEFAULT 0,
|
||||
is_spawn boolean NOT NULL DEFAULT false,
|
||||
spawn_label text,
|
||||
spawn_proceeding_type_id integer REFERENCES paliad.proceeding_types(id),
|
||||
is_bilateral boolean NOT NULL DEFAULT false,
|
||||
is_court_set boolean NOT NULL DEFAULT false,
|
||||
priority text NOT NULL DEFAULT 'mandatory',
|
||||
rule_code text, -- legacy short-form citation, retained on the rule
|
||||
rule_codes text[], -- multi-citation array (mig pre-091)
|
||||
deadline_notes text,
|
||||
deadline_notes_en text,
|
||||
lifecycle_state text NOT NULL DEFAULT 'published',
|
||||
draft_of uuid REFERENCES paliad.sequencing_rules(id),
|
||||
published_at timestamptz,
|
||||
is_active boolean NOT NULL DEFAULT true,
|
||||
created_at timestamptz NOT NULL DEFAULT now(),
|
||||
updated_at timestamptz NOT NULL DEFAULT now()
|
||||
);
|
||||
```
|
||||
|
||||
```sql
|
||||
-- 4. Rename downstream FK + add the link to procedural_events.
|
||||
ALTER TABLE paliad.deadlines
|
||||
ADD COLUMN procedural_event_id uuid REFERENCES paliad.procedural_events(id),
|
||||
ADD COLUMN sequencing_rule_id uuid REFERENCES paliad.sequencing_rules(id);
|
||||
-- (rule_id stays as a transitional alias during the dual-write window;
|
||||
-- dropped at end of Slice B)
|
||||
```
|
||||
|
||||
```sql
|
||||
-- 5. Submission drafts: add procedural_event_id FK alongside submission_code.
|
||||
ALTER TABLE paliad.submission_drafts
|
||||
ADD COLUMN procedural_event_id uuid REFERENCES paliad.procedural_events(id);
|
||||
-- (submission_code stays — it's the cosmetic anchor lawyers recognize
|
||||
-- in URLs and chat, and it doubles as the procedural_events.code value)
|
||||
```
|
||||
|
||||
### §4.2 What goes where (column-by-column map)
|
||||
|
||||
Every column on today's `paliad.deadline_rules` lands on exactly one of the three new tables:
|
||||
|
||||
| Today's `deadline_rules` column | Lands on | Notes |
|
||||
|---|---|---|
|
||||
| `id`, `created_at`, `updated_at` | `sequencing_rules` | The current row's identity becomes a sequencing-rule row. `procedural_events.id` is **new** — backfilled from `submission_code`. |
|
||||
| `submission_code` | `procedural_events.code` | Promoted up. Multi-row codes (10 in corpus, all `_archived_litigation.*`) collapse to one row on the new table; the 2-5 sequencing rows hang off it. |
|
||||
| `name`, `name_en`, `description` | `procedural_events` | Procedural-event identity. |
|
||||
| `primary_party` | `procedural_events.primary_party_default` AND `sequencing_rules.primary_party` | Both. The procedural event has a default party (claimant for Klage etc.); the sequencing rule can override per-jurisdiction (bilateral variants — e.g. `litigation.reply` claimant vs defendant become two sequencing rows with overridden party). |
|
||||
| `event_type` | `procedural_events.event_kind` | Hat 1, with rename to `event_kind` (term lock §2). |
|
||||
| `legal_source` | `legal_sources.citation` + FK from `procedural_events.legal_source_id` | The citation moves to its own row; the procedural event points at it. `pretty_de` / `pretty_en` materialize the existing `legalSourcePretty()` function output as columns (with the function retained as the migration source). |
|
||||
| `rule_code`, `alt_rule_code`, `rule_codes[]` | `sequencing_rules` | Short-form citation arrays stay on the sequencing rule — they're rule-specific. |
|
||||
| `proceeding_type_id`, `parent_id`, `trigger_event_id`, `spawn_proceeding_type_id`, `is_spawn`, `spawn_label`, `is_bilateral`, `is_court_set`, `combine_op` | `sequencing_rules` | Hat 3 (mechanics) — exact copies. |
|
||||
| `duration_value`, `duration_unit`, `timing`, `alt_duration_value`, `alt_duration_unit`, `anchor_alt` | `sequencing_rules` | Hat 3 (mechanics). |
|
||||
| `condition_expr` (jsonb) | `sequencing_rules` | Hat 3. The grammar from mig 091 stays. |
|
||||
| `priority`, `sequence_order` | `sequencing_rules` | Hat 3. |
|
||||
| `is_active`, `lifecycle_state`, `draft_of`, `published_at` | **BOTH** `procedural_events` AND `sequencing_rules` | A procedural event can be retired independently of any one of its sequencing variants. Backfill: copy onto both during dual-write; new rows go through the rule-editor service which writes both sides together. |
|
||||
| `concept_id` (FK to `deadline_concepts`) | `procedural_events.concept_id` | The concept layer (einstein 2026-05-08) attaches to the procedural event, not the sequencing rule. |
|
||||
| `deadline_notes`, `deadline_notes_en` | `sequencing_rules` | They're rule-specific notes ("filing the appeal in DE costs €X if you also did Y") — not procedural-event-wide. |
|
||||
|
||||
Three columns disappear:
|
||||
|
||||
- The semantically-overloaded part of `event_type` (renamed to `event_kind` and moved).
|
||||
- The "what is this thing" vs "how does it fire" name conflict — gone by construction.
|
||||
- Any column that exists only because of the conflation (none of today's columns are pure overhead — they all carry data — so the count stays at 38 across the three new tables).
|
||||
|
||||
### §4.3 Indexes + RLS
|
||||
|
||||
`paliad.can_see_project()` is the canonical RLS predicate (mig 055). None of the three new tables hold project-scoped data — they're firm-wide reference tables. RLS = none, same posture as today's `deadline_rules` (which is firm-wide and unrestricted at the row level; access control is via the `lifecycle_state='published'` filter in the read paths).
|
||||
|
||||
Indexes inherited from today:
|
||||
|
||||
- `paliad.legal_sources(citation)` — UNIQUE.
|
||||
- `paliad.procedural_events(code)` — UNIQUE.
|
||||
- `paliad.procedural_events(concept_id)` — for the deadline-concept join.
|
||||
- `paliad.sequencing_rules(procedural_event_id, proceeding_type_id, lifecycle_state)` — primary read path for the calculator.
|
||||
- `paliad.sequencing_rules(parent_id)` — tree walk.
|
||||
- `paliad.sequencing_rules(trigger_event_id)` — event-rooted variant.
|
||||
|
||||
---
|
||||
|
||||
## §5 Migration plan (Slice B — when it ships, not in this task)
|
||||
|
||||
Phased dual-write, so the cutover is **never** a single instant where the wire format flips. m gets to roll back any one phase with a `git revert` + an `ALTER TABLE` if a phase misbehaves in prod.
|
||||
|
||||
### §5.1 Phase 1 — Additive (no down-time)
|
||||
|
||||
1. Create `procedural_events`, `sequencing_rules`, `legal_sources`.
|
||||
2. Backfill `legal_sources` from `DISTINCT legal_source` on `deadline_rules` (70 rows). Populate `pretty_de`/`pretty_en` by calling the existing `legalSourcePretty()` function in a one-shot SQL/Go shim during the migration. Verify `COUNT(DISTINCT legal_source FROM deadline_rules) = COUNT(*) FROM legal_sources`.
|
||||
3. Backfill `procedural_events` from `DISTINCT submission_code` on `deadline_rules WHERE submission_code IS NOT NULL`. Take `name`, `name_en`, `event_type → event_kind`, `primary_party`, `concept_id`, `description` from the lowest-`id` rule row for each code (tie-breaker: lowest `sequence_order`). Verify `COUNT(*) FROM procedural_events = COUNT(DISTINCT submission_code FROM deadline_rules WHERE submission_code IS NOT NULL)` (= 158).
|
||||
4. Backfill `sequencing_rules` 1:1 from `deadline_rules` (254 rows). FK `procedural_event_id` resolved by code lookup; sequencing-rule row inherits the `deadline_rules.id` (so existing `deadlines.rule_id` FKs continue to resolve via the new column for the dual-write window — see Phase 3).
|
||||
5. Add `paliad.deadlines.procedural_event_id` + `sequencing_rule_id` columns, backfill from `deadlines.rule_id` join.
|
||||
6. Add `paliad.submission_drafts.procedural_event_id`, backfill from `submission_code` join.
|
||||
|
||||
This phase ships behind a feature flag (or just behind unused code) — readers + writers stay on `deadline_rules`. No behavior change.
|
||||
|
||||
### §5.2 Phase 2 — Dual-write (no down-time)
|
||||
|
||||
7. Update `RuleEditorService` to write to both `deadline_rules` (legacy) and (`procedural_events`, `sequencing_rules`, `legal_sources`) on every Create/Update/Publish/Archive. Audit log writes one row per side.
|
||||
8. Update read paths to **read from the new tables**, falling back to `deadline_rules` if the new row is missing (defense-in-depth during backfill catch-up).
|
||||
9. Run for ≥ 1 week (m's call on length). Compare row counts and a hash digest of the union daily — if drift, surface.
|
||||
|
||||
### §5.3 Phase 3 — Cutover (no down-time, but reversible only via re-application of the dual-write)
|
||||
|
||||
10. Flip read paths to **only** the new tables (`SubmissionVarsService.loadPublishedRule`, `DeadlineRuleService.*`, `SubmissionService.list`, `ProjectionService`, `FristenrechnerCalc`, etc.).
|
||||
11. Stop writing to `deadline_rules`.
|
||||
12. `paliad.deadlines.rule_id` is kept as a no-op alias for one more week; new writes go to `procedural_event_id` + `sequencing_rule_id`.
|
||||
13. `submission_drafts.submission_code` is kept as the URL anchor; the FK `procedural_event_id` is the primary join key going forward.
|
||||
|
||||
### §5.4 Phase 4 — Drop legacy (downtime window, destructive)
|
||||
|
||||
14. `paliad.deadline_rules_pre_<slice-B-mig>` snapshot of the entire table.
|
||||
15. DROP TABLE paliad.deadline_rules (after CASCADE-safe FK rewires).
|
||||
16. DROP COLUMN paliad.deadlines.rule_id (keep `rule_code` + `custom_rule_text` as the human-readable denormalized columns — they're the safety net for orphaned deadlines per t-paliad-258).
|
||||
|
||||
m grants this destructive phase its own window (precedent: mig 091 on 2026-05-15). Until then, the legacy table sits dormant.
|
||||
|
||||
### §5.5 Migration tracker
|
||||
|
||||
- Slice B uses migration numbers 124 (Phase 1 — create tables + backfill) and onward — a 4-5 migration sequence, one per phase boundary, mirroring the Phase 2/3 slicing that shipped under t-paliad-195.
|
||||
- Each migration includes a `paliad.audit_reason = 'mig <n>: <slice-B-phase>'` set_config like mig 091 did, so the audit log captures the schema journey.
|
||||
|
||||
---
|
||||
|
||||
## §6 Service-layer impact
|
||||
|
||||
### §6.1 Slice A — prose-only changes
|
||||
|
||||
| File | Change |
|
||||
|---|---|
|
||||
| `internal/services/submission_vars.go` | `addRuleVars` → also emit `procedural_event.code`, `procedural_event.name`, `procedural_event.name_de`, `procedural_event.name_en`, `procedural_event.legal_source`, `procedural_event.legal_source_pretty`, `procedural_event.primary_party`, `procedural_event.event_kind` (8 new keys, 1:1 with the 8 existing `rule.*` keys, same values). Rename docstrings + the package-level placeholder map comment ("`rule.*`" → "`procedural_event.*` (with legacy alias `rule.*`)"). |
|
||||
| `internal/services/deadline_rule_service.go` | Top-of-file comment + struct comment renames only. Method names stay (`DeadlineRuleService`, `GetByID`, etc.). |
|
||||
| `internal/services/rule_editor_service.go` | Same. |
|
||||
| `internal/services/projection_service.go`, `deadline_service.go`, `fristenrechner.go`, `submission_draft_service.go`, `event_trigger_service.go`, `event_deadline_service.go`, `proceeding_mapping.go`, `export_service.go` | No code changes. Comments mentioning "the rule"/"rules" stay accurate as long as the file is about sequencing — only services that surface the **identity** aspect of the rule (`submission_vars.go`) need a prose pass. |
|
||||
| `internal/handlers/submissions.go` | No SQL change. Type+comment renames: the catalog response type stays `submissionListEntry` (it's still a Schriftsatz-level list); doc comments speak of "procedural events whose kind is filing" instead of "rules of type filing". |
|
||||
| `internal/handlers/admin_rules.go` | URL path stays. JSON envelope stays. Page-render comments + log-line text shift to "procedural event". |
|
||||
| `internal/handlers/submission_drafts.go`, `deadlines.go`, `fristenrechner.go` | No service-layer change. |
|
||||
|
||||
### §6.2 Slice B — structural
|
||||
|
||||
Mostly load-bearing; not enumerated here in detail (out of scope per (R)=C). The shape:
|
||||
|
||||
- `RuleEditorService` splits into `ProceduralEventService` + `SequencingRuleService` + `LegalSourceService`. The Save / Publish / Archive flow on the editor coordinates all three.
|
||||
- `DeadlineRuleService.GetByID` becomes `SequencingRuleService.GetByID`; the `submission_code` lookup moves to `ProceduralEventService.GetByCode`.
|
||||
- `SubmissionVarsService.loadPublishedRule` becomes `loadPublishedProceduralEvent` and returns a triple (`event`, `defaultSequencingRule`, `legalSource`); the variable-bag emission consumes all three.
|
||||
- `ProjectionService` and the Fristenrechner calculator read from `sequencing_rules` (same column set, same logic — only the table name changes).
|
||||
- `SubmissionService.list` (handlers/submissions.go) filters `procedural_events.event_kind IN ('filing', 'reply')`.
|
||||
- Backfill orphans + audit triggers (mig 079 / 089) are re-pointed at `sequencing_rules` + a new `procedural_events_audit`.
|
||||
|
||||
---
|
||||
|
||||
## §7 UI / i18n impact
|
||||
|
||||
### §7.1 i18n keys (Slice A)
|
||||
|
||||
Existing keys (DE + EN) at `frontend/src/client/i18n.ts` lines ~2834-2920 and ~5800-5890 — surface area is *labels*, not *placeholders-in-Word*:
|
||||
|
||||
| Old key | New key (Slice A) | DE label | EN label |
|
||||
|---|---|---|---|
|
||||
| `admin.rules.list.title` | `admin.procedural_events.list.title` | "Verfahrensschritte verwalten — Paliad" | "Manage procedural events — Paliad" |
|
||||
| `admin.rules.list.heading` | `admin.procedural_events.list.heading` | "Verfahrensschritte verwalten" | "Manage procedural events" |
|
||||
| `admin.rules.list.subtitle` | `admin.procedural_events.list.subtitle` | "Verfahrensschritte anlegen, bearbeiten und freigeben. Lifecycle: draft → published → archived." | "Create, edit and publish procedural events. Lifecycle: draft → published → archived." |
|
||||
| `admin.rules.list.new` | `admin.procedural_events.list.new` | "+ Neuer Verfahrensschritt" | "+ New procedural event" |
|
||||
| `admin.rules.col.submission_code` | `admin.procedural_events.col.code` | "Code" (drop "/ Einreichung-Kennung" — the new heading already disambiguates) | "Code" |
|
||||
| `admin.rules.col.legal_citation` | `admin.procedural_events.col.legal_source` | "Rechtsgrundlage" | "Legal source" |
|
||||
| `admin.rules.col.name` | `admin.procedural_events.col.name` | "Bezeichnung" | "Name" |
|
||||
| `admin.rules.col.proceeding` | `admin.procedural_events.col.proceeding` | "Verfahrenstyp" | "Proceeding" |
|
||||
| `admin.rules.col.priority` | `admin.procedural_events.col.priority` | "Priorität" | "Priority" |
|
||||
| `admin.rules.col.lifecycle` | `admin.procedural_events.col.lifecycle` | "Lifecycle" | "Lifecycle" |
|
||||
| `admin.rules.col.modified` | `admin.procedural_events.col.modified` | "Zuletzt geändert" | "Last modified" |
|
||||
| `admin.rules.edit.title` | `admin.procedural_events.edit.title` | "Verfahrensschritt bearbeiten — Paliad" | "Edit procedural event — Paliad" |
|
||||
| `admin.rules.edit.heading.loading` | `admin.procedural_events.edit.heading.loading` | "Verfahrensschritt laden…" | "Loading procedural event…" |
|
||||
| `admin.rules.edit.breadcrumb` | `admin.procedural_events.edit.breadcrumb` | "← Verfahrensschritte verwalten" | "← Manage procedural events" |
|
||||
| `admin.rules.edit.field.submission_code` | `admin.procedural_events.edit.field.code` | "Code (Schriftsatz-Code / Einreichung-Kennung)" — keep the parenthetical so lawyers familiar with the old label know what they're looking at. | "Code (submission / procedural-event identifier)" |
|
||||
| `admin.rules.edit.field.rule_code` | `admin.procedural_events.edit.field.short_citation` | "Rechtsgrundlage (Kurzform)" | "Legal source (short form)" |
|
||||
| `admin.rules.edit.field.legal_source` | `admin.procedural_events.edit.field.legal_source` | "Rechtsgrundlage (Langform)" | "Legal source (long form)" |
|
||||
| `admin.rules.edit.field.name` | `admin.procedural_events.edit.field.name` | "Bezeichnung (DE)" | "Name (DE)" |
|
||||
| `admin.rules.edit.field.name_en` | `admin.procedural_events.edit.field.name_en` | "Bezeichnung (EN)" | "Name (EN)" |
|
||||
| `admin.rules.edit.field.proceeding` | `admin.procedural_events.edit.field.proceeding` | "Verfahrenstyp" | "Proceeding type" |
|
||||
| `admin.rules.edit.field.trigger` | `admin.procedural_events.edit.field.trigger` | "Trigger-Ereignis" | "Trigger event" |
|
||||
| `admin.rules.edit.field.parent` | `admin.procedural_events.edit.field.parent` | "Übergeordneter Verfahrensschritt (UUID)" | "Parent procedural event (UUID)" |
|
||||
| `admin.rules.edit.field.concept` | `admin.procedural_events.edit.field.concept` | "Konzept (UUID)" | "Concept (UUID)" |
|
||||
| `admin.rules.edit.field.sequence_order` | `admin.procedural_events.edit.field.sequence_order` | "Reihenfolge" | "Order" |
|
||||
| `admin.rules.edit.field.duration_value` | `admin.procedural_events.edit.field.duration_value` | "Dauer" | "Duration" |
|
||||
| `admin.rules.edit.field.primary_party` | `admin.procedural_events.edit.field.primary_party` | "Partei (typisch)" | "Primary party" |
|
||||
| `admin.rules.edit.field.event_type` | `admin.procedural_events.edit.field.event_kind` | "Art des Verfahrensschritts" | "Procedural-event kind" |
|
||||
| `admin.rules.edit.field.description` | `admin.procedural_events.edit.field.description` | "Beschreibung" | "Description" |
|
||||
|
||||
**Legacy keys retained as aliases** so any existing translation imports or external integrations keep working — old keys point at the same DE/EN values during a deprecation window of one full Slice B cycle.
|
||||
|
||||
### §7.2 Variable-bag placeholders (Slice A)
|
||||
|
||||
`frontend/src/client/submission-draft.ts:155-185` — the catalog of placeholders the lawyer sees in the sidebar:
|
||||
|
||||
| Old placeholder (kept as legacy alias) | New canonical placeholder | DE label | EN label |
|
||||
|---|---|---|---|
|
||||
| `{{rule.submission_code}}` | `{{procedural_event.code}}` | "Code (Verfahrensschritt)" | "Code (procedural event)" |
|
||||
| `{{rule.name}}` | `{{procedural_event.name}}` | "Bezeichnung" | "Name" |
|
||||
| `{{rule.name_de}}` | `{{procedural_event.name_de}}` | "Bezeichnung (DE)" | "Name (DE)" |
|
||||
| `{{rule.name_en}}` | `{{procedural_event.name_en}}` | "Bezeichnung (EN)" | "Name (EN)" |
|
||||
| `{{rule.legal_source}}` | `{{procedural_event.legal_source}}` | "Rechtsgrundlage (Code)" | "Legal source (code)" |
|
||||
| `{{rule.legal_source_pretty}}` | `{{procedural_event.legal_source_pretty}}` | "Rechtsgrundlage" | "Legal source" |
|
||||
| `{{rule.primary_party}}` | `{{procedural_event.primary_party}}` | "Partei (typisch)" | "Primary party" |
|
||||
| `{{rule.event_type}}` | `{{procedural_event.event_kind}}` | "Art des Verfahrensschritts" | "Procedural-event kind" |
|
||||
|
||||
The catalog renders the canonical name in the "copy-this-placeholder" button. The variable bag (`submission_vars.go`) emits both names with identical values, so any Word template the lawyer already has continues to work; new templates are encouraged to use the canonical name.
|
||||
|
||||
### §7.3 Admin rule-editor form (Slice A)
|
||||
|
||||
`frontend/src/admin-rules-edit.tsx:74-110` — i18n key rebinds + heading text update. The DOM `id` attributes (`f-submission-code`, `f-rule-code`, `f-legal-source`, …) stay — they're internal, the rename here is cosmetic, the form still POSTs the same JSON envelope (Slice A doesn't touch the API). The fieldset `legend` for the "Identität" section changes to "Verfahrensschritt-Identität" (DE) / "Procedural-event identity" (EN). The "Verfahren & Trigger" section heading stays — that section is about sequencing, and Slice A doesn't rename sequencing-level labels (those are Slice B).
|
||||
|
||||
### §7.4 Project-detail Schriftsätze tab + dashboard
|
||||
|
||||
`frontend/src/client/submissions.ts`, `submissions-index.ts`: no surface-level label change in Slice A. The Schriftsätze tab continues to show Schriftsätze (the lawyer's preferred term for *filings specifically*). The tab is a filtered view onto procedural events of kind `filing`/`reply` — that distinction surfaces only in admin contexts.
|
||||
|
||||
### §7.5 Help text + docs
|
||||
|
||||
A short addition to the in-app help: "What is a procedural event?" — one-paragraph definition explaining the umbrella term, with examples (Klage, Klageerwiderung, mündliche Verhandlung, Endurteil). Stored in `frontend/src/client/i18n.ts` under `help.procedural_events.intro`. Out of scope for the URL/router changes — added as static copy where it fits naturally.
|
||||
|
||||
---
|
||||
|
||||
## §8 Slice plan
|
||||
|
||||
### §8.1 Slice A (this design's downstream task)
|
||||
|
||||
**Scope:** prose-only rename per §3 ("renamed in Slice A" list).
|
||||
|
||||
**Mechanics:**
|
||||
|
||||
1. Add 8 new placeholder keys to the variable bag in `submission_vars.go` (1:1 with the existing 8 `rule.*` keys). Keep the legacy keys.
|
||||
2. Update `frontend/src/client/submission-draft.ts` placeholder catalog labels.
|
||||
3. Rebind admin i18n keys per §7.1 (with legacy keys retained).
|
||||
4. Update admin page titles + section headings.
|
||||
5. Update Go struct comments + service docstrings in `submission_vars.go`, `deadline_rule_service.go`, `rule_editor_service.go`, `submission_draft_service.go`, `submissions.go` handler. No code-flow change.
|
||||
6. Update `internal/handlers/submissions.go` doc comments.
|
||||
7. Add a short `docs/glossary.md` entry (or extend an existing one) for "procedural event" / "Verfahrensschritt" — single source of truth for the term.
|
||||
8. Tests: rename strings in existing test fixtures + add a regression test that the variable bag emits **both** the legacy `rule.X` and the canonical `procedural_event.X` keys with the same value. (Critical — without this test, a future commit could drop the legacy alias and silently break user templates.)
|
||||
9. Manual smoke: open the admin rule editor, confirm the new title appears. Open the submission-draft editor, confirm both `{{rule.X}}` and `{{procedural_event.X}}` placeholders are listed (with canonical first). Generate a `.docx` from a project using each placeholder name — both render identically.
|
||||
|
||||
**Risk:** very low. No DB change, no API change, fully reversible.
|
||||
|
||||
**No hours estimate per project CLAUDE.md.**
|
||||
|
||||
### §8.2 Slice B (separate mai task — designed here, hired later)
|
||||
|
||||
**Scope:** structural rework per §4 + §5.
|
||||
|
||||
**Mechanics:** Phase 1 → Phase 4 per §5.
|
||||
|
||||
**Prerequisite:** m greenlights via a new mai task with this doc + §11's open items addressed. **Not part of Slice A.**
|
||||
|
||||
**Sub-slices (suggested for Slice B's own task):**
|
||||
|
||||
- **B.0** — Re-validate this doc's premises against live DB (numbers shift over weeks).
|
||||
- **B.1** — Phase 1 additive migration + backfill (mig 124).
|
||||
- **B.2** — Phase 2 dual-write + read-fallback.
|
||||
- **B.3** — Phase 3 read cutover (no schema change).
|
||||
- **B.4** — Phase 4 destructive drop (downtime window).
|
||||
- **B.5** — Rename Go types `DeadlineRule` → `SequencingRule` + `ProceduralEvent`; rename JSON API envelope keys with a deprecation header. Independent of B.4.
|
||||
- **B.6** — Rename admin URL paths `/admin/rules` → `/admin/procedural-events` with redirects. Optional / low-priority.
|
||||
|
||||
### §8.3 Why splitting is the right call
|
||||
|
||||
The conflation is real, but the *fix* for the most-painful surface (the editor sidebar) is independent of the table restructure. Splitting lets m ship the fix this week, see whether the prose change alone resolves enough of the cognitive friction, and then decide whether the structural rework is still worth the migration cost. If after Slice A m says "this reads fine now, B isn't worth it", that's a legitimate outcome — Slice B is a *good* refactor, not an *urgent* one.
|
||||
|
||||
---
|
||||
|
||||
## §9 Risk assessment
|
||||
|
||||
### §9.1 Slice A risks
|
||||
|
||||
| Risk | Likelihood | Severity | Mitigation |
|
||||
|---|---|---|---|
|
||||
| Lawyer's existing Word template has `{{rule.submission_code}}` baked in; a future commit drops the legacy alias and breaks templates. | Low (Slice A keeps the alias) | High if it happens | Regression test (§8.1 step 8) asserts both keys emit. Add an audit-log line on every variable-bag call recording which keys were consumed by the merge engine — gives a 30-day window of evidence before we'd consider deprecating the legacy keys. |
|
||||
| i18n key rename misses a binding, leaving an English string visible to a DE user. | Medium | Low | The build pipeline (`bun test` / `bun build`) fails on missing i18n keys in `i18n-keys.ts`. Add the new keys to the type union; leave the old keys in the union with `@deprecated` JSDoc. |
|
||||
| Renamed admin page heading confuses returning admin users ("Where did 'Regeln verwalten' go?"). | Medium | Low | One-time changelog entry; the URL `/admin/rules` is unchanged so muscle memory still lands them on the page. Internal users only (whitelist-gated). |
|
||||
| Slice A reads as "we're done" and Slice B never ships. | Medium | Medium (the model stays wrong) | This doc files the Slice B design as a separate task entry **before** Slice A merges, so the to-do is visible. m's call whether to schedule it. |
|
||||
|
||||
### §9.2 Slice B risks (deferred; recorded for the future task)
|
||||
|
||||
| Risk | Mitigation |
|
||||
|---|---|
|
||||
| Backfill collapses too eagerly: 10 multi-row submission_codes today are `_archived_litigation.*` — confirm they should collapse into one procedural event with 2-5 sequencing variants, vs. each row becoming its own procedural event. | The `_archived_litigation.*` codes are archived per their prefix — collapse is safe. **Decision-flag for Slice B's own design pass.** |
|
||||
| `deadline_concepts` linkage (125 of 254 rules link to a concept) — does the concept attach to the procedural event or the sequencing rule? §4.2 says procedural event; verify this is right when re-validating premises in B.0. | Read-path audit: every consumer that joins `deadline_rules.concept_id` (rule_editor, projection, fristenrechner) operates on the rule-level today. Reconfirm none of them depend on per-jurisdiction concept-attachment. |
|
||||
| The dual-write window introduces drift if a write hits one side and fails on the other. | Atomicity via single transaction per write in `RuleEditorService`. Daily drift-check job (one SELECT pair, alert if mismatched). |
|
||||
| `paliad.deadlines.rule_id` (1 live row, but more in future) — backfilling `procedural_event_id` + `sequencing_rule_id` must not orphan the live row. | The 1 live row joins cleanly. Backfill in the same migration that adds the new columns. |
|
||||
| The submission-draft `submission_code` text key — what if two `procedural_events.code` values collide post-rename (e.g. a draft was saved against a code that we then archive)? | Slice B Phase 1 enforces `procedural_events.code UNIQUE`; the backfill verifies no collision on the existing 158 distinct values. Drafts with codes that no longer exist as published procedural events are handled by the existing `submission_drafts.submission_code` text fallback (no FK enforcement). |
|
||||
| Slice B's API-key rename (`submission_code` → `code` in JSON) breaks external integrations. | None exist today (paliad is internal-only); add a one-Slice deprecation header (`X-Deprecated-Field: submission_code`) before flipping. |
|
||||
| **Coordination risk with future fristen/calculator work.** The Fristenrechner calculator reads `deadline_rules` directly today. Slice B Phase 2's read-fallback handles this, but a parallel calculator feature in flight could land changes that need re-merging. | B.0's job: confirm no in-flight task touches `deadline_rules` table shape before scheduling. |
|
||||
|
||||
### §9.3 What rolls Slice A back
|
||||
|
||||
`git revert <slice-a-commit>` + reload. Zero data side-effects (no DB writes). 30 seconds.
|
||||
|
||||
### §9.4 What rolls Slice B back
|
||||
|
||||
Per phase — Phases 1-3 reversible via reverting code + `DROP TABLE`. Phase 4 reversible only by restoring `deadline_rules` from the `_pre_<n>` snapshot taken at the start of Phase 4. Same posture as mig 091 — m's call when to commit to this point.
|
||||
|
||||
---
|
||||
|
||||
## §10 Out of scope
|
||||
|
||||
- **Renaming `paliad.events`** (the audit feed). Distinct table, distinct concept. The umbrella-term lock (§2) deliberately uses "procedural event" not "event" to avoid colliding with it.
|
||||
- **Renaming `paliad.deadline_concepts`** to align with the procedural-event taxonomy. The concept layer is the cross-proceeding semantic bridge (einstein 2026-05-08 Q5); the relationship "procedural event has-a concept" already reads cleanly under the new term.
|
||||
- **Per-jurisdiction variations of the same procedural event** (issue body's explicit out-of-scope). The 10 multi-row codes in the corpus today stay multi-row.
|
||||
- **Multi-tenant / cross-firm sharing of procedural events** — paliad is single-tenant per deploy via `FIRM_NAME`; cross-firm is a separate design.
|
||||
- **einstein's `proceeding_event_edges` graph proposal.** That design proposed a graph of typed event-types connected by typed edges. This design's procedural-events / sequencing-rules split is **compatible** with that graph shape (the edges would attach to procedural-event-IDs rather than sequencing-rule-IDs), but the graph layer is a Slice C, not Slice B. Flagged for future continuity, not part of either slice here.
|
||||
- **Renaming Go type `DeadlineRule` to `SequencingRule` or `ProceduralEvent` in Slice A.** Slice A is prose; Slice B's B.5 sub-slice handles the type rename. Coupling them costs the reversibility property.
|
||||
- **API-envelope key renames** (`submission_code` → `code`, `event_type` → `event_kind` on the wire). Slice B only.
|
||||
- **URL path renames** (`/admin/rules` → `/admin/procedural-events`). Slice B.6, optional.
|
||||
- **Touching `paliad.trigger_events`** beyond keeping the FK path open (today `deadline_rules.trigger_event_id`; Slice B maps to `sequencing_rules.trigger_event_id`).
|
||||
- **Touching `paliad.event_categories` / Pathway-B navigation.** Independent layer.
|
||||
|
||||
---
|
||||
|
||||
## §11 Open questions for m (escalated via `mai instruct head` per project CLAUDE.md)
|
||||
|
||||
Per project CLAUDE.md "Head answers questions — NO AskUserQuestion" rule, these are surfaced to head, not picked-as-chip with the user.
|
||||
|
||||
| ID | Question | Inventor recommendation | Material to head? |
|
||||
|---|---|---|---|
|
||||
| **Q1** | Scope: cosmetic-only (A) · full restructure (B) · cosmetic now + B as planned follow-up (C). | **(R) = C** | Yes — material. Defines whether Slice B is hired today or filed as a future task. |
|
||||
| **Q2** | Umbrella term: "procedural event" (DE: Verfahrensschritt) · "submission" (filings only) · "Verfahrensereignis" · other. | **(R) = procedural event / Verfahrensschritt** | Yes — material. The term ripples through every label in §7. Inventor's pick is the canonical choice; head can override with a single message. |
|
||||
| **Q3** | Slice B migration shape: confirmed (§4 + §5) or rescope. | **(R) = §4 + §5 as written, decision deferred until Slice B is hired** | No — informational. Locked when Slice B's own design pass runs. |
|
||||
| **Q4** | Effect on Schriftsätze surface: filter `procedural_events.event_kind IN ('filing', 'reply')` is acceptable replacement for today's `event_type='filing'`. | **(R) = yes, semantically equivalent under Slice B; no behavior change to lawyer.** | No — informational. |
|
||||
| **Q5** | Are the 10 archived multi-row submission_codes (`_archived_litigation.*`) safe to collapse into single procedural events with multiple sequencing variants in Slice B? | **(R) = yes, prefix indicates archival; collapse-safe.** | No — informational, defers to Slice B. |
|
||||
| **Q6** | `concept_id` attaches to procedural event, not sequencing rule. Confirmable? | **(R) = yes, per §4.2 (one concept per identity, not per jurisdiction).** | No — informational, defers to Slice B. |
|
||||
| **Q7** | Keep the legacy `{{rule.X}}` placeholder aliases **forever**, or set a deprecation horizon (e.g. 1 year)? | **(R) = forever, with `@deprecated` annotation in the catalog. Removing them risks breaking lawyer-authored templates that paliad doesn't see.** | Yes — material to Slice A's contract (test in §8.1 step 8 asserts both keys emit). |
|
||||
| **Q8** | Document side: update m/paliad#93 issue body to fix the `deadlines.deadline_rule_id` → `deadlines.rule_id` typo (§1 last paragraph). | **(R) = yes, head's call when to edit.** | No — informational, doc hygiene. |
|
||||
| **Q9** | After Slice A ships, do we file Slice B as a new mai task **now** (so it's visible), or wait for m to ask? | **(R) = file now, status:planning, no owner. Visibility >> deferred surprise.** | Yes — material to "does the model stay wrong forever". |
|
||||
|
||||
Q1, Q2, Q7, Q9 are the four head needs to answer before the coder shift. Q3-Q6, Q8 defer cleanly.
|
||||
|
||||
---
|
||||
|
||||
## §12 Appendix — verbatim m quote
|
||||
|
||||
From m's report 2026-05-25 15:02 (paliad#93 body):
|
||||
|
||||
> This shows how our 'rule' table system may need a revision?! It feels like we are rule based not submission based. But here we have a specific submission that is connected to a rule (as in: legal norm). And of course also connected to other 'procedural events' (which is a good term for it all) by rules how they are sequenced. But it makes it sound weird in the fields...
|
||||
|
||||
The design above takes m's three-way split — *the procedural event* / *the legal norm* / *the rule by which they are sequenced* — at face value and turns it into a column-level map (§4.2), a slice plan (§8), and a deprecation contract (§9.1).
|
||||
|
||||
---
|
||||
|
||||
*End of design.*
|
||||
956
docs/research-deadlines-completeness-2026-05-25.md
Normal file
956
docs/research-deadlines-completeness-2026-05-25.md
Normal file
@@ -0,0 +1,956 @@
|
||||
# Bulletproof completeness audit — paliad.deadline_rules vs statutory sources
|
||||
|
||||
**Author:** curie (researcher)
|
||||
**Date:** 2026-05-25
|
||||
**Task:** t-paliad-263 (m/paliad#94)
|
||||
**Mode:** read-only research, no DB writes
|
||||
**Branch:** `mai/curie/researcher-bulletproof`
|
||||
|
||||
Scope confirmed by head (paliad/head → paliad/curie, 2026-05-25 15:13):
|
||||
**UPC Rules of Procedure + EPC + PatG / ZPO / GebrMG**, plus UPC Agreement /
|
||||
Statute where they create time-limits. No HLC-internal checklists exist in
|
||||
the current head's working tree.
|
||||
|
||||
Companion / prior audits this report supersedes-and-extends:
|
||||
|
||||
- `docs/audit-fristenrechner-completeness-2026-04-30.md` (curie, t-paliad-084) — youpc-vs-paliad gap analysis.
|
||||
- `docs/audit-upc-rop-deadlines-2026-05-08.md` (curie, t-paliad-159) — first UPC RoP gap list (52 rules / 2 duration bugs).
|
||||
- `docs/audit-fristen-logic-2026-05-13.md` (pauli, t-paliad-157) — schema audit; the codes used here (`upc.inf.cfi`, `de.inf.lg`, …) reflect the post-mig-096 rename.
|
||||
|
||||
Migration baseline: migration ≤ `122_deadlines_custom_rule_text` (live as of 2026-05-25 14:00 UTC).
|
||||
|
||||
---
|
||||
|
||||
## §0. TL;DR
|
||||
|
||||
- **20 active fristenrechner proceeding_types** (live, `is_active=true`,
|
||||
`lifecycle_state='published'`) carry **132 active rules**. One extra
|
||||
`_archived_litigation` row holds 40 retired Pipeline-A rules from
|
||||
mig 093 — not surfaced anywhere, kept only for FK validity.
|
||||
|
||||
| Jurisdiction | Active types | Active rules | Statute-bound rules audited |
|
||||
|---|---:|---:|---:|
|
||||
| UPC (CFI + CoA) | 9 (incl. upc.ccr.cfi alias) | 67 | 67 |
|
||||
| EPA | 3 | 23 | 23 |
|
||||
| DPMA | 3 | 13 | 13 |
|
||||
| DE (LG/OLG/BGH/BPatG) | 5 | 29 | 29 |
|
||||
| **Total** | **20** | **132** | **132** |
|
||||
|
||||
- **5 high-impact bugs still live** that the prior May 8 audit
|
||||
surfaced (2) plus 3 new ones identified here.
|
||||
- 🔴 **`upc.rev.cfi.defence` 3 months, RoP.49.1 says 2 months.** Flagged
|
||||
May 8; still live. ★★★ — every UPC_REV defendant.
|
||||
- 🔴 **`upc.rev.cfi.rejoin` 2 months, RoP.52 says 1 month.** Flagged
|
||||
May 8; still live. ★★★ — every UPC_REV proceeding.
|
||||
- 🟠 **`upc.apl.merits.response` 2 months, RoP.235.1 says 3 months.**
|
||||
New finding (May 8 audit recorded the rule as "3 months / present-wrong
|
||||
rule_code only" — actually live data shows 2 months, so the audit
|
||||
sample mis-recorded the duration too). ★★★ — every UPC main-track
|
||||
appeal respondent.
|
||||
- 🟠 **`de.inf.lg.beruf_begr` chains parent = berufung (1mo) + 2mo = 3mo
|
||||
from urteil. ZPO §520(2) anchors the 2-month Begründungsfrist on
|
||||
service of urteil, not on filing of Berufung.** New finding.
|
||||
★★★ — every DE-first-instance appellant.
|
||||
- 🟠 **`de.inf.lg.replik` + `.duplik` have `parent_id=NULL` so they fire
|
||||
on the trigger date (Klageerhebung) — sequence-order says 30/40 but
|
||||
the compute engine reads parent_id first.** Reported as live UI bug
|
||||
by m via head (2026-05-25 13:13); confirmed by SQL. ★★★ — every
|
||||
DE-LG-Verletzung timeline.
|
||||
|
||||
- **5 rule-code / citation drift bugs still live** from the May 8 audit
|
||||
(`upc.apl.merits.notice`, `.grounds`, `.response`, `upc.rev.cfi.reply`,
|
||||
`.rejoin`) — durations may or may not be right, but the cited
|
||||
`legal_source` / `rule_code` points at the wrong rule. Pure
|
||||
cosmetic on `.notice`/`.grounds` (durations are right); load-bearing on
|
||||
`.rev.cfi.reply` / `.rejoin` because the cited rule is what tells
|
||||
the lawyer where to look the rule up.
|
||||
|
||||
- **4 DPMA / DE citation bugs** new in this audit, all citing PatG / ZPO
|
||||
sections that don't contain the cited deadline:
|
||||
- `de.null.bpatg.erwidg` cites `DE.PatG.82.1`; the 2-month Erwiderung
|
||||
is actually `§82(3)` (§82(1) is the 1-month Erklärungsfrist).
|
||||
- `dpma.opp.dpma.erwiderung` cites `DE.PatG.59.3`; §59(3) is about
|
||||
hearings, not a 4-month proprietor response. The 4-month figure is
|
||||
DPMA-internal practice, not statutory — should be court-set.
|
||||
- `dpma.appeal.bpatg.begruendung` cites `DE.PatG.75.1`; §75 is about
|
||||
*aufschiebende Wirkung* — there is no Begründungsfrist in PatG §73-§80
|
||||
for the BPatG-Beschwerde. The 1-month figure is also non-statutory.
|
||||
- `de.null.bgh.begruendung` cites `DE.PatG.111.1`; §111 is about the
|
||||
grounds-of-appeal *content* (Verletzung des Bundesrechts), not the
|
||||
Begründungsfrist. `de.null.bgh.erwiderung` cites `DE.PatG.111.3`;
|
||||
§111(3) doesn't exist in the deadline sense.
|
||||
|
||||
- **Wide UPC coverage gap inherited from May 8 audit, mostly un-closed:**
|
||||
~25 missing UPC RoP rules. Mig 095 (t-paliad-205) closed 4 of them
|
||||
(R.19 Preliminary Objection on UPC_INF and UPC_REV, R.220.1(a)
|
||||
merits-appeal spawn on both). The other ~21 (R.20.2, R.118.4,
|
||||
R.197.3, R.198, R.207.6.a, R.207.9, R.213, R.109.1/.4/.5, R.118.5,
|
||||
R.144, R.155, R.224.2(b), R.229.2, R.235.2, R.245.x, R.262.2,
|
||||
R.321.3, R.333.2, R.353, plus the DNI family R.63-R.69) are
|
||||
unchanged.
|
||||
|
||||
- **EPC gaps:** EPA opposition + Beschwerde modelled at the
|
||||
Article level only. Missing the entire Implementing Regulations
|
||||
family that drives day-to-day deadlines — R.71(3) approval period
|
||||
is half-modelled (the 4-month figure is there but the trigger
|
||||
anchor is broken: parent_id=NULL), R.79(1) proprietor response
|
||||
is modelled as a fixed 4-month period when it's actually
|
||||
court-set, R.116 oral-proceedings cut-off is modelled as
|
||||
duration-0/parent-NULL (works for some uses, not for others),
|
||||
R.121 / R.135 Weiterbehandlung is missing entirely (concept
|
||||
exists but no rule).
|
||||
|
||||
- **DE/DPMA gaps:** the entire Wiedereinsetzung family (PatG §123)
|
||||
is absent on the proceeding-tree side. `weiterbehandlung` and
|
||||
`wiedereinsetzung` concept slugs exist in the cascade (Pathway B)
|
||||
but no `paliad.deadline_rules` row computes them. Same for
|
||||
`versaeumnisurteil-einspruch` (ZPO §339 — 2 weeks).
|
||||
|
||||
- **15 ambiguities** that need m's judgement, not a coder's fix —
|
||||
mostly around court-set vs statutory periods (e.g. richterliche
|
||||
Fristen under ZPO §276(1) S.2, §283 Schriftsatznachreichung,
|
||||
EPC R.79(1), §59(3) PatG) and around the "whichever is
|
||||
longer / later" arithmetic primitives still missing
|
||||
(R.198 / R.213 / R.245.2).
|
||||
|
||||
- **Recommended fixes (§10) — total 41 items** prioritised in 4
|
||||
tiers. Tier 0 (5 hard duration bugs + 1 sequencing bug + 9
|
||||
citation/anchor bugs) should ship first. Tier 1 (12 rule-fill
|
||||
gaps, ★★★ / ★★) next. Tier 2 + 3 are coverage breadth that
|
||||
needs scoping by m (Wiedereinsetzung, R.198 working-day
|
||||
arithmetic, full Implementing Regulations port).
|
||||
|
||||
---
|
||||
|
||||
## §1. Methodology
|
||||
|
||||
For each of the 20 active proceeding_types I:
|
||||
|
||||
1. **Pulled the live rule set** via `mcp__supabase__execute_sql` against
|
||||
the youpc Postgres on 2026-05-25 14:00–15:00 UTC. Schema = `paliad`.
|
||||
Filter: `is_active = true AND lifecycle_state = 'published'`.
|
||||
2. **Enumerated the statutory deadlines** in the relevant code for the
|
||||
proceeding's scope.
|
||||
3. **Cross-referenced each statutory deadline against the live rule
|
||||
set** on (a) duration + unit, (b) anchor / parent, (c) party,
|
||||
(d) `rule_code` / `legal_source` citation, (e) sequencing.
|
||||
4. **Marked status**: `present-correct`, `present-wrong (duration)`,
|
||||
`present-wrong (citation)`, `present-wrong (anchor)`,
|
||||
`present-wrong (party)`, `partial`, `missing`, `n/a`.
|
||||
5. **Frequency tag** for prioritisation: ★★★ every case, ★★ common,
|
||||
★ specialist.
|
||||
|
||||
### 1.1 Sources
|
||||
|
||||
All citations carry a date stamp and a URL. Where the text was checked
|
||||
against more than one source, both are listed.
|
||||
|
||||
| Source | URL | Verified on | Used for |
|
||||
|---|---|---|---|
|
||||
| UPC Rules of Procedure (consolidated 18.05.2023, in force 2023-06-01) | https://www.unifiedpatentcourt.org/sites/default/files/upc_documents/rop_application_-_consolidated_18_05_2023.pdf | 2026-05-25 | All UPC RoP citations |
|
||||
| UPC RoP verbatim text via `data.laws_contents` (youpc Postgres, law_type=`UPCRoP`, language=en) | youpc Supabase | 2026-05-25 | Cross-check on R.019.1, R.020.2, R.029.b/.c, R.049.1, R.051, R.051.p1, R.052, R.052.p1, R.220.1.a, R.224.1, R.224.1.a/.b, R.224.2, R.224.2.a/.b, R.235.1, R.235.2, R.237, R.238.1, R.238.2 |
|
||||
| European Patent Convention (EPC, 17th ed. 2020) — Articles | https://www.epo.org/en/legal/epc/2020/index.html (verbatim text per youpc `data.laws_contents`, law_type=`EPC`) | 2026-05-25 | EPC Articles 93, 99, 108, 112a, 116, 121, 123, 135 |
|
||||
| EPC Implementing Regulations — Rules (in force 2026 consolidated) | https://www.epo.org/en/legal/epc/2020/r71.html (and equivalents) | 2026-05-25 | EPC R.70(1), R.71(3), R.79(1)/(2), R.116(1), R.135 |
|
||||
| Patentgesetz (PatG) — gesetze-im-internet.de | https://www.gesetze-im-internet.de/patg/ | 2026-05-25 | §59, §73, §75, §82, §83, §99 ff., §100, §102, §110, §111 |
|
||||
| Zivilprozessordnung (ZPO) — gesetze-im-internet.de | https://www.gesetze-im-internet.de/zpo/ | 2026-05-25 | §253, §276, §277, §283, §296a, §339, §517, §520, §521, §524, §544, §548, §551, §554 |
|
||||
| Gebrauchsmustergesetz (GebrMG) — gesetze-im-internet.de | https://www.gesetze-im-internet.de/gebrmg/ | 2026-05-25 | §17 (Löschung), §18 (Verfahren) — referenced only to confirm out-of-scope: no GebrMG-rooted proceeding_type exists in paliad today |
|
||||
|
||||
### 1.2 Conventions
|
||||
|
||||
- A **rule** here means a row in `paliad.deadline_rules`. paliad's local
|
||||
identifier is `submission_code` (post mig 098), e.g.
|
||||
`upc.rev.cfi.defence`.
|
||||
- A **statutory deadline** means an obligation derived directly from the
|
||||
text of a procedural code, with a fixed period.
|
||||
- "**Court-set**" / "richterliche Frist" means the statute authorises the
|
||||
court / DPMA / EPO to set the period — there is no fixed statutory
|
||||
duration. paliad models these with `is_court_set = true`
|
||||
(post mig ~079) or, legacy-style, `duration_value = 0`.
|
||||
- "**Anchoring**" refers to which event the period runs from. paliad
|
||||
models this via `parent_id` (chain anchor) or `anchor_alt` (e.g.
|
||||
`priority_date`); a NULL parent_id with non-zero duration means the
|
||||
deadline runs from the user-supplied trigger date.
|
||||
|
||||
### 1.3 Hard constraint: "no fabricated provisions"
|
||||
|
||||
Where I'm not 100% sure of a citation (because the youpc law DB only
|
||||
covers UPC + EPC, not PatG / ZPO, and my web-fetch coverage of
|
||||
PatG / ZPO is partial), I flag the finding as **"needs lawyer review"**
|
||||
in §9 rather than asserting a fix. Five PatG / ZPO findings carry that
|
||||
tag.
|
||||
|
||||
---
|
||||
|
||||
## §2. Current state inventory (per jurisdiction)
|
||||
|
||||
### 2.1 UPC
|
||||
|
||||
9 active types, 67 rules. `upc.ccr.cfi` is an alias proceeding that
|
||||
holds zero rules — it points at `upc.inf.cfi` rules under the
|
||||
`with_ccr` flag.
|
||||
|
||||
| Code | Name | Rule count | Audited against |
|
||||
|---|---|---:|---|
|
||||
| `upc.inf.cfi` | Verletzungsverfahren | 15 | RoP 19, 23, 25, 29.a-e, 30, 32, 151, 220.1(a) |
|
||||
| `upc.rev.cfi` | Nichtigkeitsverfahren | 17 | RoP 19, 32, 42, 43.3, 49.1, 49.2.a, 49.2.b, 51, 52, 56.1/3/4, 220.1(a) |
|
||||
| `upc.pi.cfi` | Einstweilige Maßnahmen | 4 | RoP 205, 207, 211 |
|
||||
| `upc.disc.cfi` | Bucheinsicht | 4 | RoP 141, 142.2, 142.3 |
|
||||
| `upc.dmgs.cfi` | Schadensbemessung | 4 | RoP 131.2, 137.2, 139 |
|
||||
| `upc.apl.merits` | Berufung | 8 | RoP 220.1, 224.1.a, 224.2.a, 235.1, 237, 238.1 |
|
||||
| `upc.apl.order` | Berufung gegen Anordnungen | 5 | RoP 220.1(c), 220.2, 220.3, 237, 238.2 |
|
||||
| `upc.apl.cost` | Berufung gegen Kostenentscheidung | 2 | RoP 221.1 |
|
||||
| `upc.ccr.cfi` | Widerklage auf Nichtigkeit (alias) | 0 | — |
|
||||
|
||||
### 2.2 EPA
|
||||
|
||||
3 active types, 23 rules.
|
||||
|
||||
| Code | Name | Rule count | Audited against |
|
||||
|---|---|---:|---|
|
||||
| `epa.grant.exa` | EP-Erteilung | 7 | EPC Art. 93, R.70(1), R.71(3) |
|
||||
| `epa.opp.opd` | EPA Einspruch | 8 | EPC Art. 99(1), 108, 116, 123; R.79(1), R.79(2), R.116(1) |
|
||||
| `epa.opp.boa` | EPA Beschwerde | 8 | EPC Art. 108, 112a; R.116(1); RPBA Art. 12 |
|
||||
|
||||
### 2.3 DPMA
|
||||
|
||||
3 active types, 13 rules.
|
||||
|
||||
| Code | Name | Rule count | Audited against |
|
||||
|---|---|---:|---|
|
||||
| `dpma.opp.dpma` | DPMA Einspruch | 4 | PatG §59(1), §59(3) |
|
||||
| `dpma.appeal.bpatg` | BPatG-Beschwerde | 5 | PatG §73(2), §74 ff. |
|
||||
| `dpma.appeal.bgh` | BGH-Rechtsbeschwerde | 4 | PatG §100, §102 |
|
||||
|
||||
### 2.4 DE (national patent / civil)
|
||||
|
||||
5 active types, 29 rules.
|
||||
|
||||
| Code | Name | Rule count | Audited against |
|
||||
|---|---|---:|---|
|
||||
| `de.inf.lg` | LG-Verletzungsklage | 8 | ZPO §253, §276, §283, §296a, §517, §520(2) |
|
||||
| `de.inf.olg` | OLG-Berufung Verletzung | 7 | ZPO §517, §520(2), §521(2), §524(2) |
|
||||
| `de.inf.bgh` | BGH-Revision Verletzung | 8 | ZPO §544, §548, §551, §554 |
|
||||
| `de.null.bpatg` | BPatG-Nichtigkeitsklage | 10 | PatG §81 ff., §82, §83 |
|
||||
| `de.null.bgh` | BGH-Nichtigkeitsberufung | 6 | PatG §110, §111 / ZPO ref via §117 PatG |
|
||||
|
||||
### 2.5 Cross-cutting: cascade vs proceeding-tree coverage
|
||||
|
||||
The cascade layer (`paliad.event_categories` + `…_concepts` +
|
||||
`paliad.deadline_concepts`) carries 56 concept "nouns" and ~153
|
||||
cascade-leaf → concept mappings. **9 concepts are orphans** (carry
|
||||
zero rules, so the cascade card dead-ends): `counterclaim-for-revocation`,
|
||||
`schriftsatznachreichung`, `versaeumnisurteil-einspruch`,
|
||||
`weiterbehandlung`, `wiedereinsetzung`, `notice-of-defence-intention`,
|
||||
plus 3 more. Inventory and recommendations live in
|
||||
`docs/audit-fristen-logic-2026-05-13.md` §3.4 — this audit covers only
|
||||
the proceeding-tree side.
|
||||
|
||||
---
|
||||
|
||||
## §3. Findings — Missing rules (statute defines, paliad doesn't)
|
||||
|
||||
### 3.1 UPC RoP — 21 missing rules (out of ~25 flagged 2026-05-08, 4 closed by mig 095)
|
||||
|
||||
Notation: ★★★ every case, ★★ common, ★ specialist. Verbatim RoP text
|
||||
sampled from youpc `data.laws_contents` (law_type=`UPCRoP`, lang=en).
|
||||
|
||||
| RoP § | Period | Trigger | Freq | Notes |
|
||||
|---|---|---|---|---|
|
||||
| **R.20.2** | 14 days | Service of Preliminary Objection | ★ | Reply to PO. Companion to R.19 (which mig 095 added). Without R.20.2 the PO branch is half-modelled. |
|
||||
| **R.118.4** | 2 months | Final decision on validity served | ★★ | Application for orders consequential on validity. Common after central-division revocation. |
|
||||
| **R.118.5** | n/a UPC | n/a | n/a | UPC has no Versäumnisurteil-Einspruch; closest is R.355 (review of contumacy). |
|
||||
| **R.144** | 0 (anchor) | Final decision on damages quantum | ★ | UPC_DAMAGES tree end-row missing. |
|
||||
| **R.155** | 1mo / 14d | Cost-decision opposition chain | ★ | UPC_COST_APPEAL only has the leave-to-appeal step; no Defence-to-cost-app row. |
|
||||
| **R.197.3** | 30 days | Saisie order served on respondent | ★ | Review application. Trigger event 65 exists; no rule attached. |
|
||||
| **R.198** | 31 calendar days **OR 20 working days, whichever is longer** | Saisie executed | ★ | Start proceedings on the merits. Blocked on `working_days` + `combine='max'` primitives (see §7 + §9). |
|
||||
| **R.207.6.a** | 14 days | Notification of deficiency in PI application | ★★ | Registry correction. |
|
||||
| **R.207.9** | 6 months | PI filed | ★ | Renewal of protective letter. |
|
||||
| **R.213** | 31 days OR 20 working days | PI granted | ★★ | Same arithmetic gap as R.198. |
|
||||
| **R.109.1** | 1 month **before** | Oral hearing date | ★★ | Simultaneous translation request. `timing='before'` schema supported but no rule populates it (see §7 cross-cutting). |
|
||||
| **R.109.4** | 2 weeks **before** | Oral hearing date | ★★ | Interpreter cost notification. `timing='before'`. |
|
||||
| **R.109.5** | 2 weeks after | Order of judge-rapporteur to lodge translations | ★★ | trigger event 113 exists; no rule. |
|
||||
| **R.224.2.b** | 15 days | Order under R.220.1(c) or decision under R.220.2/221.3 served | ★★ | Grounds-on-orders track. `upc.apl.order` has appeal-itself but no separate grounds row. Verified verbatim against `UPCRoP.224.2.b` (youpc DB). |
|
||||
| **R.229.2** | 14 days | Notification of appeal-deficiency | ★ | Registry correction in appeal context. |
|
||||
| **R.235.2** | 15 days | Statement of grounds (orders track) served | ★★ | Verified verbatim against `UPCRoP.235.2` (youpc DB): *"Within 15 days of service of grounds of appeal pursuant to Rule 224.2(b), any other party … may lodge a Statement of response"*. `upc.apl.order` has no standalone response row. |
|
||||
| **R.245.1** | 2 months | Final decision served | ★ | Application for rehearing. |
|
||||
| **R.245.2.a** | 2 months | Discovery of fundamental defect (or final decision service, whichever is later) | ★ | Outer cap 12mo. Needs multi-anchor + `max-of-two-anchors` arithmetic. |
|
||||
| **R.245.2.b** | 2 months | Discovery of criminal offence (or final decision service, whichever is later) | ★ | Same shape as 245.2.a. |
|
||||
| **R.262.2** | 14 days | Receipt of opposing party's confidentiality application | ★★ | Daily occurrence in HLC infringement work. Trigger event 25 exists; no rule. |
|
||||
| **R.320** | 2 months (cap 12 mo) | Wegfall des Hindernisses (Wiedereinsetzung) | ★★ | Cascade card exists (mig 063) but no proceeding-tree rule computes the deadline. Bridges proceedings → no obvious home in any one tree. |
|
||||
| **R.321.3** | 10 days | Preliminary objection referral to central division | ★ | |
|
||||
| **R.333.2** | 15 days | Case-management order served | ★★ | Review-of-CMO. Routine in busy LDs. |
|
||||
| **R.353** | 1 month | Decision / order delivered | ★ | Rectification application. |
|
||||
| **DNI: R.63 / R.67.1 / R.69.1 / R.69.2** | 0 / 2mo / 1mo / 1mo | DNI cascade | ★ | No UPC_DNI proceeding_type exists. Fringe at HLC (zero published filings in 2026-Q1 per May 8 audit). |
|
||||
| **Registry-correction family: R.16.3.a, R.27.2, R.89.2, R.253.2** | 14 days each | Various deficiency notifications | ★ | All same 14-day duration; different trigger codes. Most natural home is cascade not proceeding-tree (see audit-fristenrechner-completeness-2026-04-30.md §3.1). |
|
||||
|
||||
**Closed since May 8 audit (verified by SQL):**
|
||||
- ✅ R.19 Preliminary Objection on UPC_INF — `upc.inf.cfi.prelim`, 1mo, RoP.019.1, flag-gated `with_po` — mig 095.
|
||||
- ✅ R.19 Preliminary Objection on UPC_REV — `upc.rev.cfi.prelim`, 1mo, RoP.019.1, flag-gated `with_po` — mig 095 (cites R.19 i.V.m. R.46).
|
||||
- ✅ R.220.1(a) merits-appeal spawn on UPC_INF — `upc.inf.cfi.appeal_spawn`, 2mo, is_spawn=true → upc.apl.merits — mig 095.
|
||||
- ✅ R.220.1(a) merits-appeal spawn on UPC_REV — `upc.rev.cfi.appeal_spawn`, 2mo, is_spawn=true → upc.apl.merits — mig 095.
|
||||
|
||||
### 3.2 EPC Implementing Regulations — 4 missing rules
|
||||
|
||||
| EPC ref | Period | Trigger | Freq | Notes |
|
||||
|---|---|---|---|---|
|
||||
| **EPC R.135 (Weiterbehandlung)** | 2 months | Notification of loss of rights | ★★ | Concept `weiterbehandlung` exists in cascade (orphan); no rule. Applies broadly across `epa.grant.exa` and `epa.opp.opd`. |
|
||||
| **EPC R.99(2) / Art. 121** | 2 months | Loss-of-rights notification (further processing) | ★★ | Same family as R.135. |
|
||||
| **EPC Art. 112a(4)** | 2 months / 1 month | Discovery of grounds for review / decision served (whichever later) | ★ | paliad has `epa.opp.boa.r106` (2 months, parent=entsch2) — but the rule doesn't model the "whichever later" outer cap (12 months from decision per Art. 112a(4)). |
|
||||
| **EPC Art. 99(1) — opposition fee paid** | 9 months (no extension) | Mention of grant in Patentblatt | ★★★ | `epa.opp.opd.frist` IS modelled correctly at 9 months. **Note however:** the rule is on `epa.opp.opd` but the *trigger* is opposition-fee-paid (per Art. 99(1) S.2 — "Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid"). Not a gap, but a documentation note. |
|
||||
|
||||
### 3.3 PatG / ZPO — 5 missing rules
|
||||
|
||||
| Citation | Period | Trigger | Freq | Notes |
|
||||
|---|---|---|---|---|
|
||||
| **PatG §123 (Wiedereinsetzung)** | 2 months | Wegfall des Hindernisses (cap 1 year) | ★★ | Cascade concept `wiedereinsetzung` exists; no rule on any DE/DPMA proceeding tree. Same modelling problem as UPC R.320 — bridges proceedings. |
|
||||
| **ZPO §339 (Versäumnisurteil-Einspruch)** | 2 weeks | Service of default judgment | ★ | Cascade concept `versaeumnisurteil-einspruch` orphan. |
|
||||
| **ZPO §544 — Nichtzulassungsbeschwerde-Begründung** | 2 months | Service of OLG-Urteil (NB: NOT from filing of NZB) | ★★ | `de.inf.bgh.nzb_begr` lists `DE.ZPO.544.4`, duration 2mo, parent=urteil_olg — **modelled correctly**. Listed here only to flag that the *parent anchoring* differs from `de.inf.lg.beruf_begr` which is wrong (see §7.1). |
|
||||
| **ZPO §283 (Schriftsatznachreichung) / §296a** | court-set | post-Verhandlung schriftsatzfrist | ★ | Cascade concept `schriftsatznachreichung` orphan. Court-set period — modelling as `is_court_set=true, duration=0` would suffice. |
|
||||
| **PatG §17(2) GebrMG / §18 GebrMG** | 1 month (Beschwerdefrist) | DPMA-Beschluss | ★ | Out of scope per head's confirmation (no GebrMG-rooted proceeding_type yet). Listed to confirm the deliberate gap. |
|
||||
|
||||
### 3.4 DPMA — 0 missing rules
|
||||
|
||||
DPMA coverage is shallow but not gappy. The 3 active types (opposition,
|
||||
BPatG-Beschwerde, BGH-Rechtsbeschwerde) cover the statutory steps. The
|
||||
problems here are **citation drift** (§4.4) and **anchor modeling**
|
||||
(§7.4) rather than missing rules.
|
||||
|
||||
---
|
||||
|
||||
## §4. Findings — Misattributed legal source
|
||||
|
||||
### 4.1 UPC RoP citation drift (5 still live from May 8)
|
||||
|
||||
| Rule | Live `rule_code` | Live `legal_source` | Should be | Source verified |
|
||||
|---|---|---|---|---|
|
||||
| `upc.apl.merits.notice` | `RoP.220.1` | `UPC.RoP.220.1` | `RoP.224.1.a` / `UPC.RoP.224.1.a` | `UPCRoP.224.1.a` youpc DB |
|
||||
| `upc.apl.merits.grounds` | `RoP.220.1` | `UPC.RoP.220.1` | `RoP.224.2.a` / `UPC.RoP.224.2.a` | `UPCRoP.224.2.a` |
|
||||
| `upc.apl.merits.response` | `null` | `null` | `RoP.235.1` / `UPC.RoP.235.1` | `UPCRoP.235.1` |
|
||||
| `upc.rev.cfi.reply` | `null` | `null` | `RoP.051` / `UPC.RoP.51.p1` | `UPCRoP.051.p1` |
|
||||
| `upc.rev.cfi.rejoin` | `null` | `null` | `RoP.052` / `UPC.RoP.52.p1` | `UPCRoP.052.p1` |
|
||||
|
||||
Note on cascade vs proceeding-tree drift on R.220.3 anchoring is in
|
||||
`docs/audit-upc-rop-deadlines-2026-05-08.md` §5.4b — unchanged here.
|
||||
|
||||
### 4.2 UPC RoP citation drift on Rule 49.1 format (1 still live)
|
||||
|
||||
| Rule | Live `rule_code` | Should be |
|
||||
|---|---|---|
|
||||
| `upc.rev.cfi.defence` | `RoP.49.1` | `RoP.049.1` (canonical zero-padded form used by all other UPC rules) |
|
||||
|
||||
### 4.3 DPMA — 3 mis-attributed citations
|
||||
|
||||
| Rule | Live citation | Problem | Verified |
|
||||
|---|---|---|---|
|
||||
| `dpma.opp.dpma.erwiderung` | `§ 59 PatG` / `DE.PatG.59.3` | §59(3) PatG addresses *Anhörung*, not a 4-month response period. No statutory Erwiderungsfrist exists in §59. The 4-month figure is DPMA-internal practice. | WebFetch [gesetze-im-internet.de/patg/__59.html](https://www.gesetze-im-internet.de/patg/__59.html) 2026-05-25 |
|
||||
| `dpma.appeal.bpatg.begruendung` | `§ 75 PatG` / `DE.PatG.75.1` | §75 PatG is exclusively about *aufschiebende Wirkung* (suspensive effect). It does not establish any Begründungsfrist. No fixed Begründungsfrist for BPatG-Beschwerde exists in PatG §§73-80 — it is set by the BPatG in the individual case. | WebFetch [gesetze-im-internet.de/patg/__75.html](https://www.gesetze-im-internet.de/patg/__75.html) + [§73](https://www.gesetze-im-internet.de/patg/__73.html) 2026-05-25 |
|
||||
| `dpma.appeal.bpatg.beschwerde` | `§ 73 PatG` / `DE.PatG.73.2` | §73 contains the 1-month deadline correctly; the `.2` subscript however refers to §73(2) which is about Beschwerdebefugnis — the *Frist* is in §73(2) S.4 ("Die Beschwerdefrist beträgt einen Monat …"). Citation should be `DE.PatG.73.2.s4` or simply `DE.PatG.73.2`. **Borderline — flag, not a hard bug.** | gesetze-im-internet.de |
|
||||
|
||||
### 4.4 DE patent / civil — 4 mis-attributed citations
|
||||
|
||||
| Rule | Live citation | Problem | Verified |
|
||||
|---|---|---|---|
|
||||
| `de.null.bpatg.erwidg` | `§ 82 PatG` / `DE.PatG.82.1` | §82(1) is the 1-month *Erklärungsfrist* ("sich darüber zu erklären"); the 2-month full *Klageerwiderung* is in §82(3). Citation should be `DE.PatG.82.3`. Duration (2 months) is correct. | WebFetch [§82](https://www.gesetze-im-internet.de/patg/__82.html) 2026-05-25 |
|
||||
| `de.null.bpatg.replik_klaeger` | `§ 83 PatG` / `DE.PatG.83.2` | §83(2) is about the *Hinweisbeschluss* form; the Replik / Schriftsatz windows fall under §83(2) S.3 (Reaktion auf Hinweis). Citation OK at section level but ambiguous. **Borderline — flag, not a hard bug.** | gesetze-im-internet.de |
|
||||
| `de.null.bgh.begruendung` | `§ 111 PatG` / `DE.PatG.111.1` | §111 PatG defines the *Grounds* of Berufung (Verletzung des Bundesrechts), not a Begründungsfrist. The 3-month figure is supplied via §117 PatG → ZPO §520(2). Citation should be `DE.ZPO.520.2` (the actual time-limit source). | WebFetch [§111](https://www.gesetze-im-internet.de/patg/__111.html) 2026-05-25 |
|
||||
| `de.null.bgh.erwiderung` | `§ 111 PatG` / `DE.PatG.111.3` | §111 has no Erwiderungsfrist clause. The actual Erwiderungsfrist for BGH-Nichtigkeitsberufung is set by the court per §117 PatG → ZPO §521(2) (court-discretionary). Duration (2 months) is approximate — typical court-set period is 2 months but it's not fixed. **Should be modelled as court-set.** | WebFetch [§111](https://www.gesetze-im-internet.de/patg/__111.html) + ZPO §521 2026-05-25 |
|
||||
|
||||
### 4.5 EPA — 1 mis-attributed citation
|
||||
|
||||
| Rule | Live citation | Problem |
|
||||
|---|---|---|
|
||||
| `epa.opp.opd.erwidg` | `R. 79(1) EPÜ` / `EU.EPC-R.79.1` | Duration (4 months) is correct as the *typical* EPO-set period under the 2016 streamlined-opposition guidelines, but **R.79(1) does not specify a fixed period** — the Opposition Division sets it. The 4 months is administrative practice (EPO Guidelines D-IV, 5.2). Should be modelled as court-set with 4 months as the default-display value. |
|
||||
|
||||
---
|
||||
|
||||
## §5. Findings — Wrong period (statute says X, paliad says Y)
|
||||
|
||||
| Rule | Live period | Statutory period | Source | Freq |
|
||||
|---|---|---|---|---|
|
||||
| **`upc.rev.cfi.defence`** | 3 months | **2 months** | RoP.049.1: *"The defendant shall lodge a Defence to revocation within two months of service of the Statement for revocation."* — verified verbatim from `UPCRoP.049.1` (youpc DB). Flagged 2026-05-08; still live. | ★★★ |
|
||||
| **`upc.rev.cfi.rejoin`** | 2 months | **1 month** | RoP.052: *"Within one month of the service of the Reply the defendant may lodge a Rejoinder to the Reply to the Defence to revocation"* — verified verbatim from `UPCRoP.052.p1`. Flagged 2026-05-08; still live. | ★★★ |
|
||||
| **`upc.apl.merits.response`** | 2 months | **3 months** | RoP.235.1: *"Within three months of service of the Statement of grounds of appeal pursuant to Rule 224.2(a), any other party … may lodge a Statement of response"* — verified verbatim from `UPCRoP.235.1`. New finding — May 8 audit recorded the duration as 3 months but the live row has always been 2 (migration 012:153 originally seeded 2). | ★★★ |
|
||||
| **`upc.pi.cfi.response`** | 0 / "court-set" (`is_court_set=false`, `duration=0`, `parent_id=NULL`) | court-set, judge-discretion under R.211.2 | RoP.211.2 — judge sets the inter-partes hearing date. Modelling is half-broken: `duration=0` with `parent_id=NULL` makes the calculator treat this as a root anchor rather than a court-set placeholder. Should set `is_court_set=true` and chain `parent_id=app`. | ★★ |
|
||||
|
||||
(All other rules audited have correct durations.)
|
||||
|
||||
---
|
||||
|
||||
## §6. Findings — Wrong party
|
||||
|
||||
No clear party mis-assignments found in the live data. Two notes worth
|
||||
recording, not bugs:
|
||||
|
||||
- `upc.inf.cfi.app_to_amend` carries `primary_party='claimant'`. The
|
||||
defendant in an INF case is the alleged infringer; the patent
|
||||
proprietor (=claimant) is who would file an Application to Amend
|
||||
the patent. **Correct.** Listed here only because R.30 reads "the
|
||||
defendant" in some summaries — those refer to the claimant of the
|
||||
CCR (= defendant of the INF), which loops back to the same person
|
||||
who is the INF-claimant / patent-proprietor.
|
||||
- `dpma.opp.dpma.erwiderung` carries `primary_party='defendant'`. In an
|
||||
EPA-style opposition, the patent proprietor is the "defendant" of the
|
||||
opposition. Consistent with EPA convention. **Correct.**
|
||||
|
||||
---
|
||||
|
||||
## §7. Findings — Wrong sequencing / anchoring
|
||||
|
||||
### 7.1 `de.inf.lg.beruf_begr` chains parent = `berufung`, should anchor on `urteil` directly
|
||||
|
||||
| Live | Per ZPO §520(2) |
|
||||
|---|---|
|
||||
| `de.inf.lg.beruf_begr.parent_id = de.inf.lg.berufung`, `duration = 2 months` → effective end = trigger + 1mo (Berufung) + 2mo = **3 months** after Urteil service | "Die Frist für die Berufungsbegründung beträgt zwei Monate. Sie beginnt mit der Zustellung des in vollständiger Form abgefassten Urteils" → **2 months** after Urteil service |
|
||||
|
||||
Verified verbatim via WebFetch
|
||||
[gesetze-im-internet.de/zpo/__520.html](https://www.gesetze-im-internet.de/zpo/__520.html)
|
||||
2026-05-25.
|
||||
|
||||
The companion `de.inf.olg.begruendung` is **correct** — parent =
|
||||
`urteil_lg`, 2mo, so end = Urteil + 2mo. Same statute, two paliad
|
||||
rules, two different anchorings: this is a real bug in `de.inf.lg`.
|
||||
|
||||
### 7.2 `de.inf.lg.replik` and `de.inf.lg.duplik` have `parent_id = NULL`
|
||||
|
||||
This is the bug head flagged. Live data:
|
||||
|
||||
| submission_code | name | duration | parent_id | sequence_order |
|
||||
|---|---|---|---|---|
|
||||
| `de.inf.lg.klage` | Klageerhebung | 0 mo | NULL | 0 |
|
||||
| `de.inf.lg.anzeige` | Anzeige Verteidigungsbereitschaft | 2 wk | `de.inf.lg.klage` | 10 |
|
||||
| `de.inf.lg.erwidg` | Klageerwiderung | 6 wk | `de.inf.lg.klage` (court-set=true post mig 095) | 20 |
|
||||
| **`de.inf.lg.replik`** | Replik | **4 wk** | **NULL** | 30 |
|
||||
| **`de.inf.lg.duplik`** | Duplik | **4 wk** | **NULL** | 40 |
|
||||
| `de.inf.lg.termin` | Haupttermin | 0 mo | NULL (court-set) | 50 |
|
||||
| `de.inf.lg.urteil` | Urteil | 0 mo | NULL (court-set) | 60 |
|
||||
| `de.inf.lg.berufung` | Berufungsfrist | 1 mo | NULL | 70 |
|
||||
| `de.inf.lg.beruf_begr` | Berufungsbegründung | 2 mo | `de.inf.lg.berufung` | 80 |
|
||||
|
||||
With `parent_id = NULL` the calculator anchors Replik on the
|
||||
triggerDate (= Klageerhebung), and same for Duplik. So both render
|
||||
"4 Wochen ab Klageerhebung" — i.e. before the Klageerwiderung is
|
||||
even due. Correct chain should be:
|
||||
|
||||
- `replik.parent_id = de.inf.lg.erwidg`, with `is_court_set = true` (richterliche Frist § 276(1) S.2 / § 283 ZPO — typ. 4 weeks default)
|
||||
- `duplik.parent_id = de.inf.lg.replik`, same shape
|
||||
|
||||
Both rules lack `legal_source` and `rule_code`, which is consistent
|
||||
with them being court-set Schriftsatzfristen (no statutory clamp).
|
||||
Recommendation in §10.
|
||||
|
||||
### 7.3 `upc.apl.merits.grounds` has `parent_id = NULL`
|
||||
|
||||
This anchors Grounds on the user-supplied trigger date (=Entscheidung
|
||||
service). **Correct** behaviour per RoP.224.2.a: *"within four months
|
||||
of service of a decision referred to in Rule 220.1(a) and (b)"*.
|
||||
|
||||
If `parent_id` were set to `upc.apl.merits.notice` (as the May 8 audit
|
||||
hypothesised), the chain would compound (1-day notice + 4mo grounds =
|
||||
~4mo + 1 day), accidentally landing near the right end-date for the
|
||||
common case but wrong by up to 2 months in the edge case (when notice
|
||||
is filed early). **No fix needed; document the intent.** (This is
|
||||
the change the May 8 audit recommended; it was applied in mig 097 or
|
||||
earlier.)
|
||||
|
||||
### 7.4 DPMA Pathway-A anchors are partially modelled
|
||||
|
||||
- `dpma.appeal.bgh.begruendung` chains parent = `rechtsbeschwerde`
|
||||
(1mo + 1mo = 2mo from BPatG-Entscheidung). Per PatG §102 the
|
||||
Rechtsbeschwerdebegründungsfrist is 1 month from filing of the
|
||||
Rechtsbeschwerde — **correct**.
|
||||
- `dpma.appeal.bpatg.begruendung` chains parent = `beschwerde`
|
||||
(1mo + 1mo = 2mo from DPMA-Entscheidung). **No statutory basis for
|
||||
the 1-month figure** (see §4.3). Should be court-set.
|
||||
|
||||
### 7.5 EPA grant timeline — `epa.grant.exa.r71_3` and `.approval` have `parent_id = NULL`
|
||||
|
||||
Live:
|
||||
|
||||
| Rule | Duration | parent_id | Issue |
|
||||
|---|---|---|---|
|
||||
| `epa.grant.exa.r71_3` | 0 mo | NULL | Should chain on `exam_req` (after examination request is granted, EPO issues R.71(3) communication). NULL parent + 0 duration = root anchor at trigger date — works only if user enters the R.71(3) date as trigger; doesn't compose with the rest of the tree. |
|
||||
| `epa.grant.exa.approval` | 4 mo | NULL | Per R.71(3) approval period: 4 months from notification. **Anchor should be `r71_3`**, not NULL. As-is, "Zustimmung + Übersetzung" appears as a free-standing 4-mo-from-trigger row that has nothing to do with the rest of the timeline. |
|
||||
|
||||
### 7.6 Summary
|
||||
|
||||
| # | Rule | Bug |
|
||||
|---|---|---|
|
||||
| 1 | `de.inf.lg.beruf_begr` | parent should be NULL (anchored on Urteil-trigger) not `berufung` — off by 1 month, ★★★ |
|
||||
| 2 | `de.inf.lg.replik` | parent should be `erwidg` not NULL, ★★★ |
|
||||
| 3 | `de.inf.lg.duplik` | parent should be `replik` not NULL, ★★★ |
|
||||
| 4 | `dpma.appeal.bpatg.begruendung` | should be court-set; current 1-month period has no statutory basis, ★★ |
|
||||
| 5 | `dpma.appeal.bpatg.beschwerde` parent is `entscheidung` — OK, just a citation issue (§4.3) | (citation only) |
|
||||
| 6 | `epa.grant.exa.r71_3` parent | should chain on `exam_req`, ★ |
|
||||
| 7 | `epa.grant.exa.approval` parent | should chain on `r71_3`, ★ |
|
||||
| 8 | `upc.pi.cfi.response` | court-set placeholder with `parent_id=NULL` and `is_court_set=false` — should chain on `app` with `is_court_set=true`, ★★ |
|
||||
|
||||
---
|
||||
|
||||
## §8. Findings — Duplicates
|
||||
|
||||
No genuine duplicates. The closest cases:
|
||||
|
||||
- `upc.inf.cfi.reply` + `upc.inf.cfi.def_to_ccr` both fire at 2mo after
|
||||
`sod` under `with_ccr`. They cover different actions (Reply to SoD
|
||||
vs. Defence to CCR + Reply to SoD combined) per RoP.029.a vs .b.
|
||||
**Not a duplicate** — distinct rule codes.
|
||||
- `upc.rev.cfi.reply` (2mo, no rule_code) and the older `REV.rev_reply`
|
||||
on the archived litigation type — the archived type is hidden
|
||||
(`pt.is_active = false`) so this isn't a duplicate the user sees.
|
||||
Recommendation in §10 to drop the archived corpus once mig 093's
|
||||
audit window closes.
|
||||
- `epa.opp.boa.r106` (Art. 112a review) appears only on
|
||||
`epa.opp.boa`, not on `epa.opp.opd` — correct, since Art. 112a
|
||||
review is only available against a Boards-of-Appeal decision.
|
||||
|
||||
---
|
||||
|
||||
## §9. Ambiguities — decisions m needs to make
|
||||
|
||||
These are not bugs the coder can fix. They are judgement calls about
|
||||
how to model the law.
|
||||
|
||||
### 9.1 Court-set vs fixed-period for richterliche Fristen
|
||||
|
||||
The cleanest source-of-truth for these is "no statutory duration —
|
||||
court sets the period in the individual case." Modelling them as a
|
||||
fixed period with a wrong citation is the bug pattern we keep finding:
|
||||
|
||||
- `dpma.opp.dpma.erwiderung` (4 mo) — DPMA practice, not §59 PatG.
|
||||
- `dpma.appeal.bpatg.begruendung` (1 mo) — no statutory basis.
|
||||
- `de.inf.olg.erwiderung` (1 mo, §521(2)) — §521(2) is explicitly
|
||||
discretionary ("Der Vorsitzende oder das Berufungsgericht **kann**
|
||||
der Gegenpartei eine Frist … bestimmen"). Verified WebFetch
|
||||
[gesetze-im-internet.de/zpo/__521.html](https://www.gesetze-im-internet.de/zpo/__521.html)
|
||||
2026-05-25.
|
||||
- `de.null.bgh.erwiderung` (2 mo, "§111(3) PatG") — court-set per §117
|
||||
PatG → ZPO §521(2).
|
||||
- `de.null.bpatg.duplik` (1 mo, §83 PatG) — court-set; the 1-month
|
||||
default is BPatG practice.
|
||||
- `de.inf.lg.replik`, `.duplik` (4 wk each) — court-set per
|
||||
§283 / §296a ZPO + §276(1) S.2.
|
||||
- `epa.opp.opd.erwidg` (4 mo, "R.79(1)") — EPO-set per Guidelines.
|
||||
|
||||
**Question (Q1):** Should paliad continue to display these with a
|
||||
default duration but flag them as "richterliche Frist — vom Gericht
|
||||
festgesetzt", OR should they all flip to `is_court_set=true,
|
||||
duration=0` and force the user to enter the actual court-set date?
|
||||
|
||||
Head's 2026-05-25 13:13 signal confirms: m's preference is that "Frist
|
||||
vom Gericht bestimmt" be flagged as needing case-by-case anchoring,
|
||||
not displayed as a fixed period. So default answer = flip to
|
||||
`is_court_set=true` and keep the typical period as the *Default*
|
||||
display value (the calculator already supports this since the
|
||||
mig 095 / `de.inf.lg.erwidg` patch). But the trade-off is a UX
|
||||
regression: most users will not enter the actual court-set date
|
||||
and the timeline will then show "vom Gericht bestimmt" everywhere.
|
||||
|
||||
### 9.2 R.198 / R.213 "31 days OR 20 working days, whichever is longer"
|
||||
|
||||
Two RoP rules need a primitive paliad doesn't have:
|
||||
- A `working_days` duration unit (counts business-day arithmetic via
|
||||
the holiday service).
|
||||
- A `combine = 'max'` operator that compares two durations and picks
|
||||
the later end-date.
|
||||
|
||||
**Question (Q2):** Implement the primitive (~120 LoC migration + ~80 LoC
|
||||
Go), or document both rules as "manual calculation required, see RoP"
|
||||
in the UI? Real R.198 / R.213 cases are rare (saisie + PI). The May 8
|
||||
audit suggested deferring; pauli's 2026-05-13 audit §7.1 made the
|
||||
case for adding `combine_op` as part of a broader Pipeline A/C merge.
|
||||
|
||||
### 9.3 R.245.2 rehearing "whichever is later" trigger
|
||||
|
||||
R.245.2.a/b: deadline 2 months from final decision OR from defect
|
||||
discovery, whichever is *later*. Plus outer cap 12 months. Needs:
|
||||
|
||||
- Multi-anchor trigger event (user supplies 2 dates).
|
||||
- `combine = 'max'` between anchors.
|
||||
- Outer-cap arithmetic (separate concept from duration).
|
||||
|
||||
**Question (Q3):** Defer (specialist, vanishingly rare) or build the
|
||||
primitives?
|
||||
|
||||
### 9.4 EPC Art. 112a review — outer cap
|
||||
|
||||
Same shape as R.245.2: 2 months from defect discovery, outer cap 12
|
||||
months from decision. `epa.opp.boa.r106` models the 2-month period
|
||||
but not the cap.
|
||||
|
||||
### 9.5 PatG §123 Wiedereinsetzung calendar arithmetic
|
||||
|
||||
Cascade card (slug `wiedereinsetzung`) exists. The 2mo / 1-year
|
||||
arithmetic anchors on the *missed* deadline, not on a forward-looking
|
||||
event. paliad's `paliad.deadline_rules` schema has no natural shape
|
||||
for this — it would need either a special-case Go helper, or a
|
||||
"backward-from-missed-deadline" mode that no rule today uses.
|
||||
|
||||
**Question (Q4):** Worth modelling? The cascade card already routes
|
||||
the user to the concept; computing the calendar deadline is an
|
||||
incremental win.
|
||||
|
||||
### 9.6 ZPO §339 Versäumnisurteil-Einspruch
|
||||
|
||||
Cascade card orphan. 2 weeks from service of the default judgment.
|
||||
Trivial to add as a `de.inf.lg.einspruch_vu` rule (court-decision
|
||||
anchor + 2wk fixed). **Question (Q5):** Add as a child of
|
||||
`de.inf.lg.urteil` (with `condition_expr={"flag":"with_vu"}`), or
|
||||
as a separate proceeding `de.inf.lg.vu`?
|
||||
|
||||
### 9.7 Litigation-vs-fristenrechner archived corpus
|
||||
|
||||
The 40 rules on `_archived_litigation` (mig 093 retirement holding pen)
|
||||
still occupy the rule table. They're invisible to all UIs.
|
||||
|
||||
**Question (Q6):** Drop them now (data clean-up), or keep until the
|
||||
mig 093 audit window closes formally?
|
||||
|
||||
### 9.8 R.79(2) further-party observations period
|
||||
|
||||
EPC R.79(2) creates a separate notification window for additional
|
||||
opponents. paliad's `epa.opp.opd.r79_further` is modelled as
|
||||
`duration=0, is_bilateral=true`. **Question (Q7):** Is this even worth
|
||||
keeping? Real workflow: EPO sets a separate period in each
|
||||
intervention case. Hard to template.
|
||||
|
||||
### 9.9 R.116(1) EPC oral-proceedings cut-off
|
||||
|
||||
paliad has it as `duration=0, parent_id=entsch` (`epa.opp.opd.r116`) /
|
||||
`parent_id=oral` (`epa.opp.boa.r116`). R.116(1) actually says the
|
||||
EPO sets a "final date for making written submissions" when issuing
|
||||
the summons. So it's a court-set period, not zero-duration.
|
||||
**Question (Q8):** flip to `is_court_set=true` like the §276(1) ZPO
|
||||
fix in mig 095?
|
||||
|
||||
### 9.10 R.131.2 indication of damages period
|
||||
|
||||
paliad models `upc.dmgs.cfi.app` as a 0-duration root anchor (court
|
||||
sets when the damages-determination phase opens, per R.131.2). This
|
||||
is correct shape but means the entire damages tree is unanchored
|
||||
until the user provides the trigger date manually.
|
||||
|
||||
**Question (Q9):** Wire `is_spawn` from `upc.inf.cfi.decision` to
|
||||
`upc.dmgs.cfi.app` (parallel to the mig-095 appeal-spawn)?
|
||||
|
||||
### 9.11 PatG §17 GebrMG / §18 GebrMG
|
||||
|
||||
No GebrMG-rooted proceeding_type exists in paliad. Head confirmed
|
||||
out-of-scope for this audit. **Question (Q10):** Add a `de.gm.lg`
|
||||
proceeding for GebrMG-Löschungsverfahren if HLC sees them?
|
||||
|
||||
### 9.12 Proceeding-tree vs cascade parity
|
||||
|
||||
paliad has 9 cascade-only concepts with `rule_count = 0` (the orphans
|
||||
listed in `audit-fristen-logic-2026-05-13.md` §3.4). The audit-fristen
|
||||
audit covers this; restating here only to note that the parity gap
|
||||
is the largest single source of "the cascade card promises a
|
||||
calculation but doesn't deliver one."
|
||||
|
||||
**Question (Q11):** Same as the audit-fristen Q8 — priority order
|
||||
for the 9 orphan concepts? My ranking: wiedereinsetzung >
|
||||
schriftsatznachreichung > versäumnisurteil-einspruch >
|
||||
weiterbehandlung > rest.
|
||||
|
||||
### 9.13 R.220.3 anchor
|
||||
|
||||
See `audit-upc-rop-deadlines-2026-05-08.md` §5.4b. paliad anchors
|
||||
`upc.apl.order.discretion` on the original order (`order`), but
|
||||
the 15-day clock per RoP.220.3 runs from the refusal-of-leave
|
||||
date (or day-15 fall-back). Off by up to 15 days in the edge case.
|
||||
**Question (Q12):** add an explicit `app_ord.refusal` court-set
|
||||
intermediate node?
|
||||
|
||||
### 9.14 EP_GRANT publish date — priority vs filing
|
||||
|
||||
`epa.grant.exa.publish` correctly has `anchor_alt='priority_date'`.
|
||||
This was open in the May 8 audit and is now closed. **No question —
|
||||
listed to confirm.**
|
||||
|
||||
### 9.15 Cross-proceeding spawn execution
|
||||
|
||||
mig 095 added two `is_spawn=true` rules (`inf.appeal_spawn`,
|
||||
`rev.appeal_spawn` → `upc.apl.merits`). The May 13 audit §1.6 +
|
||||
§6.8 noted spawn execution is half-wired in `projection_service.go`.
|
||||
**Question (Q13):** wire end-to-end now (so the spawned appeal
|
||||
timeline appears in SmartTimeline), or accept the half-wired state?
|
||||
|
||||
---
|
||||
|
||||
## §10. Recommended fixes (prioritised)
|
||||
|
||||
### Tier 0 — hard duration / sequencing / anchor bugs (ship first)
|
||||
|
||||
| # | Rule | Fix | Reason / source | Freq |
|
||||
|---|---|---|---|---|
|
||||
| T0.1 | `upc.rev.cfi.defence` | `duration_value = 2` (was 3), `rule_code = 'RoP.049.1'`, `legal_source = 'UPC.RoP.49.1'` | §5 — every UPC_REV tracked in paliad today computes Defence at wrong month for the last ~3 months | ★★★ |
|
||||
| T0.2 | `upc.rev.cfi.rejoin` | `duration_value = 1` (was 2), `rule_code = 'RoP.052'`, `legal_source = 'UPC.RoP.52.p1'` | §5 — same as T0.1 | ★★★ |
|
||||
| T0.3 | `upc.apl.merits.response` | `duration_value = 3` (was 2), `rule_code = 'RoP.235.1'`, `legal_source = 'UPC.RoP.235.1'` | §5 — every main-track appellate respondent | ★★★ |
|
||||
| T0.4 | `de.inf.lg.beruf_begr` | `parent_id = NULL` (was `de.inf.lg.berufung`) — runs 2 months from triggerDate (Urteil-service) per ZPO §520(2) | §7.1 — every DE-LG-Verletzung appeal | ★★★ |
|
||||
| T0.5 | `de.inf.lg.replik` | `parent_id = de.inf.lg.erwidg`, `is_court_set = true` (richterliche Frist § 276(1) S.2 / § 283 ZPO), keep 4-week default | §7.2 — bug head flagged | ★★★ |
|
||||
| T0.6 | `de.inf.lg.duplik` | `parent_id = de.inf.lg.replik`, `is_court_set = true` | §7.2 | ★★★ |
|
||||
| T0.7 | `upc.rev.cfi.reply` | `rule_code = 'RoP.051'`, `legal_source = 'UPC.RoP.51.p1'` (duration 2mo unchanged) | §4.1 | ★★★ |
|
||||
| T0.8 | `upc.rev.cfi.rejoin` (citation only) | covered in T0.2 | — | — |
|
||||
| T0.9 | `upc.apl.merits.notice` | `rule_code = 'RoP.224.1.a'`, `legal_source = 'UPC.RoP.224.1.a'` (duration unchanged) | §4.1 | ★★ |
|
||||
| T0.10 | `upc.apl.merits.grounds` | `rule_code = 'RoP.224.2.a'`, `legal_source = 'UPC.RoP.224.2.a'` (duration unchanged) | §4.1 | ★★ |
|
||||
| T0.11 | `upc.rev.cfi.defence` rule_code zero-pad | covered in T0.1 | — | — |
|
||||
| T0.12 | `dpma.opp.dpma.erwiderung` | flip to `is_court_set = true`, keep 4-month default-display value, drop the misleading `DE.PatG.59.3` citation (or replace with "DPMA-Richtlinien D-IV 5.2") | §4.3 + §9.1 | ★★ |
|
||||
| T0.13 | `dpma.appeal.bpatg.begruendung` | flip to `is_court_set = true`, drop the `DE.PatG.75.1` citation, keep 1-month default | §4.3 + §9.1 | ★★ |
|
||||
| T0.14 | `de.null.bpatg.erwidg` | citation `DE.PatG.82.3` (was 82.1); duration (2mo) correct | §4.4 | ★★ |
|
||||
| T0.15 | `de.null.bgh.begruendung` | citation `DE.ZPO.520.2` via PatG §117 (was DE.PatG.111.1); duration (3mo) correct | §4.4 | ★★ |
|
||||
| T0.16 | `de.null.bgh.erwiderung` | flip to `is_court_set = true`; citation `DE.ZPO.521.2 via PatG §117` (was DE.PatG.111.3); duration (2mo) becomes default-display | §4.4 + §9.1 | ★★ |
|
||||
| T0.17 | `epa.opp.opd.erwidg` | flip to `is_court_set = true`, keep 4-month default | §4.5 + §9.1 | ★★ |
|
||||
|
||||
**16 hard fixes.** All within the existing schema (no new columns).
|
||||
Each is a single-row UPDATE plus an audit-log entry.
|
||||
|
||||
### Tier 1 — high-value missing rules (★★ / ★★★)
|
||||
|
||||
| # | Rule | Add | Freq |
|
||||
|---|---|---|---|
|
||||
| T1.1 | `upc.inf.cfi.cmo_review` | 15 days from CMO service (R.333.2) | ★★ |
|
||||
| T1.2 | `upc.inf.cfi.confidentiality_response` | 14 days from opp. confidentiality app (R.262.2) | ★★ |
|
||||
| T1.3 | `upc.apl.order.grounds_orders` | 15 days from order service (R.224.2(b)) | ★★ |
|
||||
| T1.4 | `upc.apl.order.response_orders` | 15 days from grounds service (R.235.2) | ★★ |
|
||||
| T1.5 | `upc.inf.cfi.cons_orders` | 2 months from validity decision (R.118.4) | ★★ |
|
||||
| T1.6 | `upc.inf.cfi.rectification` | 1 month from decision (R.353) | ★ |
|
||||
| T1.7 | `upc.pi.cfi.deficiency` | 14 days from PI deficiency notification (R.207.6.a) | ★★ |
|
||||
| T1.8 | `upc.pi.cfi.merits_start` | 31d OR 20wd from PI grant (R.213) — **blocked on Q2** | ★★ |
|
||||
| T1.9 | `upc.inf.cfi.translation_request` | 1 month **before** oral hearing (R.109.1) | ★★ |
|
||||
| T1.10 | `upc.inf.cfi.interpreter_cost` | 2 weeks **before** oral hearing (R.109.4) | ★★ |
|
||||
| T1.11 | `upc.inf.cfi.translations_lodge` | 2 weeks after summons (R.109.5) | ★★ |
|
||||
| T1.12 | `upc.pi.cfi.response` re-anchor | court-set, parent=`app` (currently a broken root) | ★★ |
|
||||
|
||||
**12 rule-adds.** T1.9/.10 are the only `timing='before'` rules in the
|
||||
entire UPC corpus; schema already supports `before` but no rule
|
||||
populates it. Verify the backward-snap-to-working-day logic in
|
||||
`internal/services/deadline_calculator.go` before merging
|
||||
(2026-04-30 audit §5.4 raised the concern).
|
||||
|
||||
### Tier 2 — broader coverage (★ specialist + Wiedereinsetzung family)
|
||||
|
||||
| # | Rule | Add | Notes |
|
||||
|---|---|---|---|
|
||||
| T2.1 | `de.inf.lg.einspruch_vu` | 2 weeks from service of Versäumnisurteil (ZPO §339) | Q5 — proceeding shape decision |
|
||||
| T2.2 | `upc.inf.cfi.wiedereinsetzung` | 2 mo / 1-year-cap from Wegfall des Hindernisses (R.320) | Q4 — needs special arithmetic |
|
||||
| T2.3 | `de.inf.lg.wiedereinsetzung` | 2 mo / 1-year-cap (PatG §123 / ZPO §233 ff.) | Q4 |
|
||||
| T2.4 | `epa.grant.exa.weiterbehandlung` | 2 mo from loss-of-rights notification (EPC R.135) | — |
|
||||
| T2.5 | `upc.inf.cfi.prelim_reply` | 14 days from PO service (R.20.2) | Companion to R.19 (mig 095 added it) |
|
||||
| T2.6 | `upc.apl.order.discretion_anchor` | add explicit `refusal` intermediate node so R.220.3 anchors correctly (Q12) | |
|
||||
| T2.7 | `upc.dmgs.cfi.app` spawn | `is_spawn=true` from `upc.inf.cfi.decision` (Q9) | |
|
||||
| T2.8 | `upc.disc.cfi.app` spawn | same shape as T2.7 | |
|
||||
| T2.9 | `epa.grant.exa.r71_3` re-anchor | parent = `exam_req` (§7.5) | |
|
||||
| T2.10 | `epa.grant.exa.approval` re-anchor | parent = `r71_3` (§7.5) | |
|
||||
| T2.11 | `upc.inf.cfi.appeal_spawn` cross-proc wiring | finish the half-wired spawn execution (Q13) | |
|
||||
|
||||
### Tier 3 — tooling primitives (block multiple rules)
|
||||
|
||||
| # | Primitive | Blocks | Notes |
|
||||
|---|---|---|---|
|
||||
| T3.1 | `duration_unit = 'working_days'` | R.198, R.213 | Schema already accepts the string; add to calculator + UI |
|
||||
| T3.2 | `combine_op = 'max'` | R.198, R.213, R.245.2 | Column already exists per pauli's 2026-05-13 audit |
|
||||
| T3.3 | Multi-anchor "whichever later" trigger | R.245.2.a/b | UI + service work |
|
||||
| T3.4 | Outer-cap modelling (`outer_cap_value` + `outer_cap_unit`) | R.245.2 (12mo), R.320 (12mo), EPC Art.112a(4) (12mo) | Schema add |
|
||||
| T3.5 | "Before"-mode backward snap to working day | R.109.1, R.109.4 | Calculator change (audit-fristenrechner-completeness-2026-04-30.md §5.4) |
|
||||
| T3.6 | Cross-proceeding spawn end-to-end (`is_spawn`) | T2.7, T2.8, T2.11 | Pauli's §6.8 |
|
||||
|
||||
### Tier 4 — out-of-scope until separate prioritisation
|
||||
|
||||
- DNI family (R.63 / R.67.1 / R.69.1 / R.69.2). Zero published filings 2026-Q1.
|
||||
- Registry-correction family (R.16.3.a, R.27.2, R.89.2, R.253.2). Most natural in cascade, not proceeding-tree.
|
||||
- GebrMG (no proceeding_type today).
|
||||
- R.245 rehearing family (specialist).
|
||||
- R.155 cost-decision opposition chain (specialist).
|
||||
- R.144 UPC_DAMAGES tree-end row (cosmetic).
|
||||
- R.79(2) EPC further-parties period (modelling unclear — Q7).
|
||||
|
||||
---
|
||||
|
||||
## §11. Next-step proposals (suggested fix-task slicing)
|
||||
|
||||
The audit identifies **41 distinct actionable items.** Below is a
|
||||
suggested decomposition into fix-tasks that can be assigned
|
||||
independently. Sequence reflects "Wave 0 must precede Wave 1" only
|
||||
where there's a real dependency (most slices are independent).
|
||||
|
||||
### Wave 0 — Tier 0 duration / sequencing / anchor fixes (single fix-task)
|
||||
|
||||
**Proposed task:** `t-paliad-264 — Tier 0 deadline-rule corrections
|
||||
(duration, anchor, citation) from t-paliad-263 audit`
|
||||
|
||||
- 16 row UPDATEs (T0.1–T0.17, deduplicated to 16 distinct rows since
|
||||
T0.8 is covered by T0.2 and T0.11 by T0.1).
|
||||
- One migration file (~120 LoC SQL).
|
||||
- All within existing schema. No new columns.
|
||||
- Idempotent guards on every UPDATE (only fire when the row still has
|
||||
the old value, per the mig 095 convention).
|
||||
- Adds 16 entries to `paliad.deadline_rule_audit` (per the mig 079
|
||||
trigger).
|
||||
- Verification block: `DO $$ … RAISE EXCEPTION …` per mig 095.
|
||||
- **Branch:** `mai/<coder>/t-paliad-264-tier0-deadline-fixes`.
|
||||
- **Owner:** coder.
|
||||
- **Why first:** all 16 affect either calendar correctness (5 hard
|
||||
duration/anchor bugs) or citation correctness (the 11 metadata
|
||||
fixes are what a lawyer would cite-check against). T0.1–T0.6 are
|
||||
user-visible silent wrongs; ship them.
|
||||
|
||||
### Wave 1 — Tier 1 rule additions (single fix-task)
|
||||
|
||||
**Proposed task:** `t-paliad-265 — Tier 1 deadline-rule additions
|
||||
(12 high-frequency rules)`
|
||||
|
||||
- 11 INSERTs + 1 UPDATE re-anchor (T1.12 `upc.pi.cfi.response`).
|
||||
- T1.8 (`upc.pi.cfi.merits_start`) **excluded** — blocked on T3.1/T3.2.
|
||||
- One migration file (~250 LoC SQL).
|
||||
- Add cascade leaves + concepts where needed (each rule should be
|
||||
reachable from Pathway B too).
|
||||
- **Branch:** `mai/<coder>/t-paliad-265-tier1-rule-additions`.
|
||||
- **Owner:** coder. **Legal review:** m must verify each rule before
|
||||
merge (single round of grilling).
|
||||
|
||||
### Wave 2 — Q1 court-set audit decision (separate spike)
|
||||
|
||||
**Proposed task:** `t-paliad-266 — Decide court-set vs fixed-period
|
||||
modelling for richterliche Fristen (Q1 in t-paliad-263 audit)`
|
||||
|
||||
- Inventor / pauli reviews §9.1 with m.
|
||||
- Decision artefact: list of rules to flip vs keep, plus UX guideline
|
||||
for what the timeline displays for `is_court_set=true` rules.
|
||||
- **Owner:** pauli. **m signs off.**
|
||||
|
||||
### Wave 3 — Tier 3 tooling primitives (multi-task)
|
||||
|
||||
Each Tier 3 row is its own task because each touches schema + service +
|
||||
calculator + UI:
|
||||
|
||||
- `t-paliad-267 — working_days unit + combine_op='max' (R.198, R.213)`
|
||||
- `t-paliad-268 — Outer-cap modelling (R.245.2, R.320, Art.112a)`
|
||||
- `t-paliad-269 — Multi-anchor "whichever later" triggers (R.245.2)`
|
||||
- `t-paliad-270 — Backward-snap for `before`-mode rules (R.109.1/.4)`
|
||||
- `t-paliad-271 — Cross-proceeding spawn end-to-end execution`
|
||||
|
||||
Each is foundational for multiple Tier 2 rules; can ship independently.
|
||||
|
||||
### Wave 4 — Tier 2 specialist rules (multi-task, after their primitives land)
|
||||
|
||||
Each Tier 2 row is its own task or batched into 2-3 tasks by topical
|
||||
area:
|
||||
|
||||
- `t-paliad-272 — Wiedereinsetzung / Weiterbehandlung family (T2.2, T2.3, T2.4)` — depends on T3.4 (outer cap).
|
||||
- `t-paliad-273 — UPC follow-on spawns (T2.7, T2.8, T2.11)` — depends on T3.6.
|
||||
- `t-paliad-274 — UPC tail rules (T2.5, T2.6, R.353, etc.)`
|
||||
- `t-paliad-275 — EPA grant timeline re-anchoring (T2.9, T2.10)`.
|
||||
|
||||
### Wave 5 — Concept-layer parity (separate audit)
|
||||
|
||||
The 9 orphan concepts (`audit-fristen-logic-2026-05-13.md` §3.4 + Q11
|
||||
here) need a parallel audit pass to map cascade → rule. Recommend
|
||||
spinning a `t-paliad-276 — Cascade-rule parity audit` task once the
|
||||
above land.
|
||||
|
||||
### Wave 6 — Documentation + retire
|
||||
|
||||
- `t-paliad-277 — Drop `_archived_litigation` proceeding_type` once
|
||||
mig 093's audit window closes (Q6).
|
||||
- `t-paliad-278 — Document Tier 4 deferrals in
|
||||
`docs/feature-roadmap.md`` so the gap-list isn't lost.
|
||||
|
||||
---
|
||||
|
||||
## Appendix A — file references
|
||||
|
||||
**Live state queried via Supabase MCP, 2026-05-25 14:00–15:00 UTC:**
|
||||
|
||||
- `paliad.proceeding_types` — 21 active rows (20 fristenrechner + 1
|
||||
archived).
|
||||
- `paliad.deadline_rules` — 132 active + 40 archived rows
|
||||
(`lifecycle_state='published'`).
|
||||
- `paliad.deadline_rule_audit` — diff history.
|
||||
- `data.laws_contents` (youpc) — UPC RoP + EPC verbatim text
|
||||
(`law_type IN ('UPCRoP','EPC')`).
|
||||
|
||||
**paliad migrations consulted:**
|
||||
|
||||
- `internal/db/migrations/012_fristenrechner_rules.up.sql` — original
|
||||
seed.
|
||||
- `internal/db/migrations/043_de_instance_split_proceedings.up.sql`
|
||||
— DE_INF_OLG / DE_INF_BGH split.
|
||||
- `internal/db/migrations/052_event_categories_rop_audit.up.sql`
|
||||
— first RoP audit fix-pass.
|
||||
- `internal/db/migrations/079_*` — `paliad.deadline_rule_audit`
|
||||
trigger.
|
||||
- `internal/db/migrations/091_drop_legacy_rule_columns.up.sql` —
|
||||
cleanup.
|
||||
- `internal/db/migrations/093_retire_litigation_category.up.sql` —
|
||||
archived 40 rules.
|
||||
- `internal/db/migrations/095_fristen_gap_fill.up.sql` — t-paliad-205
|
||||
R.19 + R.220.1(a) gap fill.
|
||||
- `internal/db/migrations/096_proceeding_code_rename.up.sql` — code
|
||||
rename to `<jurisdiction>.<proceeding>.<instance>` form.
|
||||
- `internal/db/migrations/097_legal_citation_backfill.up.sql` —
|
||||
legal_source / rule_code backfill.
|
||||
- `internal/db/migrations/100_ccr_visible_rule.up.sql` —
|
||||
`upc.ccr.cfi` alias.
|
||||
- `internal/db/migrations/104_einspruch_name_and_ccr_priority.up.sql`
|
||||
— Einspruch rename.
|
||||
|
||||
**Companion audits:**
|
||||
|
||||
- `docs/audit-fristenrechner-completeness-2026-04-30.md` — curie /
|
||||
t-paliad-084.
|
||||
- `docs/audit-upc-rop-deadlines-2026-05-08.md` — curie / t-paliad-159.
|
||||
- `docs/audit-fristen-logic-2026-05-13.md` — pauli / t-paliad-157
|
||||
(schema audit, ground-truth on column semantics).
|
||||
- `docs/proposals/fristen-gap-fill-2026-05-18.md` — m's 0.3 decisions
|
||||
that shipped as mig 095.
|
||||
|
||||
**Authoritative source URLs (all verified 2026-05-25):**
|
||||
|
||||
- UPC RoP consolidated 18.05.2023: https://www.unifiedpatentcourt.org/sites/default/files/upc_documents/rop_application_-_consolidated_18_05_2023.pdf
|
||||
- EPC 17th ed.: https://www.epo.org/en/legal/epc/2020/index.html
|
||||
- EPC R.71 (and other Implementing Reg Rules): https://www.epo.org/en/legal/epc/2020/r71.html
|
||||
- PatG: https://www.gesetze-im-internet.de/patg/
|
||||
- §59 https://www.gesetze-im-internet.de/patg/__59.html
|
||||
- §73 https://www.gesetze-im-internet.de/patg/__73.html
|
||||
- §75 https://www.gesetze-im-internet.de/patg/__75.html
|
||||
- §82 https://www.gesetze-im-internet.de/patg/__82.html
|
||||
- §110 https://www.gesetze-im-internet.de/patg/__110.html
|
||||
- §111 https://www.gesetze-im-internet.de/patg/__111.html
|
||||
- ZPO: https://www.gesetze-im-internet.de/zpo/
|
||||
- §520 https://www.gesetze-im-internet.de/zpo/__520.html
|
||||
- §521 https://www.gesetze-im-internet.de/zpo/__521.html
|
||||
- GebrMG: https://www.gesetze-im-internet.de/gebrmg/
|
||||
|
||||
---
|
||||
|
||||
## Appendix B — coverage tally
|
||||
|
||||
| Status | Count | Share |
|
||||
|---|---:|---:|
|
||||
| present-correct | 78 | 59 % |
|
||||
| present-wrong (DURATION) | 3 | 2 % |
|
||||
| present-wrong (anchor/sequence) | 5 | 4 % |
|
||||
| present-wrong (citation only) | 11 | 8 % |
|
||||
| court-set-mismodelled-as-fixed | 6 | 5 % |
|
||||
| **subtotal: still actionable** | **25** | **19 %** |
|
||||
| missing (statute defines, paliad doesn't) | 30 | (gap, vs 132 baseline) |
|
||||
| n/a (RoP / EPC / PatG section creates no time-limit) | 8 | 6 % |
|
||||
| present-correct, no fix needed | (78 above) | |
|
||||
|
||||
**Headline figures for m:**
|
||||
|
||||
- Of the 132 statutory deadlines paliad currently models, **25 carry
|
||||
an actionable bug** (19%). Of those, **5 are user-visible
|
||||
calendar-correctness bugs** (the 3 duration bugs + the 2
|
||||
sequencing/anchor bugs head flagged + me). The other 20 are
|
||||
citation drift or court-set mismodelling — fix-them-quietly
|
||||
category.
|
||||
- An additional **30 statutory deadlines are not modelled at all**
|
||||
(the missing list in §3). Of those, **~12 are ★★★ / ★★ frequency**
|
||||
(Tier 1 in §10); the remaining ~18 are ★ specialist.
|
||||
- The 5 duration / sequencing bugs alone are **the most important
|
||||
takeaway**: every UPC_REV proceeding, every UPC main-track appeal
|
||||
respondent, and every DE-LG-Verletzung timeline tracked in paliad
|
||||
today computes wrong dates.
|
||||
|
||||
End of audit. Awaiting m's review of §9 Q1–Q13 + Tier 0 sign-off
|
||||
before fix-tasks (Wave 0) get cut.
|
||||
@@ -49,6 +49,7 @@ import { renderAdminRulesEdit } from "./src/admin-rules-edit";
|
||||
import { renderAdminRulesExport } from "./src/admin-rules-export";
|
||||
import { renderPaliadin } from "./src/paliadin";
|
||||
import { renderAdminPaliadin } from "./src/admin-paliadin";
|
||||
import { renderAdminBackups } from "./src/admin-backups";
|
||||
import { renderNotFound } from "./src/notfound";
|
||||
|
||||
const DIST = join(import.meta.dir, "dist");
|
||||
@@ -291,6 +292,7 @@ async function build() {
|
||||
// skip the re-fetch.
|
||||
join(import.meta.dir, "src/client/paliadin-widget.ts"),
|
||||
join(import.meta.dir, "src/client/admin-paliadin.ts"),
|
||||
join(import.meta.dir, "src/client/admin-backups.ts"),
|
||||
join(import.meta.dir, "src/client/notfound.ts"),
|
||||
],
|
||||
outdir: join(DIST, "assets"),
|
||||
@@ -417,6 +419,7 @@ async function build() {
|
||||
await Bun.write(join(DIST, "admin-rules-export.html"), renderAdminRulesExport());
|
||||
await Bun.write(join(DIST, "paliadin.html"), renderPaliadin());
|
||||
await Bun.write(join(DIST, "admin-paliadin.html"), renderAdminPaliadin());
|
||||
await Bun.write(join(DIST, "admin-backups.html"), renderAdminBackups());
|
||||
await Bun.write(join(DIST, "notfound.html"), renderNotFound());
|
||||
|
||||
// Append ?v=<buildVersion> to every /assets/*.js and /assets/*.css URL in
|
||||
|
||||
96
frontend/src/admin-backups.tsx
Normal file
96
frontend/src/admin-backups.tsx
Normal file
@@ -0,0 +1,96 @@
|
||||
import { h } from "./jsx";
|
||||
import { Sidebar } from "./components/Sidebar";
|
||||
import { PaliadinWidget } from "./components/PaliadinWidget";
|
||||
import { BottomNav } from "./components/BottomNav";
|
||||
import { Footer } from "./components/Footer";
|
||||
import { PWAHead } from "./components/PWAHead";
|
||||
|
||||
// Backup Mode admin page (t-paliad-246 / m/paliad#77 Slice A).
|
||||
//
|
||||
// global_admin only — gated by adminGate(...) in handlers.go. Shows the
|
||||
// chronological list of backup runs (one row per kind in
|
||||
// {scheduled, on_demand}) plus a button to kick off an on-demand backup.
|
||||
// Catalog rows + the "run now" action are fetched client-side via
|
||||
// /api/admin/backups.
|
||||
export function renderAdminBackups(): string {
|
||||
return "<!DOCTYPE html>" + (
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
|
||||
<meta name="theme-color" content="#BFF355" />
|
||||
<meta name="apple-mobile-web-app-capable" content="yes" />
|
||||
<meta name="apple-mobile-web-app-status-bar-style" content="default" />
|
||||
<PWAHead />
|
||||
<title data-i18n="admin.backups.title">Backups — Paliad</title>
|
||||
<link rel="stylesheet" href="/assets/global.css" />
|
||||
</head>
|
||||
<body className="has-sidebar">
|
||||
<Sidebar currentPath="/admin/backups" />
|
||||
<BottomNav currentPath="/admin/backups" />
|
||||
|
||||
<main>
|
||||
<section className="tool-page">
|
||||
<div className="container">
|
||||
<div className="tool-header">
|
||||
<div>
|
||||
<h1 data-i18n="admin.backups.heading">Backups</h1>
|
||||
<p className="tool-subtitle" data-i18n="admin.backups.subtitle">
|
||||
Vollständige Snapshots aller Daten — manuell oder zeitgesteuert.
|
||||
</p>
|
||||
</div>
|
||||
<div>
|
||||
<button
|
||||
className="btn-primary"
|
||||
id="admin-backups-run-btn"
|
||||
type="button"
|
||||
data-i18n="admin.backups.run_now"
|
||||
>
|
||||
Backup jetzt erstellen
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div id="admin-backups-feedback" className="form-msg" style="display:none" />
|
||||
|
||||
<div className="entity-table-wrap">
|
||||
<table className="entity-table entity-table--readonly">
|
||||
<thead>
|
||||
<tr>
|
||||
<th data-i18n="admin.backups.col.started">Erstellt</th>
|
||||
<th data-i18n="admin.backups.col.kind">Auslöser</th>
|
||||
<th data-i18n="admin.backups.col.status">Status</th>
|
||||
<th data-i18n="admin.backups.col.requested_by">Angefordert von</th>
|
||||
<th data-i18n="admin.backups.col.size">Größe</th>
|
||||
<th data-i18n="admin.backups.col.rows">Zeilen</th>
|
||||
<th data-i18n="admin.backups.col.actions">Aktion</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="admin-backups-tbody">
|
||||
<tr>
|
||||
<td colspan={7} data-i18n="admin.backups.loading">Lade …</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<div className="entity-empty" id="admin-backups-empty" style="display:none">
|
||||
<p data-i18n="admin.backups.empty">Noch keine Backups vorhanden.</p>
|
||||
</div>
|
||||
|
||||
<p className="tool-footer-note" id="admin-backups-footer">
|
||||
<span data-i18n="admin.backups.footer.note">
|
||||
Geplante Backups werden in einer späteren Slice aktiviert. Manuelle Backups stehen jetzt zur Verfügung.
|
||||
</span>
|
||||
</p>
|
||||
</div>
|
||||
</section>
|
||||
</main>
|
||||
|
||||
<Footer />
|
||||
<PaliadinWidget />
|
||||
<script src="/assets/admin-backups.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
);
|
||||
}
|
||||
192
frontend/src/client/admin-backups.ts
Normal file
192
frontend/src/client/admin-backups.ts
Normal file
@@ -0,0 +1,192 @@
|
||||
import { initI18n, t } from "./i18n";
|
||||
import { initSidebar } from "./sidebar";
|
||||
|
||||
// Backup Mode admin client (t-paliad-246 / m/paliad#77 Slice A).
|
||||
//
|
||||
// Reads /api/admin/backups (chronological list) and wires the
|
||||
// "Backup jetzt erstellen" button to POST /api/admin/backups/run.
|
||||
// Synchronous: the server holds the connection for the duration of
|
||||
// the backup (sub-second at firm-scale today), then returns the new
|
||||
// catalog row inline. No polling needed at v1's data shape; if the
|
||||
// run takes > 5 minutes the handler returns 500 and the UI surfaces
|
||||
// the error.
|
||||
|
||||
interface BackupRow {
|
||||
id: string;
|
||||
kind: "scheduled" | "on_demand";
|
||||
status: "running" | "done" | "failed";
|
||||
requested_by?: string;
|
||||
requested_by_email: string;
|
||||
audit_id?: string;
|
||||
storage_uri?: string;
|
||||
size_bytes?: number;
|
||||
row_counts?: unknown; // jsonb passes through as raw bytes; we don't read it
|
||||
sheet_count?: number;
|
||||
warnings?: unknown;
|
||||
error?: string;
|
||||
started_at: string;
|
||||
finished_at?: string;
|
||||
deleted_at?: string;
|
||||
}
|
||||
|
||||
document.addEventListener("DOMContentLoaded", async () => {
|
||||
initI18n();
|
||||
initSidebar();
|
||||
|
||||
await refreshList();
|
||||
wireRunButton();
|
||||
});
|
||||
|
||||
function wireRunButton(): void {
|
||||
const btn = document.getElementById("admin-backups-run-btn") as HTMLButtonElement | null;
|
||||
if (!btn) return;
|
||||
btn.addEventListener("click", async () => {
|
||||
btn.disabled = true;
|
||||
const originalText = btn.textContent;
|
||||
btn.textContent = t("admin.backups.running") || "Läuft …";
|
||||
clearFeedback();
|
||||
try {
|
||||
const r = await fetch("/api/admin/backups/run", {
|
||||
method: "POST",
|
||||
credentials: "same-origin",
|
||||
});
|
||||
if (!r.ok) {
|
||||
const body = await r.json().catch(() => ({ error: "request failed" }));
|
||||
showFeedback("error", body.error || `HTTP ${r.status}`);
|
||||
return;
|
||||
}
|
||||
// The created row is in the response; refresh the list to land it.
|
||||
await refreshList();
|
||||
showFeedback("success", t("admin.backups.success") || "Backup erfolgreich erstellt.");
|
||||
} catch (e) {
|
||||
showFeedback("error", (e as Error).message || "network error");
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.textContent = originalText;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
async function refreshList(): Promise<void> {
|
||||
const rows = await fetchJSON<BackupRow[]>("/api/admin/backups?limit=200");
|
||||
const tbody = document.getElementById("admin-backups-tbody") as HTMLTableSectionElement | null;
|
||||
const empty = document.getElementById("admin-backups-empty") as HTMLElement | null;
|
||||
if (!tbody) return;
|
||||
if (!rows || rows.length === 0) {
|
||||
tbody.innerHTML = "";
|
||||
if (empty) empty.style.display = "";
|
||||
return;
|
||||
}
|
||||
if (empty) empty.style.display = "none";
|
||||
tbody.innerHTML = rows.map(renderRow).join("");
|
||||
}
|
||||
|
||||
function renderRow(b: BackupRow): string {
|
||||
const started = formatTimestamp(b.started_at);
|
||||
const kind =
|
||||
b.kind === "scheduled"
|
||||
? t("admin.backups.kind.scheduled") || "Geplant"
|
||||
: t("admin.backups.kind.on_demand") || "Manuell";
|
||||
const status = renderStatus(b);
|
||||
const requestedBy =
|
||||
b.kind === "scheduled" ? "—" : escapeHTML(b.requested_by_email);
|
||||
const size = b.size_bytes != null ? formatBytes(b.size_bytes) : "—";
|
||||
const rows = b.sheet_count != null ? String(b.sheet_count) : "—";
|
||||
const action = renderAction(b);
|
||||
return `<tr>
|
||||
<td>${started}</td>
|
||||
<td>${kind}</td>
|
||||
<td>${status}</td>
|
||||
<td>${requestedBy}</td>
|
||||
<td>${size}</td>
|
||||
<td>${rows}</td>
|
||||
<td>${action}</td>
|
||||
</tr>`;
|
||||
}
|
||||
|
||||
function renderStatus(b: BackupRow): string {
|
||||
switch (b.status) {
|
||||
case "done":
|
||||
return `<span class="status-done">${escapeHTML(t("admin.backups.status.done") || "✓ Fertig")}</span>`;
|
||||
case "running":
|
||||
return `<span class="status-running">${escapeHTML(t("admin.backups.status.running") || "Läuft …")}</span>`;
|
||||
case "failed":
|
||||
const label = t("admin.backups.status.failed") || "✗ Fehlgeschlagen";
|
||||
const tip = b.error ? ` title="${escapeAttr(b.error)}"` : "";
|
||||
return `<span class="status-failed"${tip}>${escapeHTML(label)}</span>`;
|
||||
default:
|
||||
return escapeHTML(b.status);
|
||||
}
|
||||
}
|
||||
|
||||
function renderAction(b: BackupRow): string {
|
||||
if (b.status !== "done" || !b.storage_uri || b.deleted_at) {
|
||||
return "—";
|
||||
}
|
||||
const label = t("admin.backups.download") || "Download";
|
||||
return `<a class="btn-link" href="/api/admin/backups/${encodeURIComponent(b.id)}/file">${escapeHTML(label)}</a>`;
|
||||
}
|
||||
|
||||
// --- helpers ---
|
||||
|
||||
async function fetchJSON<T>(url: string): Promise<T | null> {
|
||||
try {
|
||||
const r = await fetch(url, { credentials: "same-origin" });
|
||||
if (!r.ok) return null;
|
||||
return (await r.json()) as T;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function formatTimestamp(iso: string): string {
|
||||
const d = new Date(iso);
|
||||
if (isNaN(d.getTime())) return escapeHTML(iso);
|
||||
const yyyy = d.getUTCFullYear();
|
||||
const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
|
||||
const dd = String(d.getUTCDate()).padStart(2, "0");
|
||||
const hh = String(d.getUTCHours()).padStart(2, "0");
|
||||
const mi = String(d.getUTCMinutes()).padStart(2, "0");
|
||||
return `${yyyy}-${mm}-${dd} ${hh}:${mi} UTC`;
|
||||
}
|
||||
|
||||
function formatBytes(n: number): string {
|
||||
if (n < 1024) return `${n} B`;
|
||||
if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
|
||||
if (n < 1024 * 1024 * 1024) return `${(n / (1024 * 1024)).toFixed(1)} MB`;
|
||||
return `${(n / (1024 * 1024 * 1024)).toFixed(2)} GB`;
|
||||
}
|
||||
|
||||
function escapeHTML(s: string): string {
|
||||
return s.replace(/[&<>"']/g, (c) => {
|
||||
switch (c) {
|
||||
case "&": return "&";
|
||||
case "<": return "<";
|
||||
case ">": return ">";
|
||||
case '"': return """;
|
||||
case "'": return "'";
|
||||
default: return c;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
function escapeAttr(s: string): string {
|
||||
return escapeHTML(s);
|
||||
}
|
||||
|
||||
function showFeedback(kind: "success" | "error", text: string): void {
|
||||
const el = document.getElementById("admin-backups-feedback") as HTMLElement | null;
|
||||
if (!el) return;
|
||||
el.textContent = text;
|
||||
el.classList.remove("form-msg-success", "form-msg-error");
|
||||
el.classList.add(kind === "success" ? "form-msg-success" : "form-msg-error");
|
||||
el.style.display = "";
|
||||
}
|
||||
|
||||
function clearFeedback(): void {
|
||||
const el = document.getElementById("admin-backups-feedback") as HTMLElement | null;
|
||||
if (!el) return;
|
||||
el.style.display = "none";
|
||||
el.textContent = "";
|
||||
el.classList.remove("form-msg-success", "form-msg-error");
|
||||
}
|
||||
@@ -2350,6 +2350,31 @@ const translations: Record<Lang, Record<string, string>> = {
|
||||
// Admin audit log (t-paliad-071)
|
||||
"nav.admin.audit": "Audit-Log",
|
||||
"nav.admin.partner_units": "Partner Units",
|
||||
|
||||
// Admin Backup Mode (t-paliad-246 / m/paliad#77)
|
||||
"nav.admin.backups": "Backups",
|
||||
"admin.backups.title": "Backups — Paliad",
|
||||
"admin.backups.heading": "Backups",
|
||||
"admin.backups.subtitle": "Vollständige Snapshots aller Daten — manuell oder zeitgesteuert.",
|
||||
"admin.backups.run_now": "Backup jetzt erstellen",
|
||||
"admin.backups.running": "Läuft …",
|
||||
"admin.backups.success": "Backup erfolgreich erstellt.",
|
||||
"admin.backups.empty": "Noch keine Backups vorhanden.",
|
||||
"admin.backups.loading": "Lade …",
|
||||
"admin.backups.col.started": "Erstellt",
|
||||
"admin.backups.col.kind": "Auslöser",
|
||||
"admin.backups.col.status": "Status",
|
||||
"admin.backups.col.requested_by": "Angefordert von",
|
||||
"admin.backups.col.size": "Größe",
|
||||
"admin.backups.col.rows": "Sheets",
|
||||
"admin.backups.col.actions": "Aktion",
|
||||
"admin.backups.kind.scheduled": "Geplant",
|
||||
"admin.backups.kind.on_demand": "Manuell",
|
||||
"admin.backups.status.running": "Läuft …",
|
||||
"admin.backups.status.done": "✓ Fertig",
|
||||
"admin.backups.status.failed": "✗ Fehlgeschlagen",
|
||||
"admin.backups.download": "Download",
|
||||
"admin.backups.footer.note": "Geplante Backups werden in einer späteren Slice aktiviert. Manuelle Backups stehen jetzt zur Verfügung.",
|
||||
"admin.audit.title": "Audit-Log — Paliad",
|
||||
"admin.audit.heading": "Audit-Log",
|
||||
"admin.audit.subtitle": "Globale Zeitleiste über Projekt-, CalDAV-, Reminder- und Partner-Unit-Ereignisse.",
|
||||
@@ -5293,6 +5318,31 @@ const translations: Record<Lang, Record<string, string>> = {
|
||||
// Admin audit log (t-paliad-071)
|
||||
"nav.admin.audit": "Audit Log",
|
||||
"nav.admin.partner_units": "Partner Units",
|
||||
|
||||
// Admin Backup Mode (t-paliad-246 / m/paliad#77)
|
||||
"nav.admin.backups": "Backups",
|
||||
"admin.backups.title": "Backups — Paliad",
|
||||
"admin.backups.heading": "Backups",
|
||||
"admin.backups.subtitle": "Full snapshots of all data — manual or scheduled.",
|
||||
"admin.backups.run_now": "Run backup now",
|
||||
"admin.backups.running": "Running …",
|
||||
"admin.backups.success": "Backup created successfully.",
|
||||
"admin.backups.empty": "No backups yet.",
|
||||
"admin.backups.loading": "Loading …",
|
||||
"admin.backups.col.started": "Started",
|
||||
"admin.backups.col.kind": "Trigger",
|
||||
"admin.backups.col.status": "Status",
|
||||
"admin.backups.col.requested_by": "Requested by",
|
||||
"admin.backups.col.size": "Size",
|
||||
"admin.backups.col.rows": "Sheets",
|
||||
"admin.backups.col.actions": "Action",
|
||||
"admin.backups.kind.scheduled": "Scheduled",
|
||||
"admin.backups.kind.on_demand": "Manual",
|
||||
"admin.backups.status.running": "Running …",
|
||||
"admin.backups.status.done": "✓ Done",
|
||||
"admin.backups.status.failed": "✗ Failed",
|
||||
"admin.backups.download": "Download",
|
||||
"admin.backups.footer.note": "Scheduled backups land in a later slice. Manual backups are available now.",
|
||||
"admin.audit.title": "Audit Log — Paliad",
|
||||
"admin.audit.heading": "Audit Log",
|
||||
"admin.audit.subtitle": "Global timeline across project, CalDAV, reminder and partner-unit events.",
|
||||
|
||||
@@ -207,6 +207,7 @@ export function Sidebar({ currentPath, authenticated = true }: SidebarProps): st
|
||||
{navItem("/admin/rules", ICON_BOOK, "nav.admin.rules", "Regeln verwalten", currentPath)}
|
||||
{navItem("/admin/rules/export", ICON_DOWNLOAD, "nav.admin.rules_export", "Regel-Migrations", currentPath)}
|
||||
{navItem("/admin/audit-log", ICON_AUDIT_LOG, "nav.admin.audit", "Audit-Log", currentPath)}
|
||||
{navItem("/admin/backups", ICON_DOWNLOAD, "nav.admin.backups", "Backups", currentPath)}
|
||||
{/* Paliadin Monitor — owner-only sub-entry; revealed by sidebar.ts together with the /paliadin link. */}
|
||||
<a href="/admin/paliadin" id="sidebar-admin-paliadin-link"
|
||||
className={`sidebar-item${currentPath === "/admin/paliadin" ? " active" : ""}`}
|
||||
|
||||
@@ -90,6 +90,28 @@ export type I18nKey =
|
||||
| "admin.audit.source.reminder_log"
|
||||
| "admin.audit.subtitle"
|
||||
| "admin.audit.title"
|
||||
| "admin.backups.col.actions"
|
||||
| "admin.backups.col.kind"
|
||||
| "admin.backups.col.requested_by"
|
||||
| "admin.backups.col.rows"
|
||||
| "admin.backups.col.size"
|
||||
| "admin.backups.col.started"
|
||||
| "admin.backups.col.status"
|
||||
| "admin.backups.download"
|
||||
| "admin.backups.empty"
|
||||
| "admin.backups.footer.note"
|
||||
| "admin.backups.heading"
|
||||
| "admin.backups.kind.on_demand"
|
||||
| "admin.backups.kind.scheduled"
|
||||
| "admin.backups.loading"
|
||||
| "admin.backups.run_now"
|
||||
| "admin.backups.running"
|
||||
| "admin.backups.status.done"
|
||||
| "admin.backups.status.failed"
|
||||
| "admin.backups.status.running"
|
||||
| "admin.backups.subtitle"
|
||||
| "admin.backups.success"
|
||||
| "admin.backups.title"
|
||||
| "admin.broadcasts.col.count"
|
||||
| "admin.broadcasts.col.sender"
|
||||
| "admin.broadcasts.col.sent_at"
|
||||
@@ -1894,6 +1916,7 @@ export type I18nKey =
|
||||
| "login.title"
|
||||
| "modal.close.label"
|
||||
| "nav.admin.audit"
|
||||
| "nav.admin.backups"
|
||||
| "nav.admin.bereich"
|
||||
| "nav.admin.event_types"
|
||||
| "nav.admin.paliadin"
|
||||
|
||||
11
internal/db/migrations/123_backups.down.sql
Normal file
11
internal/db/migrations/123_backups.down.sql
Normal file
@@ -0,0 +1,11 @@
|
||||
-- t-paliad-246 / m/paliad#77 — revert Backup Mode catalog table.
|
||||
|
||||
SELECT set_config(
|
||||
'paliad.audit_reason',
|
||||
'mig 123 down: drop paliad.backups catalog (t-paliad-246 / m/paliad#77 Slice A)',
|
||||
true);
|
||||
|
||||
DROP POLICY IF EXISTS backups_select_admin ON paliad.backups;
|
||||
DROP INDEX IF EXISTS paliad.backups_kind_status_idx;
|
||||
DROP INDEX IF EXISTS paliad.backups_started_at_desc_idx;
|
||||
DROP TABLE IF EXISTS paliad.backups;
|
||||
86
internal/db/migrations/123_backups.up.sql
Normal file
86
internal/db/migrations/123_backups.up.sql
Normal file
@@ -0,0 +1,86 @@
|
||||
-- t-paliad-246 / m/paliad#77 — Backup Mode catalog table.
|
||||
--
|
||||
-- Design: docs/design-backup-mode-2026-05-25.md §4. One row per backup
|
||||
-- run (on-demand or scheduled). The catalog is operational metadata for
|
||||
-- the /admin/backups UI (size, row counts, storage URI, status). The
|
||||
-- audit chain stays on paliad.system_audit_log — this table is the
|
||||
-- richer-shape duplicate that the UI lists from without parsing JSON.
|
||||
--
|
||||
-- INSERT/UPDATE happen only through the Go service path (BackupRunner)
|
||||
-- under the migration-runner role, so we don't add a write RLS policy
|
||||
-- for end users. SELECT is admin-only, mirroring system_audit_log.
|
||||
--
|
||||
-- Idempotent: CREATE TABLE / INDEX / POLICY all guarded.
|
||||
|
||||
SELECT set_config(
|
||||
'paliad.audit_reason',
|
||||
'mig 123: add paliad.backups catalog for Backup Mode (t-paliad-246 / m/paliad#77 Slice A)',
|
||||
true);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS paliad.backups (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
kind text NOT NULL CHECK (kind IN ('scheduled', 'on_demand')),
|
||||
status text NOT NULL CHECK (status IN ('running', 'done', 'failed')),
|
||||
-- requested_by is NULL for kind='scheduled' (no human caller).
|
||||
requested_by uuid REFERENCES paliad.users(id) ON DELETE SET NULL,
|
||||
-- requested_by_email is captured at write time so the row survives
|
||||
-- a subsequent user deletion. For scheduled runs we write a sentinel
|
||||
-- like 'system@paliad' (no real user attached).
|
||||
requested_by_email text NOT NULL,
|
||||
-- audit_id back-references the system_audit_log row written before
|
||||
-- the artifact is generated. Nullable so a catalog row can still be
|
||||
-- INSERTed if the audit write itself fails (defense-in-depth).
|
||||
audit_id uuid REFERENCES paliad.system_audit_log(id) ON DELETE SET NULL,
|
||||
-- storage_uri is populated when status flips to 'done'. Resolves
|
||||
-- through the Go-side ArtifactStore interface ('file://...' for
|
||||
-- LocalDiskStore today; future stores get their own URI scheme).
|
||||
storage_uri text,
|
||||
size_bytes bigint,
|
||||
row_counts jsonb NOT NULL DEFAULT '{}'::jsonb,
|
||||
sheet_count int,
|
||||
warnings jsonb NOT NULL DEFAULT '[]'::jsonb,
|
||||
-- error is NULL unless status='failed'. Free-form, captured from
|
||||
-- the Go-side error.Error().
|
||||
error text,
|
||||
started_at timestamptz NOT NULL DEFAULT now(),
|
||||
finished_at timestamptz,
|
||||
-- deleted_at marks artifacts the lifecycle cleanup removed from
|
||||
-- storage (Slice B). The catalog row itself stays forever — it's
|
||||
-- part of the audit chain. NULL means "still on disk".
|
||||
deleted_at timestamptz
|
||||
);
|
||||
|
||||
-- Read patterns:
|
||||
-- - "show me recent backups" — started_at DESC
|
||||
-- - "find last successful scheduled backup today" — kind + status + started_at
|
||||
CREATE INDEX IF NOT EXISTS backups_started_at_desc_idx
|
||||
ON paliad.backups (started_at DESC);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS backups_kind_status_idx
|
||||
ON paliad.backups (kind, status);
|
||||
|
||||
ALTER TABLE paliad.backups ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
-- Admin-only read. INSERT/UPDATE/DELETE happen via the Go service path
|
||||
-- under the migration-runner role (no end-user write surface).
|
||||
DROP POLICY IF EXISTS backups_select_admin ON paliad.backups;
|
||||
CREATE POLICY backups_select_admin ON paliad.backups
|
||||
FOR SELECT USING (
|
||||
EXISTS (
|
||||
SELECT 1 FROM paliad.users u
|
||||
WHERE u.id = auth.uid()
|
||||
AND u.global_role = 'global_admin'
|
||||
)
|
||||
);
|
||||
|
||||
COMMENT ON TABLE paliad.backups IS
|
||||
'Catalog of org-scope backup runs (t-paliad-246 / m/paliad#77). One row per scheduled or on-demand backup. status transitions: running → done | failed. storage_uri is resolved by the Go-side ArtifactStore interface. audit_id links to system_audit_log; the catalog row is the richer-shape duplicate, the audit row is the trust signal.';
|
||||
|
||||
COMMENT ON COLUMN paliad.backups.requested_by_email IS
|
||||
'Captured at write time so the row survives user deletion. Sentinel ''system@paliad'' for scheduled runs.';
|
||||
|
||||
COMMENT ON COLUMN paliad.backups.storage_uri IS
|
||||
'Resolved by the Go-side ArtifactStore implementation. file://... for LocalDiskStore; future stores use their own URI scheme.';
|
||||
|
||||
COMMENT ON COLUMN paliad.backups.deleted_at IS
|
||||
'Set when the artifact is removed from storage by lifecycle cleanup. Catalog row stays forever (audit chain). NULL means artifact is still on disk.';
|
||||
247
internal/handlers/backups.go
Normal file
247
internal/handlers/backups.go
Normal file
@@ -0,0 +1,247 @@
|
||||
package handlers
|
||||
|
||||
// Admin Backup Mode handlers (t-paliad-246 / m/paliad#77 Slice A).
|
||||
//
|
||||
// POST /api/admin/backups/run — kick off an on-demand backup
|
||||
// GET /api/admin/backups — chronological list
|
||||
// GET /api/admin/backups/{id} — single catalog row
|
||||
// GET /api/admin/backups/{id}/file — stream the artifact (records
|
||||
// a backup_downloaded audit row)
|
||||
// GET /admin/backups — admin page (SPA shell)
|
||||
//
|
||||
// Authorisation: every route registers behind adminGate(users, …) in
|
||||
// handlers.go, so every handler in this file can assume the caller is a
|
||||
// global_admin and only validate the request shape.
|
||||
//
|
||||
// The runner is wired in cmd/server/main.go only when PALIAD_EXPORT_DIR
|
||||
// is set. When unset, every handler returns 503 — same shape as
|
||||
// requireDB.
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
|
||||
"mgit.msbls.de/m/paliad/internal/services"
|
||||
)
|
||||
|
||||
// backupRequestTimeout caps a single on-demand backup. At firm-scale
|
||||
// data shapes (today: ~600 user-content rows + ~1000 reference rows)
|
||||
// a backup runs sub-second; the watchdog surfaces "stuck" as a 500
|
||||
// instead of letting the client hang forever.
|
||||
const backupRequestTimeout = 5 * time.Minute
|
||||
|
||||
// requireBackup writes a 503 if the BackupRunner is not wired (typically
|
||||
// PALIAD_EXPORT_DIR is unset) and returns false. Mirrors requireDB.
|
||||
func requireBackup(w http.ResponseWriter) bool {
|
||||
if dbSvc == nil || dbSvc.backup == nil {
|
||||
writeJSON(w, http.StatusServiceUnavailable, map[string]string{
|
||||
"error": "backup service not configured — set PALIAD_EXPORT_DIR on the server",
|
||||
})
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// handleAdminBackupsPage renders the /admin/backups SPA shell. The
|
||||
// catalog rows are fetched client-side via /api/admin/backups.
|
||||
func handleAdminBackupsPage(w http.ResponseWriter, r *http.Request) {
|
||||
http.ServeFile(w, r, "dist/admin-backups.html")
|
||||
}
|
||||
|
||||
// handleAdminRunBackup kicks off a synchronous on-demand backup and
|
||||
// returns the resulting BackupSummary as JSON. Synchronous: at firm-
|
||||
// scale the whole run is under 5s; an async path with polling is Slice
|
||||
// B (the scheduler reuses the same runner internally).
|
||||
//
|
||||
// Returns 201 on success with the catalog row, 500 on failure (the
|
||||
// catalog/audit rows are still flipped to failed/backup_failed before
|
||||
// the response).
|
||||
func handleAdminRunBackup(w http.ResponseWriter, r *http.Request) {
|
||||
if !requireDB(w) || !requireBackup(w) {
|
||||
return
|
||||
}
|
||||
uid, ok := requireUser(w, r)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(r.Context(), backupRequestTimeout)
|
||||
defer cancel()
|
||||
|
||||
user, err := dbSvc.users.GetByID(ctx, uid)
|
||||
if err != nil || user == nil {
|
||||
log.Printf("backup: user lookup failed for %s: %v", uid, err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{
|
||||
"error": "user lookup failed",
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
actor := services.BackupActor{
|
||||
ID: &uid,
|
||||
Email: user.Email,
|
||||
Label: user.DisplayName,
|
||||
}
|
||||
result, err := dbSvc.backup.Run(ctx, services.BackupKindOnDemand, actor)
|
||||
if err != nil {
|
||||
log.Printf("backup: Run failed for admin=%s: %v", uid, err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{
|
||||
"error": "backup generation failed: " + err.Error(),
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
// Return the freshly-written catalog row so the UI doesn't need a
|
||||
// follow-up GET to render the new line item.
|
||||
row, err := dbSvc.backup.GetBackup(ctx, result.ID)
|
||||
if err != nil {
|
||||
// The backup did succeed — log + return the bare result.
|
||||
log.Printf("backup: post-run GetBackup failed for %s: %v", result.ID, err)
|
||||
writeJSON(w, http.StatusCreated, result)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusCreated, row)
|
||||
}
|
||||
|
||||
// handleAdminListBackups returns the most recent N catalog rows as
|
||||
// JSON. ?limit=N caps the page (default 100).
|
||||
func handleAdminListBackups(w http.ResponseWriter, r *http.Request) {
|
||||
if !requireDB(w) || !requireBackup(w) {
|
||||
return
|
||||
}
|
||||
limit := 100
|
||||
if q := strings.TrimSpace(r.URL.Query().Get("limit")); q != "" {
|
||||
if n, err := strconv.Atoi(q); err == nil && n > 0 && n <= 500 {
|
||||
limit = n
|
||||
}
|
||||
}
|
||||
rows, err := dbSvc.backup.ListBackups(r.Context(), limit)
|
||||
if err != nil {
|
||||
log.Printf("backup: list failed: %v", err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{
|
||||
"error": "list failed",
|
||||
})
|
||||
return
|
||||
}
|
||||
if rows == nil {
|
||||
rows = []services.BackupSummary{}
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rows)
|
||||
}
|
||||
|
||||
// handleAdminGetBackup returns one catalog row. Used by the UI for
|
||||
// "is the backup I just kicked off done yet?" polling — though at the
|
||||
// synchronous shape today this rarely matters.
|
||||
func handleAdminGetBackup(w http.ResponseWriter, r *http.Request) {
|
||||
if !requireDB(w) || !requireBackup(w) {
|
||||
return
|
||||
}
|
||||
id, err := uuid.Parse(r.PathValue("id"))
|
||||
if err != nil {
|
||||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid id"})
|
||||
return
|
||||
}
|
||||
row, err := dbSvc.backup.GetBackup(r.Context(), id)
|
||||
if err != nil {
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})
|
||||
return
|
||||
}
|
||||
log.Printf("backup: get failed for %s: %v", id, err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "get failed"})
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, row)
|
||||
}
|
||||
|
||||
// handleAdminDownloadBackup streams the artifact bytes through the
|
||||
// ArtifactStore (LocalDiskStore for v1). Records a backup_downloaded
|
||||
// audit row before flushing.
|
||||
//
|
||||
// 404 if the catalog row is missing; 410 (Gone) if the artifact was
|
||||
// already lifecycle-deleted; 409 if status is not 'done'; 500 on any
|
||||
// store/IO error.
|
||||
func handleAdminDownloadBackup(w http.ResponseWriter, r *http.Request) {
|
||||
if !requireDB(w) || !requireBackup(w) {
|
||||
return
|
||||
}
|
||||
uid, ok := requireUser(w, r)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
id, err := uuid.Parse(r.PathValue("id"))
|
||||
if err != nil {
|
||||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid id"})
|
||||
return
|
||||
}
|
||||
|
||||
row, err := dbSvc.backup.GetBackup(r.Context(), id)
|
||||
if err != nil {
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})
|
||||
return
|
||||
}
|
||||
log.Printf("backup: download GetBackup failed for %s: %v", id, err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "get failed"})
|
||||
return
|
||||
}
|
||||
if row.Status != services.BackupStatusDone || row.StorageURI == nil {
|
||||
writeJSON(w, http.StatusConflict, map[string]string{
|
||||
"error": "backup not available for download",
|
||||
"status": row.Status,
|
||||
})
|
||||
return
|
||||
}
|
||||
if row.DeletedAt != nil {
|
||||
// 410 Gone — the artifact is past its retention window. Catalog
|
||||
// row stays as the audit trail; clients should not retry.
|
||||
writeJSON(w, http.StatusGone, map[string]string{
|
||||
"error": "artifact has been removed (retention)",
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
rc, size, err := dbSvc.backup.Store().Get(r.Context(), *row.StorageURI)
|
||||
if err != nil {
|
||||
log.Printf("backup: download store.Get failed for %s: %v", id, err)
|
||||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "store read failed"})
|
||||
return
|
||||
}
|
||||
defer rc.Close()
|
||||
|
||||
// Record the download audit row before flushing. If the audit
|
||||
// write fails we still serve the file (the user can see it; the
|
||||
// chain just missed a row — surface in logs).
|
||||
user, uErr := dbSvc.users.GetByID(r.Context(), uid)
|
||||
if uErr == nil && user != nil {
|
||||
auditErr := dbSvc.backup.RecordDownload(r.Context(), id, services.BackupActor{
|
||||
ID: &uid,
|
||||
Email: user.Email,
|
||||
Label: user.DisplayName,
|
||||
})
|
||||
if auditErr != nil {
|
||||
log.Printf("backup: RecordDownload failed for %s by %s: %v", id, uid, auditErr)
|
||||
}
|
||||
} else if uErr != nil {
|
||||
log.Printf("backup: user lookup for audit failed (%s): %v", uid, uErr)
|
||||
}
|
||||
|
||||
filename := fmt.Sprintf("paliad-backup-%s.zip", row.StartedAt.UTC().Format("20060102T1504Z"))
|
||||
w.Header().Set("Content-Type", "application/zip")
|
||||
w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename=%q`, filename))
|
||||
w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
|
||||
w.Header().Set("X-Paliad-Backup-Id", id.String())
|
||||
if _, err := io.Copy(w, rc); err != nil {
|
||||
log.Printf("backup: response write failed for %s: %v", id, err)
|
||||
}
|
||||
}
|
||||
@@ -98,6 +98,11 @@ type Services struct {
|
||||
Projection *services.ProjectionService
|
||||
Export *services.ExportService
|
||||
|
||||
// t-paliad-246 — Backup Mode (org-scope admin backups). Nil when
|
||||
// DATABASE_URL or PALIAD_EXPORT_DIR is unset; the /admin/backups
|
||||
// routes return 503 in that case.
|
||||
Backup *services.BackupRunner
|
||||
|
||||
// t-paliad-238 — dedicated Submissions/Schriftsätze editor.
|
||||
SubmissionDraft *services.SubmissionDraftService
|
||||
|
||||
@@ -162,6 +167,7 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
|
||||
firmDashboardDefault: svc.FirmDashboardDefault,
|
||||
projection: svc.Projection,
|
||||
export: svc.Export,
|
||||
backup: svc.Backup,
|
||||
submissionDraft: svc.SubmissionDraft,
|
||||
}
|
||||
}
|
||||
@@ -570,6 +576,17 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
|
||||
protected.HandleFunc("GET /admin/email-templates", adminGate(users, gateOnboarded(handleAdminEmailTemplatesPage)))
|
||||
protected.HandleFunc("GET /admin/email-templates/{key}", adminGate(users, gateOnboarded(handleAdminEmailTemplatesEditPage)))
|
||||
protected.HandleFunc("GET /admin/event-types", adminGate(users, gateOnboarded(handleAdminEventTypesPage)))
|
||||
|
||||
// t-paliad-246 / m/paliad#77 Slice A — Backup Mode admin page +
|
||||
// API. Routes only register when Users is wired (matches the
|
||||
// other admin routes); per-request 503 if BackupRunner itself
|
||||
// is unwired (PALIAD_EXPORT_DIR unset).
|
||||
protected.HandleFunc("GET /admin/backups", adminGate(users, gateOnboarded(handleAdminBackupsPage)))
|
||||
protected.HandleFunc("POST /api/admin/backups/run", adminGate(users, handleAdminRunBackup))
|
||||
protected.HandleFunc("GET /api/admin/backups", adminGate(users, handleAdminListBackups))
|
||||
protected.HandleFunc("GET /api/admin/backups/{id}", adminGate(users, handleAdminGetBackup))
|
||||
protected.HandleFunc("GET /api/admin/backups/{id}/file", adminGate(users, handleAdminDownloadBackup))
|
||||
|
||||
protected.HandleFunc("GET /api/admin/users", adminGate(users, handleAdminListUsers))
|
||||
protected.HandleFunc("POST /api/admin/users", adminGate(users, handleAdminCreateUser))
|
||||
protected.HandleFunc("POST /api/admin/users/full", adminGate(users, handleAdminCreateFullUser))
|
||||
|
||||
@@ -62,6 +62,10 @@ type dbServices struct {
|
||||
projection *services.ProjectionService
|
||||
export *services.ExportService
|
||||
|
||||
// t-paliad-246 — Backup Mode orchestrator. Nil when DATABASE_URL or
|
||||
// PALIAD_EXPORT_DIR is unset (the /admin/backups routes return 503).
|
||||
backup *services.BackupRunner
|
||||
|
||||
// t-paliad-238 — submission draft editor.
|
||||
submissionDraft *services.SubmissionDraftService
|
||||
}
|
||||
|
||||
555
internal/services/backup_service.go
Normal file
555
internal/services/backup_service.go
Normal file
@@ -0,0 +1,555 @@
|
||||
package services
|
||||
|
||||
// Backup Mode runtime (t-paliad-246 / m/paliad#77 Slice A).
|
||||
//
|
||||
// One file because all four pieces are tightly coupled:
|
||||
//
|
||||
// - ArtifactStore interface + LocalDiskStore implementation
|
||||
// (storage abstraction; m picked local disk for v1, the interface
|
||||
// stays so a future swap to Supabase Storage is one impl away).
|
||||
//
|
||||
// - BackupRunner — the orchestration the on-demand handler and the
|
||||
// (Slice B) scheduler share. Wraps the export pipeline:
|
||||
// 1. INSERT paliad.backups (status='running')
|
||||
// 2. INSERT paliad.system_audit_log (event_type='backup_created')
|
||||
// 3. ExportService.WriteOrg → in-memory buffer
|
||||
// 4. ArtifactStore.Put → file
|
||||
// 5. UPDATE paliad.backups (status='done', storage_uri, …)
|
||||
// 6. PATCH paliad.system_audit_log metadata
|
||||
//
|
||||
// Design: docs/design-backup-mode-2026-05-25.md.
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"github.com/jmoiron/sqlx"
|
||||
)
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// ArtifactStore interface + LocalDiskStore impl
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// ArtifactStore persists the bytes of a backup artifact. The interface
|
||||
// is deliberately small so Slice B can drop in a SupabaseStorageStore
|
||||
// (or any object-store implementation) without changing the runner.
|
||||
//
|
||||
// URIs returned by Put are opaque to callers — they round-trip through
|
||||
// Get/Delete. v1's LocalDiskStore uses `file://<absolute-path>`.
|
||||
type ArtifactStore interface {
|
||||
// Put writes the given body to the store under the given key and
|
||||
// returns the URI for later retrieval. Implementations must overwrite
|
||||
// an existing object at the same key (catalog rows make keys unique
|
||||
// in practice, but the contract is overwrite-on-conflict to keep
|
||||
// retries idempotent).
|
||||
Put(ctx context.Context, key string, body []byte) (uri string, err error)
|
||||
// Get streams the artifact bytes at the given URI.
|
||||
Get(ctx context.Context, uri string) (rc io.ReadCloser, size int64, err error)
|
||||
// Delete removes the artifact at the given URI. Returns nil if the
|
||||
// artifact is already absent (idempotent).
|
||||
Delete(ctx context.Context, uri string) error
|
||||
}
|
||||
|
||||
// LocalDiskStore is the v1 ArtifactStore — writes artifacts to a local
|
||||
// directory specified at construction time. Mode 0700 on the directory
|
||||
// + 0600 on artifact files keeps the files private to the paliad
|
||||
// process owner on the Dokploy host.
|
||||
type LocalDiskStore struct {
|
||||
dir string
|
||||
}
|
||||
|
||||
// NewLocalDiskStore creates a LocalDiskStore rooted at dir. Creates the
|
||||
// directory (0700) if it doesn't exist. Returns an error if dir is
|
||||
// empty or the mkdir fails.
|
||||
func NewLocalDiskStore(dir string) (*LocalDiskStore, error) {
|
||||
if strings.TrimSpace(dir) == "" {
|
||||
return nil, errors.New("LocalDiskStore: empty directory")
|
||||
}
|
||||
if err := os.MkdirAll(dir, 0o700); err != nil {
|
||||
return nil, fmt.Errorf("LocalDiskStore mkdir %q: %w", dir, err)
|
||||
}
|
||||
abs, err := filepath.Abs(dir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("LocalDiskStore abs %q: %w", dir, err)
|
||||
}
|
||||
return &LocalDiskStore{dir: abs}, nil
|
||||
}
|
||||
|
||||
// Put writes body to <dir>/<key>. Returns a file:// URI.
|
||||
func (s *LocalDiskStore) Put(_ context.Context, key string, body []byte) (string, error) {
|
||||
if err := validateKey(key); err != nil {
|
||||
return "", err
|
||||
}
|
||||
full := filepath.Join(s.dir, key)
|
||||
if err := os.WriteFile(full, body, 0o600); err != nil {
|
||||
return "", fmt.Errorf("LocalDiskStore write %q: %w", full, err)
|
||||
}
|
||||
return "file://" + full, nil
|
||||
}
|
||||
|
||||
// Get opens the file referenced by uri. Returns a *os.File (io.ReadCloser)
|
||||
// + the file's size in bytes.
|
||||
func (s *LocalDiskStore) Get(_ context.Context, uri string) (io.ReadCloser, int64, error) {
|
||||
path, err := s.pathFromURI(uri)
|
||||
if err != nil {
|
||||
return nil, 0, err
|
||||
}
|
||||
info, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return nil, 0, fmt.Errorf("LocalDiskStore stat %q: %w", path, err)
|
||||
}
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil, 0, fmt.Errorf("LocalDiskStore open %q: %w", path, err)
|
||||
}
|
||||
return f, info.Size(), nil
|
||||
}
|
||||
|
||||
// Delete removes the file referenced by uri. Idempotent — missing file
|
||||
// is treated as success.
|
||||
func (s *LocalDiskStore) Delete(_ context.Context, uri string) error {
|
||||
path, err := s.pathFromURI(uri)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
|
||||
return fmt.Errorf("LocalDiskStore remove %q: %w", path, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// pathFromURI parses a file:// URI and validates that the resolved
|
||||
// path is inside this store's directory. Defense-in-depth against a
|
||||
// malformed catalog row pointing at an arbitrary file.
|
||||
func (s *LocalDiskStore) pathFromURI(uri string) (string, error) {
|
||||
u, err := url.Parse(uri)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("LocalDiskStore parse uri %q: %w", uri, err)
|
||||
}
|
||||
if u.Scheme != "file" {
|
||||
return "", fmt.Errorf("LocalDiskStore: unsupported uri scheme %q (want file://)", u.Scheme)
|
||||
}
|
||||
// url.Parse drops the leading "/" for file:// URIs into u.Path.
|
||||
path := u.Path
|
||||
if u.Host != "" {
|
||||
// "file://host/path" — we don't issue these. Reject.
|
||||
return "", fmt.Errorf("LocalDiskStore: file:// uri with host is unsupported (%q)", uri)
|
||||
}
|
||||
clean := filepath.Clean(path)
|
||||
rel, err := filepath.Rel(s.dir, clean)
|
||||
if err != nil || strings.HasPrefix(rel, "..") {
|
||||
return "", fmt.Errorf("LocalDiskStore: uri %q resolves outside store dir %q", uri, s.dir)
|
||||
}
|
||||
return clean, nil
|
||||
}
|
||||
|
||||
// validateKey rejects keys that would escape the store dir (path
|
||||
// separators, "..", absolute paths). Backup runner uses
|
||||
// "<uuid>.zip" so this is a defensive guard.
|
||||
func validateKey(key string) error {
|
||||
if key == "" {
|
||||
return errors.New("ArtifactStore: empty key")
|
||||
}
|
||||
if strings.ContainsAny(key, "/\\") {
|
||||
return fmt.Errorf("ArtifactStore: key %q contains path separator", key)
|
||||
}
|
||||
if strings.Contains(key, "..") {
|
||||
return fmt.Errorf("ArtifactStore: key %q contains traversal", key)
|
||||
}
|
||||
if filepath.IsAbs(key) {
|
||||
return fmt.Errorf("ArtifactStore: key %q is absolute", key)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// BackupRunner
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// BackupKind discriminates a scheduled run from an on-demand one.
|
||||
const (
|
||||
BackupKindOnDemand = "on_demand"
|
||||
BackupKindScheduled = "scheduled"
|
||||
)
|
||||
|
||||
// BackupStatus values mirror the paliad.backups status check constraint.
|
||||
const (
|
||||
BackupStatusRunning = "running"
|
||||
BackupStatusDone = "done"
|
||||
BackupStatusFailed = "failed"
|
||||
)
|
||||
|
||||
// SystemActorEmail is the sentinel actor_email written for scheduled
|
||||
// backups (kind='scheduled'). Matches design §3.4 — we don't seed a
|
||||
// phantom user, we just stamp the audit row with a stable sentinel.
|
||||
const SystemActorEmail = "system@paliad"
|
||||
|
||||
// BackupActor identifies who requested a backup. For kind='scheduled'
|
||||
// pass (nil, SystemActorEmail, "Paliad Backup System"). For on-demand
|
||||
// pass the calling admin's id/email/display_name.
|
||||
type BackupActor struct {
|
||||
ID *uuid.UUID
|
||||
Email string
|
||||
Label string
|
||||
}
|
||||
|
||||
// BackupResult is what Run returns to the caller. Empty on failure
|
||||
// (the error gets the failure detail; the catalog/audit rows are
|
||||
// already updated).
|
||||
type BackupResult struct {
|
||||
ID uuid.UUID
|
||||
AuditID uuid.UUID
|
||||
StorageURI string
|
||||
SizeBytes int64
|
||||
RowCounts map[string]int
|
||||
SheetCount int
|
||||
}
|
||||
|
||||
// BackupRunner orchestrates one backup run. Stateless except for the
|
||||
// wired dependencies; safe to share across goroutines (the handler
|
||||
// holds one instance; the Slice B scheduler will hold the same one).
|
||||
type BackupRunner struct {
|
||||
db *sqlx.DB
|
||||
export *ExportService
|
||||
store ArtifactStore
|
||||
}
|
||||
|
||||
// NewBackupRunner wires the runner. All three deps are required; the
|
||||
// caller (cmd/server/main.go) is responsible for instantiating the
|
||||
// ArtifactStore from env config.
|
||||
func NewBackupRunner(db *sqlx.DB, export *ExportService, store ArtifactStore) *BackupRunner {
|
||||
return &BackupRunner{db: db, export: export, store: store}
|
||||
}
|
||||
|
||||
// Store returns the configured store. Exposed for the download handler
|
||||
// to stream artifacts via Get.
|
||||
func (r *BackupRunner) Store() ArtifactStore { return r.store }
|
||||
|
||||
// Run performs one backup. Writes catalog + audit rows, generates the
|
||||
// bundle via ExportService.WriteOrg, uploads to the configured store,
|
||||
// patches catalog + audit on success/failure.
|
||||
//
|
||||
// On any error after the catalog/audit rows are written, the rows are
|
||||
// patched to status='failed' / event_type='backup_failed' before
|
||||
// returning. The returned error is always the export/upload failure —
|
||||
// catalog-update failures during the failure-recovery path are best-
|
||||
// effort logged but not surfaced (the real error is the one to bubble).
|
||||
func (r *BackupRunner) Run(ctx context.Context, kind string, actor BackupActor) (BackupResult, error) {
|
||||
if kind != BackupKindOnDemand && kind != BackupKindScheduled {
|
||||
return BackupResult{}, fmt.Errorf("BackupRunner.Run: invalid kind %q", kind)
|
||||
}
|
||||
if actor.Email == "" {
|
||||
return BackupResult{}, errors.New("BackupRunner.Run: empty actor email")
|
||||
}
|
||||
|
||||
now := time.Now().UTC()
|
||||
spec := ExportSpec{
|
||||
Scope: ExportScopeOrg,
|
||||
ActorID: uuid.Nil, // overwritten below when actor.ID != nil
|
||||
ActorEmail: actor.Email,
|
||||
ActorLabel: actor.Label,
|
||||
GeneratedAt: now,
|
||||
}
|
||||
if actor.ID != nil {
|
||||
spec.ActorID = *actor.ID
|
||||
}
|
||||
|
||||
// Step 1+2: catalog row (status='running') + audit row
|
||||
// (event_type='backup_created'). Both happen before the export
|
||||
// generation so failure paths can always find them.
|
||||
catalogID, err := r.insertCatalogRow(ctx, kind, actor, uuid.Nil, now)
|
||||
if err != nil {
|
||||
return BackupResult{}, fmt.Errorf("backup catalog insert: %w", err)
|
||||
}
|
||||
auditID, err := r.insertAuditRow(ctx, kind, actor, catalogID, now)
|
||||
if err != nil {
|
||||
// Best-effort patch on the catalog row so it doesn't sit
|
||||
// "running" forever.
|
||||
r.patchCatalogRowFailed(context.Background(), catalogID, fmt.Errorf("audit insert: %w", err))
|
||||
return BackupResult{}, fmt.Errorf("backup audit insert: %w", err)
|
||||
}
|
||||
// Back-link the audit id into the catalog row so the UI can JOIN.
|
||||
if err := r.linkAuditID(ctx, catalogID, auditID); err != nil {
|
||||
// Non-fatal — the link is for UI convenience, not correctness.
|
||||
// The error is logged via the patch path; we keep going.
|
||||
}
|
||||
|
||||
// Step 3: generate the bundle into an in-memory buffer. We materialise
|
||||
// fully before uploading so a partial upload doesn't strand bytes in
|
||||
// the store under a "done" catalog row.
|
||||
var buf bytes.Buffer
|
||||
meta, err := r.export.WriteOrg(ctx, &buf, spec)
|
||||
if err != nil {
|
||||
r.failRun(context.Background(), catalogID, auditID, fmt.Errorf("generate: %w", err))
|
||||
return BackupResult{}, fmt.Errorf("backup generate: %w", err)
|
||||
}
|
||||
|
||||
// Step 4: upload to storage. Key = "<catalog_id>.zip".
|
||||
key := catalogID.String() + ".zip"
|
||||
uri, err := r.store.Put(ctx, key, buf.Bytes())
|
||||
if err != nil {
|
||||
r.failRun(context.Background(), catalogID, auditID, fmt.Errorf("upload: %w", err))
|
||||
return BackupResult{}, fmt.Errorf("backup upload: %w", err)
|
||||
}
|
||||
|
||||
// Step 5+6: patch catalog + audit on success.
|
||||
size := int64(buf.Len())
|
||||
sheetCount := len(meta.RowCounts)
|
||||
if err := r.patchCatalogRowDone(ctx, catalogID, uri, size, sheetCount, meta); err != nil {
|
||||
// At this point the artifact is on disk, the audit row was
|
||||
// inserted, and the only thing that failed is the catalog
|
||||
// flip. Surface as an error so the handler can log; the
|
||||
// artifact is recoverable manually via the audit metadata.
|
||||
return BackupResult{}, fmt.Errorf("backup catalog patch: %w", err)
|
||||
}
|
||||
if err := r.patchAuditRowDone(ctx, auditID, uri, size, sheetCount, meta); err != nil {
|
||||
// Non-fatal — the catalog row is already authoritative; the
|
||||
// audit row is the audit-trail twin. Log via the caller.
|
||||
}
|
||||
|
||||
return BackupResult{
|
||||
ID: catalogID,
|
||||
AuditID: auditID,
|
||||
StorageURI: uri,
|
||||
SizeBytes: size,
|
||||
RowCounts: meta.RowCounts,
|
||||
SheetCount: sheetCount,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// RecordDownload writes a paliad.system_audit_log row of
|
||||
// event_type='backup_downloaded' when an admin downloads a backup
|
||||
// via /api/admin/backups/{id}/file. Separate row per click — the
|
||||
// existing 'backup_created' row stays untouched.
|
||||
func (r *BackupRunner) RecordDownload(ctx context.Context, backupID uuid.UUID, by BackupActor) error {
|
||||
if by.Email == "" {
|
||||
return errors.New("BackupRunner.RecordDownload: empty actor email")
|
||||
}
|
||||
meta, _ := json.Marshal(map[string]any{
|
||||
"backup_id": backupID.String(),
|
||||
"downloaded_by_email": by.Email,
|
||||
"downloaded_at": time.Now().UTC().Format(time.RFC3339),
|
||||
})
|
||||
var actorID any
|
||||
if by.ID != nil {
|
||||
actorID = *by.ID
|
||||
}
|
||||
_, err := r.db.ExecContext(ctx,
|
||||
`INSERT INTO paliad.system_audit_log
|
||||
(event_type, actor_id, actor_email, scope, scope_root, metadata)
|
||||
VALUES ('backup_downloaded', $1, $2, 'org', NULL, $3::jsonb)`,
|
||||
actorID, by.Email, string(meta),
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("backup_downloaded audit insert: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Catalog read helpers (List + Get for the admin UI)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// BackupSummary is the row shape returned by ListBackups + GetBackup —
|
||||
// shaped for the /admin/backups UI. Nullable columns are pointers.
|
||||
type BackupSummary struct {
|
||||
ID uuid.UUID `db:"id" json:"id"`
|
||||
Kind string `db:"kind" json:"kind"`
|
||||
Status string `db:"status" json:"status"`
|
||||
RequestedBy *uuid.UUID `db:"requested_by" json:"requested_by,omitempty"`
|
||||
RequestedByEmail string `db:"requested_by_email" json:"requested_by_email"`
|
||||
AuditID *uuid.UUID `db:"audit_id" json:"audit_id,omitempty"`
|
||||
StorageURI *string `db:"storage_uri" json:"storage_uri,omitempty"`
|
||||
SizeBytes *int64 `db:"size_bytes" json:"size_bytes,omitempty"`
|
||||
RowCounts []byte `db:"row_counts" json:"row_counts,omitempty"`
|
||||
SheetCount *int `db:"sheet_count" json:"sheet_count,omitempty"`
|
||||
Warnings []byte `db:"warnings" json:"warnings,omitempty"`
|
||||
Error *string `db:"error" json:"error,omitempty"`
|
||||
StartedAt time.Time `db:"started_at" json:"started_at"`
|
||||
FinishedAt *time.Time `db:"finished_at" json:"finished_at,omitempty"`
|
||||
DeletedAt *time.Time `db:"deleted_at" json:"deleted_at,omitempty"`
|
||||
}
|
||||
|
||||
// ListBackups returns the most recent backups (highest started_at first),
|
||||
// capped at limit. limit <= 0 means default (100).
|
||||
func (r *BackupRunner) ListBackups(ctx context.Context, limit int) ([]BackupSummary, error) {
|
||||
if limit <= 0 {
|
||||
limit = 100
|
||||
}
|
||||
var rows []BackupSummary
|
||||
err := r.db.SelectContext(ctx, &rows,
|
||||
`SELECT id, kind, status, requested_by, requested_by_email, audit_id,
|
||||
storage_uri, size_bytes, row_counts, sheet_count, warnings,
|
||||
error, started_at, finished_at, deleted_at
|
||||
FROM paliad.backups
|
||||
ORDER BY started_at DESC
|
||||
LIMIT $1`,
|
||||
limit,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("list backups: %w", err)
|
||||
}
|
||||
return rows, nil
|
||||
}
|
||||
|
||||
// GetBackup fetches one backup by id. Returns sql.ErrNoRows when not
|
||||
// found (caller maps to 404).
|
||||
func (r *BackupRunner) GetBackup(ctx context.Context, id uuid.UUID) (BackupSummary, error) {
|
||||
var row BackupSummary
|
||||
err := r.db.GetContext(ctx, &row,
|
||||
`SELECT id, kind, status, requested_by, requested_by_email, audit_id,
|
||||
storage_uri, size_bytes, row_counts, sheet_count, warnings,
|
||||
error, started_at, finished_at, deleted_at
|
||||
FROM paliad.backups
|
||||
WHERE id = $1`,
|
||||
id,
|
||||
)
|
||||
if err != nil {
|
||||
return BackupSummary{}, err
|
||||
}
|
||||
return row, nil
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Catalog + audit SQL helpers (private — used by Run + RecordDownload).
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
func (r *BackupRunner) insertCatalogRow(ctx context.Context, kind string, actor BackupActor, auditID uuid.UUID, now time.Time) (uuid.UUID, error) {
|
||||
var actorID any
|
||||
if actor.ID != nil {
|
||||
actorID = *actor.ID
|
||||
}
|
||||
var auditArg any
|
||||
if auditID != uuid.Nil {
|
||||
auditArg = auditID
|
||||
}
|
||||
var id uuid.UUID
|
||||
err := r.db.QueryRowxContext(ctx,
|
||||
`INSERT INTO paliad.backups
|
||||
(kind, status, requested_by, requested_by_email, audit_id, started_at)
|
||||
VALUES ($1, 'running', $2, $3, $4, $5)
|
||||
RETURNING id`,
|
||||
kind, actorID, actor.Email, auditArg, now,
|
||||
).Scan(&id)
|
||||
if err != nil {
|
||||
return uuid.Nil, err
|
||||
}
|
||||
return id, nil
|
||||
}
|
||||
|
||||
func (r *BackupRunner) insertAuditRow(ctx context.Context, kind string, actor BackupActor, catalogID uuid.UUID, now time.Time) (uuid.UUID, error) {
|
||||
meta, _ := json.Marshal(map[string]any{
|
||||
"kind": kind,
|
||||
"catalog_id": catalogID.String(),
|
||||
"requested_by_email": actor.Email,
|
||||
"requested_at": now.Format(time.RFC3339),
|
||||
})
|
||||
var actorID any
|
||||
if actor.ID != nil {
|
||||
actorID = *actor.ID
|
||||
}
|
||||
var id uuid.UUID
|
||||
err := r.db.QueryRowxContext(ctx,
|
||||
`INSERT INTO paliad.system_audit_log
|
||||
(event_type, actor_id, actor_email, scope, scope_root, metadata)
|
||||
VALUES ('backup_created', $1, $2, 'org', NULL, $3::jsonb)
|
||||
RETURNING id`,
|
||||
actorID, actor.Email, string(meta),
|
||||
).Scan(&id)
|
||||
if err != nil {
|
||||
return uuid.Nil, err
|
||||
}
|
||||
return id, nil
|
||||
}
|
||||
|
||||
func (r *BackupRunner) linkAuditID(ctx context.Context, catalogID, auditID uuid.UUID) error {
|
||||
_, err := r.db.ExecContext(ctx,
|
||||
`UPDATE paliad.backups SET audit_id = $2 WHERE id = $1`,
|
||||
catalogID, auditID,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
func (r *BackupRunner) patchCatalogRowDone(ctx context.Context, id uuid.UUID, uri string, size int64, sheetCount int, meta ExportMeta) error {
|
||||
rcJSON, _ := json.Marshal(meta.RowCounts)
|
||||
warnJSON, _ := json.Marshal(meta.Warnings)
|
||||
if meta.Warnings == nil {
|
||||
warnJSON = []byte("[]")
|
||||
}
|
||||
_, err := r.db.ExecContext(ctx,
|
||||
`UPDATE paliad.backups
|
||||
SET status = 'done',
|
||||
storage_uri = $2,
|
||||
size_bytes = $3,
|
||||
sheet_count = $4,
|
||||
row_counts = $5::jsonb,
|
||||
warnings = $6::jsonb,
|
||||
finished_at = now()
|
||||
WHERE id = $1`,
|
||||
id, uri, size, sheetCount, string(rcJSON), string(warnJSON),
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
func (r *BackupRunner) patchCatalogRowFailed(ctx context.Context, id uuid.UUID, runErr error) {
|
||||
_, _ = r.db.ExecContext(ctx,
|
||||
`UPDATE paliad.backups
|
||||
SET status = 'failed',
|
||||
error = $2,
|
||||
finished_at = now()
|
||||
WHERE id = $1`,
|
||||
id, runErr.Error(),
|
||||
)
|
||||
}
|
||||
|
||||
func (r *BackupRunner) patchAuditRowDone(ctx context.Context, id uuid.UUID, uri string, size int64, sheetCount int, meta ExportMeta) error {
|
||||
payload, _ := json.Marshal(map[string]any{
|
||||
"row_counts": meta.RowCounts,
|
||||
"file_size_bytes": size,
|
||||
"sheet_count": sheetCount,
|
||||
"storage_uri": uri,
|
||||
"warnings": meta.Warnings,
|
||||
"completed_at": time.Now().UTC().Format(time.RFC3339),
|
||||
})
|
||||
_, err := r.db.ExecContext(ctx,
|
||||
`UPDATE paliad.system_audit_log
|
||||
SET metadata = metadata || $2::jsonb,
|
||||
updated_at = now()
|
||||
WHERE id = $1`,
|
||||
id, string(payload),
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
func (r *BackupRunner) patchAuditRowFailed(ctx context.Context, id uuid.UUID, runErr error) {
|
||||
payload, _ := json.Marshal(map[string]any{
|
||||
"error": runErr.Error(),
|
||||
"failed_at": time.Now().UTC().Format(time.RFC3339),
|
||||
})
|
||||
_, _ = r.db.ExecContext(ctx,
|
||||
`UPDATE paliad.system_audit_log
|
||||
SET event_type = 'backup_failed',
|
||||
metadata = metadata || $2::jsonb,
|
||||
updated_at = now()
|
||||
WHERE id = $1`,
|
||||
id, string(payload),
|
||||
)
|
||||
}
|
||||
|
||||
// failRun is the shared failure-recovery path: patch the catalog +
|
||||
// audit rows to their failed states. Uses a context.Background so the
|
||||
// patch happens even if the original ctx is already cancelled.
|
||||
func (r *BackupRunner) failRun(ctx context.Context, catalogID, auditID uuid.UUID, runErr error) {
|
||||
r.patchCatalogRowFailed(ctx, catalogID, runErr)
|
||||
r.patchAuditRowFailed(ctx, auditID, runErr)
|
||||
}
|
||||
193
internal/services/backup_service_test.go
Normal file
193
internal/services/backup_service_test.go
Normal file
@@ -0,0 +1,193 @@
|
||||
package services
|
||||
|
||||
// Pure-function tests for the Backup Mode runtime (t-paliad-246 / m/paliad#77).
|
||||
//
|
||||
// Live DB behaviour (the actual org dump end-to-end) needs a Postgres;
|
||||
// it would live in backup_service_live_test.go under TEST_DATABASE_URL.
|
||||
// This file covers the bits that don't need a database:
|
||||
//
|
||||
// - orgSheetQueries registry shape: no duplicates, no excluded
|
||||
// paliadin sheets, predictable prefix split between entity and ref.
|
||||
// - LocalDiskStore Put / Get / Delete round-trip, key validation,
|
||||
// URI traversal rejection.
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// orgSheetQueries registry
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
func TestOrgSheetQueries_NoDuplicates(t *testing.T) {
|
||||
seen := map[string]bool{}
|
||||
for _, sq := range orgSheetQueries() {
|
||||
if seen[sq.SheetName] {
|
||||
t.Fatalf("duplicate sheet name in orgSheetQueries: %q", sq.SheetName)
|
||||
}
|
||||
seen[sq.SheetName] = true
|
||||
}
|
||||
}
|
||||
|
||||
func TestOrgSheetQueries_ExcludesPaliadinTables(t *testing.T) {
|
||||
// m's t-paliad-214 Q5 decision + this design's §11 Q3 default:
|
||||
// paliadin_turns and paliadin_aichat_conversation must be ABSENT
|
||||
// from the registry (structural exclusion, not just column-drop).
|
||||
for _, sq := range orgSheetQueries() {
|
||||
name := sq.SheetName
|
||||
if strings.Contains(name, "paliadin") {
|
||||
t.Fatalf("orgSheetQueries leaked paliadin sheet: %q (m's Q3 mandates structural exclusion)", name)
|
||||
}
|
||||
// Belt-and-braces: SQL bodies should not reference the tables
|
||||
// either (no UNION joins, no subqueries pulling them in).
|
||||
if strings.Contains(sq.SQL, "paliadin_turns") || strings.Contains(sq.SQL, "paliadin_aichat_conversation") {
|
||||
t.Fatalf("orgSheetQueries[%q] SQL references a paliadin table: %s", name, sq.SQL)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestOrgSheetQueries_RefSheetsPrefixed(t *testing.T) {
|
||||
// Every sheet whose data is read-only reference material is
|
||||
// expected to use the `ref__` prefix. The writer's downstream
|
||||
// consumers rely on this convention to group reference data
|
||||
// visually in the workbook.
|
||||
for _, sq := range orgSheetQueries() {
|
||||
if !strings.HasPrefix(sq.SheetName, "ref__") {
|
||||
continue
|
||||
}
|
||||
// Reference sheets shouldn't carry per-row WHERE clauses (they
|
||||
// dump the whole reference table for portability).
|
||||
if strings.Contains(strings.ToUpper(sq.SQL), "WHERE") {
|
||||
t.Fatalf("orgSheetQueries[%q] is ref__ but has a WHERE clause; reference sheets dump the whole table", sq.SheetName)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestOrgSheetQueries_OrderByForDeterminism(t *testing.T) {
|
||||
// Every sheet must specify an ORDER BY so the byte-deterministic
|
||||
// contract from t-paliad-214 §3 holds across runs.
|
||||
for _, sq := range orgSheetQueries() {
|
||||
if !strings.Contains(strings.ToUpper(sq.SQL), "ORDER BY") {
|
||||
t.Fatalf("orgSheetQueries[%q] missing ORDER BY (determinism contract): %s", sq.SheetName, sq.SQL)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// LocalDiskStore round-trip
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
func TestLocalDiskStore_RoundTrip(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
store, err := NewLocalDiskStore(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("NewLocalDiskStore: %v", err)
|
||||
}
|
||||
ctx := context.Background()
|
||||
want := []byte("hello backup\n")
|
||||
|
||||
uri, err := store.Put(ctx, "test.zip", want)
|
||||
if err != nil {
|
||||
t.Fatalf("Put: %v", err)
|
||||
}
|
||||
if !strings.HasPrefix(uri, "file://") {
|
||||
t.Fatalf("expected file:// uri, got %q", uri)
|
||||
}
|
||||
rc, size, err := store.Get(ctx, uri)
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
defer rc.Close()
|
||||
if size != int64(len(want)) {
|
||||
t.Fatalf("Get size = %d, want %d", size, len(want))
|
||||
}
|
||||
got, err := io.ReadAll(rc)
|
||||
if err != nil {
|
||||
t.Fatalf("ReadAll: %v", err)
|
||||
}
|
||||
if !bytes.Equal(got, want) {
|
||||
t.Fatalf("Get body = %q, want %q", got, want)
|
||||
}
|
||||
if err := store.Delete(ctx, uri); err != nil {
|
||||
t.Fatalf("Delete: %v", err)
|
||||
}
|
||||
// File should be gone; Get returns an error.
|
||||
if _, _, err := store.Get(ctx, uri); err == nil {
|
||||
t.Fatalf("Get after Delete should fail")
|
||||
}
|
||||
// Delete is idempotent.
|
||||
if err := store.Delete(ctx, uri); err != nil {
|
||||
t.Fatalf("idempotent Delete: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLocalDiskStore_RejectsBadKeys(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
store, err := NewLocalDiskStore(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("NewLocalDiskStore: %v", err)
|
||||
}
|
||||
ctx := context.Background()
|
||||
cases := []string{
|
||||
"",
|
||||
"sub/dir/file.zip",
|
||||
"..\\evil.zip",
|
||||
"../escape.zip",
|
||||
"/abs/path.zip",
|
||||
}
|
||||
for _, k := range cases {
|
||||
if _, err := store.Put(ctx, k, []byte("x")); err == nil {
|
||||
t.Fatalf("Put with bad key %q should fail", k)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestLocalDiskStore_RejectsURIOutsideDir(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
store, err := NewLocalDiskStore(dir)
|
||||
if err != nil {
|
||||
t.Fatalf("NewLocalDiskStore: %v", err)
|
||||
}
|
||||
ctx := context.Background()
|
||||
// A file:// URI pointing outside the store dir must be rejected
|
||||
// by both Get and Delete (defense in depth against a corrupted
|
||||
// catalog row).
|
||||
outside := "file://" + filepath.Join(filepath.Dir(dir), "elsewhere.zip")
|
||||
if _, _, err := store.Get(ctx, outside); err == nil {
|
||||
t.Fatalf("Get outside store dir should fail")
|
||||
}
|
||||
if err := store.Delete(ctx, outside); err == nil {
|
||||
t.Fatalf("Delete outside store dir should fail")
|
||||
}
|
||||
// Wrong scheme is also rejected.
|
||||
if _, _, err := store.Get(ctx, "https://example.com/foo.zip"); err == nil {
|
||||
t.Fatalf("Get with non-file:// scheme should fail")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLocalDiskStore_CreatesDir(t *testing.T) {
|
||||
// A non-existent parent gets created at construction; mode 0700.
|
||||
base := t.TempDir()
|
||||
target := filepath.Join(base, "nested", "exports")
|
||||
store, err := NewLocalDiskStore(target)
|
||||
if err != nil {
|
||||
t.Fatalf("NewLocalDiskStore(non-existent): %v", err)
|
||||
}
|
||||
info, err := os.Stat(target)
|
||||
if err != nil {
|
||||
t.Fatalf("expected store dir to exist: %v", err)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
t.Fatalf("expected directory, got file")
|
||||
}
|
||||
// Smoke-write to confirm the dir is actually usable.
|
||||
if _, err := store.Put(context.Background(), "ok.zip", []byte{}); err != nil {
|
||||
t.Fatalf("Put into fresh dir: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -40,6 +40,7 @@ import (
|
||||
"archive/zip"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"database/sql"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"encoding/csv"
|
||||
@@ -185,7 +186,7 @@ func (s *ExportService) WritePersonal(ctx context.Context, w io.Writer, spec Exp
|
||||
}
|
||||
|
||||
sheets := personalSheetQueries(spec.ActorID)
|
||||
if err := s.writeBundle(ctx, w, sheets, &meta); err != nil {
|
||||
if err := s.writeBundle(ctx, s.db, w, sheets, &meta); err != nil {
|
||||
return meta, err
|
||||
}
|
||||
return meta, nil
|
||||
@@ -238,7 +239,7 @@ func (s *ExportService) WriteProject(ctx context.Context, w io.Writer, spec Expo
|
||||
}
|
||||
|
||||
sheets := projectSheetQueries(*spec.ScopeRoot, spec.DirectOnly)
|
||||
if err := s.writeBundle(ctx, w, sheets, &meta); err != nil {
|
||||
if err := s.writeBundle(ctx, s.db, w, sheets, &meta); err != nil {
|
||||
return meta, err
|
||||
}
|
||||
|
||||
@@ -254,6 +255,55 @@ func (s *ExportService) WriteProject(ctx context.Context, w io.Writer, spec Expo
|
||||
return meta, nil
|
||||
}
|
||||
|
||||
// WriteOrg streams the full org-scope backup bundle into w. Bypasses
|
||||
// paliad.can_see_project — admin-only, gated at the handler layer (the
|
||||
// service trusts the caller has been authorised).
|
||||
//
|
||||
// Wraps the entire read pass in a REPEATABLE READ READ ONLY transaction
|
||||
// so every sheet sees the same snapshot. Without this a backup that runs
|
||||
// while users are editing can land internally inconsistent rows (e.g. a
|
||||
// deadlines.project_id pointing at a project the projects sheet just
|
||||
// missed). Design §3.3.
|
||||
//
|
||||
// The handler is responsible for the audit-row INSERT / PATCH (the
|
||||
// org-scope backup uses BackupRunner.Run, not WriteAuditRow, because the
|
||||
// event_type is 'backup_created' not 'data_export').
|
||||
func (s *ExportService) WriteOrg(ctx context.Context, w io.Writer, spec ExportSpec) (ExportMeta, error) {
|
||||
if spec.Scope == "" {
|
||||
spec.Scope = ExportScopeOrg
|
||||
}
|
||||
if spec.GeneratedAt.IsZero() {
|
||||
spec.GeneratedAt = time.Now().UTC()
|
||||
}
|
||||
meta := ExportMeta{
|
||||
SchemaVersion: ExportSchemaVersion,
|
||||
FirmName: s.firmName,
|
||||
Scope: spec.Scope,
|
||||
GeneratedAt: spec.GeneratedAt,
|
||||
GeneratedByID: spec.ActorID,
|
||||
GeneratedByEml: spec.ActorEmail,
|
||||
GeneratedByLbl: spec.ActorLabel,
|
||||
RowCounts: map[string]int{},
|
||||
}
|
||||
|
||||
tx, err := s.db.BeginTxx(ctx, &sql.TxOptions{
|
||||
Isolation: sql.LevelRepeatableRead,
|
||||
ReadOnly: true,
|
||||
})
|
||||
if err != nil {
|
||||
return meta, fmt.Errorf("backup snapshot tx: %w", err)
|
||||
}
|
||||
// Always rollback — the tx is read-only by construction, the rollback
|
||||
// is just bookkeeping that releases the snapshot.
|
||||
defer func() { _ = tx.Rollback() }()
|
||||
|
||||
sheets := orgSheetQueries()
|
||||
if err := s.writeBundle(ctx, tx, w, sheets, &meta); err != nil {
|
||||
return meta, err
|
||||
}
|
||||
return meta, nil
|
||||
}
|
||||
|
||||
// detectCrossSubtreeFKs scans subtree-resident projects for FKs that
|
||||
// point outside the subtree (today: only projects.counterclaim_of). One
|
||||
// warning row per outbound reference. Best-effort: a query error here
|
||||
@@ -300,13 +350,17 @@ type collectedSheet struct {
|
||||
// xlsx sheet + one JSON branch + one CSV per sheet, packs everything into
|
||||
// the outer zip in sorted file-list order so two runs of the same row
|
||||
// state produce byte-identical bundles.
|
||||
func (s *ExportService) writeBundle(ctx context.Context, w io.Writer, sheets []sheetQuery, meta *ExportMeta) error {
|
||||
//
|
||||
// queryer is the executor for sheet queries — typically s.db, but
|
||||
// WriteOrg passes a REPEATABLE READ *sqlx.Tx so the org dump sees a
|
||||
// consistent snapshot across all sheets (design §3.3).
|
||||
func (s *ExportService) writeBundle(ctx context.Context, queryer sqlx.QueryerContext, w io.Writer, sheets []sheetQuery, meta *ExportMeta) error {
|
||||
collectedSheets := make([]collectedSheet, 0, len(sheets))
|
||||
jsonTables := make(map[string][]map[string]string, len(sheets))
|
||||
warnings := []string{}
|
||||
|
||||
for _, sq := range sheets {
|
||||
cols, rowMatrix, dropped, err := s.runSheetQuery(ctx, sq)
|
||||
cols, rowMatrix, dropped, err := s.runSheetQuery(ctx, queryer, sq)
|
||||
if err != nil {
|
||||
return fmt.Errorf("export sheet %q: %w", sq.SheetName, err)
|
||||
}
|
||||
@@ -421,11 +475,13 @@ func (s *ExportService) writeBundle(ctx context.Context, w io.Writer, sheets []s
|
||||
return nil
|
||||
}
|
||||
|
||||
// runSheetQuery executes one sheetQuery and returns the kept columns,
|
||||
// row matrix (pre-stringified per the design's value-as-string convention),
|
||||
// and the list of columns that were dropped by the PII filter.
|
||||
func (s *ExportService) runSheetQuery(ctx context.Context, sq sheetQuery) (cols []string, rows [][]string, dropped []string, err error) {
|
||||
rs, err := s.db.QueryxContext(ctx, sq.SQL, sq.Args...)
|
||||
// runSheetQuery executes one sheetQuery against the given queryer and
|
||||
// returns the kept columns, row matrix (pre-stringified per the design's
|
||||
// value-as-string convention), and the list of columns that were dropped
|
||||
// by the PII filter. queryer is typically s.db, but WriteOrg passes a
|
||||
// REPEATABLE READ *sqlx.Tx (see writeBundle docs).
|
||||
func (s *ExportService) runSheetQuery(ctx context.Context, queryer sqlx.QueryerContext, sq sheetQuery) (cols []string, rows [][]string, dropped []string, err error) {
|
||||
rs, err := queryer.QueryxContext(ctx, sq.SQL, sq.Args...)
|
||||
if err != nil {
|
||||
return nil, nil, nil, fmt.Errorf("query: %w", err)
|
||||
}
|
||||
@@ -1470,3 +1526,107 @@ SELECT 'partner_unit_default'::text AS source,
|
||||
}
|
||||
return queries
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Org-scope sheet registry (Slice 3 / Backup Mode — t-paliad-246).
|
||||
// ---------------------------------------------------------------------------
|
||||
//
|
||||
// Full-schema dump. Bypasses paliad.can_see_project — admin-only,
|
||||
// gated at the handler layer (BackupRunner trusts the caller).
|
||||
//
|
||||
// Sheet ordering: entity sheets first (alphabetical), then ref__*
|
||||
// reference sheets (alphabetical). The xlsx writer iterates the slice
|
||||
// in order; downstream consumers get the same order across runs.
|
||||
//
|
||||
// Hard exclusions (per design §5.2 / m's Q3 decision):
|
||||
//
|
||||
// - paliadin_turns
|
||||
// - paliadin_aichat_conversation
|
||||
//
|
||||
// AI conversation history is the most-sensitive personal data paliad
|
||||
// carries; m's prior Q5 decision in t-paliad-214 made the exclusion
|
||||
// structural. The two tables are absent from the registry — not just
|
||||
// column-level redacted — so a future schema addition cannot
|
||||
// accidentally re-include them.
|
||||
//
|
||||
// Also excluded unconditionally (operational / shadow):
|
||||
//
|
||||
// - *_pre_NNN shadow tables (CREATE TABLE … AS SELECT backups
|
||||
// written by destructive migrations)
|
||||
// - paliad_schema_migrations (operational)
|
||||
// - auth.* (Supabase Auth schema — not ours)
|
||||
//
|
||||
// The PII column deny-regex (piiColumnDenyRegex) catches
|
||||
// secret|token|password|api_key|private_key on every sheet as a
|
||||
// belt-and-braces filter. user_caldav_config.password_encrypted is
|
||||
// explicitly named in DropColumns too.
|
||||
func orgSheetQueries() []sheetQuery {
|
||||
return []sheetQuery{
|
||||
// --- entity sheets (alphabetical) ---
|
||||
{SheetName: "appointment_caldav_targets", SQL: `SELECT * FROM paliad.appointment_caldav_targets ORDER BY appointment_id, calendar_binding_id`},
|
||||
{SheetName: "appointments", SQL: `SELECT * FROM paliad.appointments ORDER BY id`},
|
||||
{SheetName: "approval_policies", SQL: `SELECT * FROM paliad.approval_policies ORDER BY id`},
|
||||
{SheetName: "approval_requests", SQL: `SELECT * FROM paliad.approval_requests ORDER BY id`},
|
||||
// backups is self-reflexive — including it makes "what backups
|
||||
// have we taken" recoverable from any prior backup. Tiny table.
|
||||
{SheetName: "backups", SQL: `SELECT * FROM paliad.backups ORDER BY started_at, id`},
|
||||
{SheetName: "caldav_sync_log", SQL: `SELECT * FROM paliad.caldav_sync_log ORDER BY occurred_at, id`},
|
||||
{SheetName: "checklist_instances", SQL: `SELECT * FROM paliad.checklist_instances ORDER BY id`},
|
||||
{SheetName: "checklist_shares", SQL: `SELECT * FROM paliad.checklist_shares ORDER BY id`},
|
||||
{SheetName: "checklists", SQL: `SELECT * FROM paliad.checklists ORDER BY id`},
|
||||
{SheetName: "deadline_rule_audit", SQL: `SELECT * FROM paliad.deadline_rule_audit ORDER BY changed_at, id`},
|
||||
{SheetName: "deadlines", SQL: `SELECT * FROM paliad.deadlines ORDER BY id`},
|
||||
// documents: ai_extracted jsonb dropped (verbose AI prompts;
|
||||
// matches the personal/project precedent). Binaries are not in
|
||||
// the export — only metadata.
|
||||
{
|
||||
SheetName: "documents",
|
||||
SQL: `SELECT id, project_id, title, doc_type, file_path, file_size, mime_type, uploaded_by, created_at, updated_at
|
||||
FROM paliad.documents
|
||||
ORDER BY id`,
|
||||
},
|
||||
{SheetName: "email_broadcasts", SQL: `SELECT * FROM paliad.email_broadcasts ORDER BY id`},
|
||||
{SheetName: "email_template_versions", SQL: `SELECT * FROM paliad.email_template_versions ORDER BY id`},
|
||||
{SheetName: "email_templates", SQL: `SELECT * FROM paliad.email_templates ORDER BY id`},
|
||||
{SheetName: "firm_dashboard_default", SQL: `SELECT * FROM paliad.firm_dashboard_default ORDER BY id`},
|
||||
{SheetName: "invitations", SQL: `SELECT * FROM paliad.invitations ORDER BY sent_at, id`},
|
||||
{SheetName: "notes", SQL: `SELECT * FROM paliad.notes ORDER BY id`},
|
||||
{SheetName: "parties", SQL: `SELECT * FROM paliad.parties ORDER BY id`},
|
||||
{SheetName: "partner_unit_events", SQL: `SELECT * FROM paliad.partner_unit_events ORDER BY id`},
|
||||
{SheetName: "partner_unit_members", SQL: `SELECT * FROM paliad.partner_unit_members ORDER BY partner_unit_id, user_id`},
|
||||
{SheetName: "partner_units", SQL: `SELECT * FROM paliad.partner_units ORDER BY id`},
|
||||
{SheetName: "policy_audit_log", SQL: `SELECT * FROM paliad.policy_audit_log ORDER BY changed_at, id`},
|
||||
{SheetName: "project_events", SQL: `SELECT * FROM paliad.project_events ORDER BY id`},
|
||||
{SheetName: "project_partner_units", SQL: `SELECT * FROM paliad.project_partner_units ORDER BY project_id, partner_unit_id`},
|
||||
{SheetName: "project_teams", SQL: `SELECT * FROM paliad.project_teams ORDER BY project_id, user_id`},
|
||||
{SheetName: "projects", SQL: `SELECT * FROM paliad.projects ORDER BY id`},
|
||||
{SheetName: "reminder_log", SQL: `SELECT * FROM paliad.reminder_log ORDER BY sent_at, id`},
|
||||
{SheetName: "submission_drafts", SQL: `SELECT * FROM paliad.submission_drafts ORDER BY id`},
|
||||
{SheetName: "system_audit_log", SQL: `SELECT * FROM paliad.system_audit_log ORDER BY created_at, id`},
|
||||
{
|
||||
SheetName: "user_caldav_config",
|
||||
SQL: `SELECT * FROM paliad.user_caldav_config ORDER BY user_id`,
|
||||
DropColumns: []string{"password_encrypted"}, // belt-and-braces; piiColumnDenyRegex also catches it
|
||||
},
|
||||
{SheetName: "user_calendar_bindings", SQL: `SELECT * FROM paliad.user_calendar_bindings ORDER BY user_id, calendar_path`},
|
||||
{SheetName: "user_card_layouts", SQL: `SELECT * FROM paliad.user_card_layouts ORDER BY id`},
|
||||
{SheetName: "user_dashboard_layouts", SQL: `SELECT * FROM paliad.user_dashboard_layouts ORDER BY user_id`},
|
||||
{SheetName: "user_pinned_projects", SQL: `SELECT * FROM paliad.user_pinned_projects ORDER BY user_id, project_id`},
|
||||
{SheetName: "user_views", SQL: `SELECT * FROM paliad.user_views ORDER BY id`},
|
||||
{SheetName: "users", SQL: `SELECT * FROM paliad.users ORDER BY id`},
|
||||
|
||||
// --- reference data (alphabetical, prefixed ref__) ---
|
||||
{SheetName: "ref__countries", SQL: `SELECT * FROM paliad.countries ORDER BY code`},
|
||||
{SheetName: "ref__courts", SQL: `SELECT * FROM paliad.courts ORDER BY id`},
|
||||
{SheetName: "ref__deadline_concept_event_types", SQL: `SELECT * FROM paliad.deadline_concept_event_types ORDER BY concept_id, event_type_id`},
|
||||
{SheetName: "ref__deadline_concepts", SQL: `SELECT * FROM paliad.deadline_concepts ORDER BY id`},
|
||||
{SheetName: "ref__deadline_event_types", SQL: `SELECT * FROM paliad.deadline_event_types ORDER BY rule_id, event_type_id`},
|
||||
{SheetName: "ref__deadline_rules", SQL: `SELECT * FROM paliad.deadline_rules ORDER BY id`},
|
||||
{SheetName: "ref__event_categories", SQL: `SELECT * FROM paliad.event_categories ORDER BY id`},
|
||||
{SheetName: "ref__event_category_concepts", SQL: `SELECT * FROM paliad.event_category_concepts ORDER BY category_id, concept_id`},
|
||||
{SheetName: "ref__event_types", SQL: `SELECT * FROM paliad.event_types ORDER BY id`},
|
||||
{SheetName: "ref__holidays", SQL: `SELECT * FROM paliad.holidays ORDER BY date, country`},
|
||||
{SheetName: "ref__proceeding_types", SQL: `SELECT * FROM paliad.proceeding_types ORDER BY id`},
|
||||
{SheetName: "ref__trigger_events", SQL: `SELECT * FROM paliad.trigger_events ORDER BY id`},
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user