Audit log entries for deleted resources

[matthew-white]

Right now the audits table in Frontend will show links for actors and actees even if they are deleted. For example, let's say a user updates a form, then the user is deleted, and the form is deleted. In that case, the row in the audits table for the update action will link to the user page and the form page, but both pages will show an error.

Filing this issue here rather than in Frontend, because I think this ties into our larger conversation about resource deletion and because depending on our approach, I think Backend may need to return additional information.

[ktuite]

This issue is finally being addressed in getodk/central-backend#443 and getodk/central-frontend#519.

The backend audit log API will return the deletedAt field for soft-deleted targets (Forms, Users, Projects) and the purgedAt field for purged resources (just Forms, initially).

When rendering the audit log, the frontend will check for these deleted/purged timestamps and render the targets appropriately (no link, trashcan icon) for all audit entries involving such targets.

[matthew-white]

I'm very excited about the progress we're making on this issue as part of v1.4. I think that those PRs will make all the changes we need related to the actee. At some point, I believe additional work will be needed for the actor so that we don't linkify an initiating user who has been deleted. However, I think that's lower-priority (I imagine that happens less often), so I think we can plan to close this issue once getodk/central-backend#443 is merged, then file a new issue specifically about deleted actors.

[matthew-white]

Actually, looking at getodk/central-backend#443, it looks like if the actor of the audit log action is deleted, then /v1/audits will return a deletedAt property for that actor. Is that right? If so, I think it'd be just a small change to the ActorLink component to stop a deleted actor from being linkified: all the Backend work needed seems to be complete.

[matthew-white]

Sorry for the many comments, but I'm realizing that that would also automatically have a small but positive effect on the submission details page: if a web user submits a submission, then the web user is retired, then the activity feed will no longer link to the web user.

[matthew-white]

I thought I'd note that a form will still linkify if the associated project is deleted: even if the project is deleted, if the form isn't, the form will link to a page that will show a 404. However, we don't surface project deletion in Frontend, so I think this is something we should come back to later.