[Bug] Repair Campaign editor saves, legacy Mail migration and archive-policy settings #95

New Issue

2026-09-07T09:38:05+02:00

zemion commented

2026-09-07 09:38:05 +02:00

User report (2026-09-07)

Campaign is difficult to operate in the existing development instance:

Opening/leaving Template can autosave server-owned review_send editor metadata and receive HTTP 422.
Legacy ZIPCrypto cannot be enabled/discovered.
Legacy campaign-local transport requires migration, but Mail settings/profile loading and Review & Send expose raw blocking errors.
Campaign settings can report HTTP 500; module loading can fall back to “The resource could not be loaded.”

Repair acceptance

Client edit requests exclude server-owned review/approval evidence, retaining strict backend validation and proper evidence invalidation.
Fresh system archive policy is editable and governed legacy controls are discoverable; AES stays default, with explicit permission/policy/acknowledgment required for legacy.
Authorized Mail-profile migration remains explicit/audited, preserves stored history and never exposes credentials. Optional catalog failures do not erase usable choices.
Legacy Review & Send guides migration instead of repeatedly making known-invalid preview requests.
Settings failures are traced and corrected with focused regressions.
English/German module documentation and cross-module checks updated; actual-instance verification limitations recorded.

No real campaign delivery, credential migration, or weakening of configured security is authorized as part of diagnostic verification. Related: #76.

## User report (2026-09-07) Campaign is difficult to operate in the existing development instance: - Opening/leaving Template can autosave server-owned `review_send` editor metadata and receive HTTP 422. - Legacy ZIPCrypto cannot be enabled/discovered. - Legacy campaign-local transport requires migration, but Mail settings/profile loading and Review & Send expose raw blocking errors. - Campaign settings can report HTTP 500; module loading can fall back to “The resource could not be loaded.” ## Repair acceptance - [ ] Client edit requests exclude server-owned review/approval evidence, retaining strict backend validation and proper evidence invalidation. - [ ] Fresh system archive policy is editable and governed legacy controls are discoverable; AES stays default, with explicit permission/policy/acknowledgment required for legacy. - [ ] Authorized Mail-profile migration remains explicit/audited, preserves stored history and never exposes credentials. Optional catalog failures do not erase usable choices. - [ ] Legacy Review & Send guides migration instead of repeatedly making known-invalid preview requests. - [ ] Settings failures are traced and corrected with focused regressions. - [ ] English/German module documentation and cross-module checks updated; actual-instance verification limitations recorded. No real campaign delivery, credential migration, or weakening of configured security is authorized as part of diagnostic verification. Related: #76.

zemion commented

2026-09-07 09:57:46 +02:00

Local repair and actual-instance verification (2026-09-07)

Implemented in the Campaign, Policy, Core and workspace checkouts (not yet committed/pushed; issue remains open for release tracking).

Confirmed causes and fixes

Campaign save/autosave/fork echoed server-owned review/approval metadata. A shared client serializer now sends only editable metadata; strict server validation remains, and omitted server evidence is preserved with existing build invalidation rules.
Shared rich-text editor emitted a synthetic change on mount/read-only updates, marking Template dirty without typing. Core now suppresses non-document updates and preserves exact HTML during visual/source inspection.
Fresh system archive policy inherited from a nonexistent parent and disabled its own controls. Controls now allow explicit overrides; AES default, inherited restrictions, dedicated permission and legacy acknowledgment remain. Campaign includes direct system/tenant policy links and reload.
Legacy Mail migration could not be explicitly saved for an unchanged, already selected profile. Added a dedicated migration action, independent/race-safe profile list loading, version-preserving guidance across editors, and truthful blocked Review/preflight states. Historical versions and Mail credential ownership remain intact.
Actual Campaign Settings500 came from missing core_ownership_transfers.decisions despite applied old migrations. Added forward Core revision c58a2d7e9f10 on release/dev tracks. The development server applied it; PostgreSQL schema/unchanged ownership data and authenticated endpoint200 were verified. No stamp/reset/table recreation.
Lazy Excel/Tiptap vendor dependencies triggered late Vite reoptimization/reloads. Explicitly prebundled Core-installed entrypoints while preserving lazy optional modules.

Verification

Authenticated isolated browser against running localhost5173: Settings, Mail, Template, Review and Attachments load without page errors; Template opens clean and sidebar navigation does not request save/discard. Existing profile migration action enabled.
System Legacy checkbox enabled; toggling enables Save; Discard restores original policy without persisting. All diagnostic non-login write requests were blocked; no mail or campaign changes made.
Campaign:460 passed +26 subtests. Mail prescribed unittest suite:165 passed. Policy archive backend:3 passed. Core migrations/ownership:22 passed.
Shared browser conformance:15 passed (including2 new real rich-text lifecycle regressions). Campaign focused UI suites, archive-policy draft tests,72 manifest checks,shared layout/primitive/foundation checks and production build/bundle budget passed. EN/DE module docs updated.
Full check-focused was run but stops on an unrelated pre-existing temporal-context failure in tests.test_institutional_governance_journey: fixture validity ends Aug31, while Services filters by current date before Portal applies Aug1 effective_at. Reproduces with unchanged involved files; isolated fixture temporal context passes. Not changed in this repair.

Operator confirmation still required

Reload UI. In Campaign Mail settings, confirm the intended already selected profile with “Auf ausgewähltes Mail-Profil umstellen”. Validate/build/review afterward. If desired, explicitly enable Legacy ZipCrypto through the system policy link and save, then choose it on the attachment archive and provide required acknowledgment/reason. Neither choice was made automatically.

## Local repair and actual-instance verification (2026-09-07) Implemented in the Campaign, Policy, Core and workspace checkouts (not yet committed/pushed; issue remains open for release tracking). ### Confirmed causes and fixes - Campaign save/autosave/fork echoed server-owned review/approval metadata. A shared client serializer now sends only editable metadata; strict server validation remains, and omitted server evidence is preserved with existing build invalidation rules. - Shared rich-text editor emitted a synthetic change on mount/read-only updates, marking Template dirty without typing. Core now suppresses non-document updates and preserves exact HTML during visual/source inspection. - Fresh system archive policy inherited from a nonexistent parent and disabled its own controls. Controls now allow explicit overrides; AES default, inherited restrictions, dedicated permission and legacy acknowledgment remain. Campaign includes direct system/tenant policy links and reload. - Legacy Mail migration could not be explicitly saved for an unchanged, already selected profile. Added a dedicated migration action, independent/race-safe profile list loading, version-preserving guidance across editors, and truthful blocked Review/preflight states. Historical versions and Mail credential ownership remain intact. - Actual Campaign Settings500 came from missing core_ownership_transfers.decisions despite applied old migrations. Added forward Core revision c58a2d7e9f10 on release/dev tracks. The development server applied it; PostgreSQL schema/unchanged ownership data and authenticated endpoint200 were verified. No stamp/reset/table recreation. - Lazy Excel/Tiptap vendor dependencies triggered late Vite reoptimization/reloads. Explicitly prebundled Core-installed entrypoints while preserving lazy optional modules. ### Verification - Authenticated isolated browser against running localhost5173: Settings, Mail, Template, Review and Attachments load without page errors; Template opens clean and sidebar navigation does not request save/discard. Existing profile migration action enabled. - System Legacy checkbox enabled; toggling enables Save; Discard restores original policy without persisting. All diagnostic non-login write requests were blocked; no mail or campaign changes made. - Campaign:460 passed +26 subtests. Mail prescribed unittest suite:165 passed. Policy archive backend:3 passed. Core migrations/ownership:22 passed. - Shared browser conformance:15 passed (including2 new real rich-text lifecycle regressions). Campaign focused UI suites, archive-policy draft tests,72 manifest checks,shared layout/primitive/foundation checks and production build/bundle budget passed. EN/DE module docs updated. - Full check-focused was run but stops on an unrelated pre-existing temporal-context failure in tests.test_institutional_governance_journey: fixture validity ends Aug31, while Services filters by current date before Portal applies Aug1 effective_at. Reproduces with unchanged involved files; isolated fixture temporal context passes. Not changed in this repair. ### Operator confirmation still required Reload UI. In Campaign Mail settings, confirm the intended already selected profile with “Auf ausgewähltes Mail-Profil umstellen”. Validate/build/review afterward. If desired, explicitly enable Legacy ZipCrypto through the system policy link and save, then choose it on the attachment archive and provide required acknowledgment/reason. Neither choice was made automatically.

zemion commented

2026-09-07 10:10:07 +02:00

Follow-up repair for the live Legacy ZipCrypto Save failure (unknown_configuration_field):

Registered campaign_archive_encryption_policy in Core's high-risk configuration safety catalog. Global changes require BOTH system:settings:write and admin:policies:write; frontend agrees and lower-scope parent ceilings remain enforced.
Preserved the exact allowlisted encryption-method/password-channel enum lists in audited history, while malformed scalar/list values, unknown values and fields remain redacted. Corrected the before-value snapshot on subsequent policy updates so rollback history retains the previous policy.
Added real HTTP save/read, denied authority, invalid method, child ceiling, safe-history, second-save rollback, and malformed-value regressions; wired archive API regression into focused workspace checks. Updated English/German module documentation.

Verification: full Policy backend 74 passed (4 subtests); Core configuration-policy/API/IDM/organization regressions17 passed; manifest registry72/72. Independent review verified both-scope enforcement and sanitizer handling. On the existing local instance, authenticated GET safety catalog and nonmutating POST safety-plan both return200 with archive key recognized, allowed: true, and no blockers. No live archive policy was saved by the diagnostic.

Changes remain local/uncommitted/unpushed. Issue stays open until delivered. Broader check-focused remains blocked by the previously recorded unrelated dated institutional-governance fixture.

Follow-up repair for the live Legacy ZipCrypto Save failure (`unknown_configuration_field`): - Registered `campaign_archive_encryption_policy` in Core's high-risk configuration safety catalog. Global changes require BOTH `system:settings:write` and `admin:policies:write`; frontend agrees and lower-scope parent ceilings remain enforced. - Preserved the exact allowlisted encryption-method/password-channel enum lists in audited history, while malformed scalar/list values, unknown values and fields remain redacted. Corrected the before-value snapshot on subsequent policy updates so rollback history retains the previous policy. - Added real HTTP save/read, denied authority, invalid method, child ceiling, safe-history, second-save rollback, and malformed-value regressions; wired archive API regression into focused workspace checks. Updated English/German module documentation. Verification: full Policy backend 74 passed (4 subtests); Core configuration-policy/API/IDM/organization regressions17 passed; manifest registry72/72. Independent review verified both-scope enforcement and sanitizer handling. On the existing local instance, authenticated GET safety catalog and nonmutating POST safety-plan both return200 with archive key recognized, `allowed: true`, and no blockers. No live archive policy was saved by the diagnostic. Changes remain local/uncommitted/unpushed. Issue stays open until delivered. Broader check-focused remains blocked by the previously recorded unrelated dated institutional-governance fixture.

zemion commented

2026-09-08 05:23:53 +02:00

Reconciled 2026-09-08: implemented and published

This supersedes the earlier local/unpublished status. The owning fix is on remote main and the verified v0.1.28 tag (commit c51fc180fba7), included in the published 0.1.45 source/package composition.

Strict editor-state sanitization, independent legacy Mail/ZIP repairs, governed archive controls and actionable migration/loading behavior are implemented. Editor-state security, Mail-profile boundary and archive-encryption tests plus actual campaign-saving/mail-settings browser cases passed. Owning EN/DE documentation is included. An operator must still explicitly select/authorize Mail migration and any Legacy ZIPCrypto policy/acknowledgment; this closure does not enable legacy encryption or migrate a live campaign.

The completed, unmodified release tools/checks/check-focused.sh run passed, including 213 browser conformance cases and the relevant backend suites. The audit matched current remote branches/tags and reviewed the original acceptance criteria and subsequent comments. Closing the implemented source/package scope. This is not a runtime deployment claim: Meta #52 and website #9 retain their independent runtime/public-site holds. No tag was moved.

## Reconciled 2026-09-08: implemented and published This supersedes the earlier local/unpublished status. The owning fix is on remote `main` and the verified [`v0.1.28` tag](https://git.add-ideas.de/GovOPlaN/govoplan-campaign/src/tag/v0.1.28) ([commit `c51fc180fba7`](https://git.add-ideas.de/GovOPlaN/govoplan-campaign/commit/c51fc180fba75441dbd19c25b02a3ddc37c81a5d)), included in the published [0.1.45 source/package composition](https://git.add-ideas.de/GovOPlaN/govoplan/src/commit/88b685ff5e689acf096bdfc7084bd108e801e86e/docs/releases/0.1.45.md). Strict editor-state sanitization, independent legacy Mail/ZIP repairs, governed archive controls and actionable migration/loading behavior are implemented. Editor-state security, Mail-profile boundary and archive-encryption tests plus actual campaign-saving/mail-settings browser cases passed. Owning EN/DE documentation is included. An operator must still explicitly select/authorize Mail migration and any Legacy ZIPCrypto policy/acknowledgment; this closure does not enable legacy encryption or migrate a live campaign. The completed, unmodified release `tools/checks/check-focused.sh` run passed, including 213 browser conformance cases and the relevant backend suites. The audit matched current remote branches/tags and reviewed the original acceptance criteria and subsequent comments. Closing the implemented source/package scope. This is not a runtime deployment claim: [Meta #52](https://git.add-ideas.de/GovOPlaN/govoplan/issues/52) and [website #9](https://git.add-ideas.de/add-ideas/addideas-govoplan-website/issues/9) retain their independent runtime/public-site holds. No tag was moved.

zemion closed this issue

2026-09-08 05:23:53 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#95