15 files changed, 318 insertions, 65 deletions

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..c26956c
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,89 @@
+# Contributing to CCCMS
+
+## Stack
+Rails 8.1, Ruby 3.2, PostgreSQL 16, ImageMagick 7 (`magick`, not `convert`).
+No Sprockets pipeline for public or admin static assets except
+`admin_bundle.js` — everything else is served straight from `public/` and
+cache-busted via file mtime (`ApplicationHelper#mtime_busted_path`), not
+fingerprinted content hashing.
+
+## Content model
+- **Node** — the tree structure (`awesome_nested_set`-derived, migrating
+  toward a plain `parent_id` model — both may be present during that
+  transition). Holds three separate Page references: `head` (published),
+  `draft` (being worked on), `autosave` (in-progress typing).
+- **Page** — one revision's content. `belongs_to :node`, except `autosave`
+  layers specifically: their `node_id` is deliberately `nil`, which is what
+  keeps them out of `node.pages` (the real revision history) entirely —
+  an autosave is not a revision.
+- **Page::Translation** — Globalize's own generated class (`translates
+  :title, :abstract, :body` on `Page`). Not a top-level `PageTranslation`
+  constant, and it has `page_id`, not a `page` association reader.
+
+## Publishing lifecycle
+There is exactly one path from an edit to a published change:
+`autosave!` (writes into the autosave layer, creating it via
+`clone_attributes_from` on the previous head/draft if it doesn't exist yet)
+→ `save_draft!` (clones the *entire* autosave into the draft layer,
+wholesale — every locale, not just the one just edited) → `publish_draft!`
+(promotes draft to head). Nothing writes to `draft` or `head` directly.
+Locking (`lock_for_editing!`, raising `LockedByAnotherUser`) gates every
+step; a lock can exist with no draft or autosave at all (acquisition is
+deliberately separate from content creation).
+
+## Locale architecture
+Presentation locale (which language the admin chrome or public page
+renders in) and content-target locale (which translation a given screen is
+reading or writing) are two different concerns and never share a
+mechanism. The route's `:locale` segment governs the former only. The
+primary node editor always targets the default locale, enforced via
+`Globalize.with_locale` (never `I18n.locale`, which would leak into
+generated URLs through `default_url_options`). Non-default-locale editing
+uses a separately-named route param (`:translation_locale`), deliberately
+distinct from `:locale` so the two can never be conflated by a link helper.
+Globalize's configured fallback chain is correct for public rendering and
+wrong for editing — anywhere a screen needs to know a translation's real,
+unborrowed state, read the `Page::Translation` row directly rather than the
+locale-dependent attribute accessor.
+
+## Assets
+`FileAttachment` (`app/models/concerns/file_attachment.rb`) is a from-
+scratch Paperclip replacement. `STYLES` is a hash of style name to a full
+ImageMagick argument array (not just a geometry string — some styles need
+`-gravity`/`-extent` alongside `-resize`, which a single string can't
+express). `generate_variants` loops over `STYLES` generically; adding a
+style needs no other code change, only `bundle exec rake
+assets:regenerate_variants` to backfill existing assets. The URL contract
+(`/system/uploads/:id/:style/:filename`) is stable and safe to parse
+directly (the numeric id is always the second path segment) rather than
+reconstructed through model methods.
+
+## Aggregator / shortcode system
+`[aggregate ...]` in page body text is parsed by
+`ContentHelper#aggregate?` into an options hash, then executed by
+`Page.aggregate`. Only `tags`, `children` (`"direct"`/`"all"`, combined
+with the current node), `order_by`/`order_direction`, and `limit` are
+actually consumed.  Only the first `[aggregate ...]` in a given body is
+ever processed (`aggregate?` does a single, non-global match).
+
+## TinyMCE integration
+`extended_valid_elements` must define a parent element and its commonly-
+nested children symmetrically and explicitly together — leaving one
+element on the schema's default rule while the other is explicitly
+redefined can cause content loss on save, even when the child would be
+perfectly valid under the untouched default alone. `valid_classes` denies
+all classes by default (`'*': ''`); anything meant to render needs an
+explicit per-element allowance. `content_style` injects CSS into the
+editing iframe directly — the app's real public stylesheet is never loaded
+there, so anything that needs to render correctly while editing needs its
+own rule supplied this way. Constrained-input features (fixed placement
+choices, for instance) are built as custom toolbar buttons with their own
+dialog and `editor.insertContent()`, not the native image dialog or
+`file_picker_callback` — those bring their own resize/edit affordances that
+would undermine a genuinely fixed set of choices.
+
+## Testing
+Shared test-only convenience methods (that need to operate across many
+model/controller test files) live directly on `ActiveSupport::TestCase`,
+in `test/test_helper.rb` — the framework's own designated extension point
+for exactly this, not a monkey-patch of a production model class.
diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index bff1733..9c5d228 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -147,7 +147,7 @@ class NodesController < ApplicationController
   end
 
   def publish
-    @node.publish_draft!
+    @node.publish_draft!(current_user)
     flash[:notice] = "Draft has been published"
     redirect_to node_path(@node)
   end
diff --git a/app/controllers/page_translations_controller.rb b/app/controllers/page_translations_controller.rb
index 38a7c4f..be4f488 100644
--- a/app/controllers/page_translations_controller.rb
+++ b/app/controllers/page_translations_controller.rb
@@ -63,6 +63,9 @@ class PageTranslationsController < ApplicationController
     draft.translations.where(:locale => @locale).delete_all
     draft.reload
 
+    NodeAction.record!(:node => @node, :page => draft, :user => current_user,
+                        :action => "translation_destroy", :locale => @locale)
+
     flash[:notice] = "#{@locale.upcase} translation removed from the draft. Publish to make this permanent."
     redirect_to node_path(@node)
   rescue LockedByAnotherUser => e
diff --git a/app/models/node.rb b/app/models/node.rb
index 311c5c0..b41df06 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -170,10 +170,12 @@ class Node < ApplicationRecord
       self.autosave.destroy
       self.autosave_id = nil
       self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "discard_autosave")
     elsif self.draft && self.head
       self.draft.destroy
       self.draft_id = nil
       self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy_draft")
     end
 
     self.unlock! unless self.draft
@@ -188,43 +190,50 @@ class Node < ApplicationRecord
     end
   end
 
-  def publish_draft!
+  def publish_draft! current_user = nil
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
-    if self.draft
-      self.head = self.draft
-      self.head.published_at ||= Time.now
-      self.head.save!
-      self.draft = nil
-    end
-
-    if staged_slug && (staged_slug != slug)
-      self.slug = staged_slug
-      self.staged_slug = nil
-    end
+    ActiveRecord::Base.transaction do
+      if self.draft
+        previous_title = self.head ? Globalize.with_locale(I18n.default_locale) { self.head.title } : nil
+        self.head = self.draft
+        self.head.published_at ||= Time.now
+        self.head.save!
+        self.draft = nil
 
-    if staged_parent_id && (staged_parent_id != parent_id)
-      new_parent = Node.find(staged_parent_id)
+        new_title = Globalize.with_locale(I18n.default_locale) { self.head.title }
+        NodeAction.record!(:node => self, :page => self.head, :user => current_user,
+                            :action => "publish", :from => previous_title, :to => new_title)
+      end
 
-      if new_parent == self || self.descendants.include?(new_parent)
-        raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+      if staged_slug && (staged_slug != slug)
+        self.slug = staged_slug
+        self.staged_slug = nil
       end
 
-      self.staged_parent_id = nil
-      self.save!
-      self.move_to_child_of(new_parent)
-    else
-      unless self.save
-        raise ActiveRecord::RecordInvalid.new(self)
+      if staged_parent_id && (staged_parent_id != parent_id)
+        new_parent = Node.find(staged_parent_id)
+
+        if new_parent == self || self.descendants.include?(new_parent)
+          raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+        end
+
+        self.staged_parent_id = nil
+        self.save!
+        self.move_to_child_of(new_parent)
+      else
+        unless self.save
+          raise ActiveRecord::RecordInvalid.new(self)
+        end
       end
-    end
 
-    self.reload
-    self.update_unique_name
-    self.send(:update_unique_names_of_children)
-    self.unlock!
-    self
+      self.reload
+      self.update_unique_name
+      self.send(:update_unique_names_of_children)
+      self.unlock!
+      self
+    end
   end
 
   def restore_revision! revision
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
new file mode 100644
index 0000000..f32b5b7
--- /dev/null
+++ b/app/models/node_action.rb
@@ -0,0 +1,33 @@
+class NodeAction < ApplicationRecord
+  belongs_to :node, optional: true
+  belongs_to :page, optional: true
+  belongs_to :user, optional: true
+
+  validates :action, presence: true
+  validates :occurred_at, presence: true
+
+  def self.record!(node:, action:, user: nil, page: nil, locale: nil, **extra)
+    create!(
+      :node        => node,
+      :page        => page,
+      :user        => user,
+      :action      => action,
+      :locale      => locale,
+      :occurred_at => Time.now,
+      :metadata    => {
+        "username"                 => user&.login,
+        "human_readable_node_name" => Globalize.with_locale(I18n.default_locale) {
+                                        node&.head&.title || node&.draft&.title
+                                      },
+      }.merge(extra.stringify_keys)
+   )
+  end
+
+  def actor_name
+    metadata["username"] || "unknown"
+  end
+
+  def subject_name
+    metadata["human_readable_node_name"] || node&.unique_name || "deleted node"
+  end
+end
diff --git a/app/views/admin/_recent_changes.html.erb b/app/views/admin/_recent_changes.html.erb
deleted file mode 100644
index 88b5e93..0000000
--- a/app/views/admin/_recent_changes.html.erb
+++ /dev/null
@@ -1,24 +0,0 @@
-<h2>Recent Changes</h2>
-<div id="draft_list">
-  <table>
-    <tr class="header">
-      <th>Title</th>
-      <th>path</th>
-      <th>user</th>
-      <th>date</th>
-      <th></th>
-    </tr>
-    <% @recent_changes.each do |node| %>
-    <tr>
-      <td><%= truncated_title_for_node node %></td>
-      <td><%= node.unique_name %></td>
-      <td><%= node.draft.user.login rescue "" %></td>
-      <td><%= node.updated_at.to_fs(:db) %></td>
-      <td class="actions">
-        <%= link_to 'Show', node_path(node) %>
-        <%= link_to "Revisions", revision_path(:id => node.id) %>
-      </td>
-    </tr>
-    <% end %>
-  </table>
-</div>
\ No newline at end of file
diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb
index bdb555e..a9c0512 100644
--- a/app/views/admin/index.html.erb
+++ b/app/views/admin/index.html.erb
@@ -43,17 +43,7 @@
   <div class="dashboard_widget">
     <h3>Recent changes</h3>
     <ul>
-    <% @recent_changes.each do |node| %>
-      <li>
-        <div>
-          <%= link_to title_for_node(node), node_path(node) %>
-          <span class="field_hint"><%= link_to_path("#{node.unique_name} ↗", node.unique_name) %></span>
-        </div>
-        <span class="dashboard_widget_meta">
-          <%= (editor = node_head_editor(node)) ? t("published_by", editor: editor) : t("published") %>, <%= relative_time_phrase(node.head.updated_at) %>
-        </span>
-      </li>
-    <% end %>
+      <%= render partial: "nodes/recent_change_item", collection: @recent_changes, as: :node %>
     </ul>
     <%= link_to "See all recent changes →", recent_nodes_path %>
   </div>
diff --git a/app/views/nodes/_recent_change_item.html.erb b/app/views/nodes/_recent_change_item.html.erb
new file mode 100644
index 0000000..754a775
--- /dev/null
+++ b/app/views/nodes/_recent_change_item.html.erb
@@ -0,0 +1,9 @@
+<li>
+  <div>
+    <%= link_to title_for_node(node), node_path(node) %>
+    <span class="field_hint"><%= link_to_path("#{node.unique_name} ↗", node.unique_name) %></span>
+  </div>
+  <span class="dashboard_widget_meta">
+    <%= (editor = node_head_editor(node)) ? t("last_edited_by", editor: editor) : t("last_edited") %>, <%= relative_time_phrase(node.head.updated_at) %>
+  </span>
+</li>
diff --git a/app/views/nodes/recent.html.erb b/app/views/nodes/recent.html.erb
index 3602775..d256253 100644
--- a/app/views/nodes/recent.html.erb
+++ b/app/views/nodes/recent.html.erb
@@ -1,3 +1,7 @@
 <h1>Recently changed</h1>
 
-<%= render 'node_list' %>
+<%= will_paginate @nodes %>
+<ul id="recent_changes_full_list">
+  <%= render partial: "nodes/recent_change_item", collection: @nodes, as: :node %>
+</ul>
+<%= will_paginate @nodes %>
diff --git a/config/locales/de.yml b/config/locales/de.yml
index 550ccb3..74cd183 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -16,6 +16,8 @@ de:
   open_today: "Das Chaos, lokal und heute offen"
   published: "veröffentlicht"
   published_by: "veröffentlicht durch %{editor}"
+  last_edited: "zuletzt bearbeitet"
+  last_edited_by: "zuletzt bearbeitet durch %{editor}"
   editor_self: "du"
   publisher_self: "dich"
   date:
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 73271ed..c52280d 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -17,6 +17,8 @@ en:
   open_today: "Open today"
   published: "published"
   published_by: "published by %{editor}"
+  last_edited: "last edited"
+  last_edited_by: "last edited by %{editor}"
   publisher_self: "you"
   editor_self: "you"
 
diff --git a/db/migrate/20260714233414_create_node_actions.rb b/db/migrate/20260714233414_create_node_actions.rb
new file mode 100644
index 0000000..6c18285
--- /dev/null
+++ b/db/migrate/20260714233414_create_node_actions.rb
@@ -0,0 +1,19 @@
+class CreateNodeActions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :node_actions do |t|
+      t.references :node, foreign_key: { on_delete: :nullify }
+      t.references :page, foreign_key: { on_delete: :nullify }
+      t.references :user, foreign_key: { on_delete: :nullify }
+      t.string   :action, null: false
+      t.string   :locale
+      t.string   :inferred_from
+      t.jsonb    :metadata, null: false
+      t.datetime :occurred_at, null: false
+
+      t.timestamps
+    end
+
+    add_index :node_actions, [:node_id, :occurred_at]
+    add_index :node_actions, :action
+  end
+end
diff --git a/public/stylesheets/admin.css b/public/stylesheets/admin.css
index b5b8707..5f0b165 100644
--- a/public/stylesheets/admin.css
+++ b/public/stylesheets/admin.css
@@ -1121,6 +1121,25 @@ div#draft_list table td.actions a {
   font-size: 0.9em;
 }
 
+#recent_changes_full_list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+#recent_changes_full_list li {
+  padding: 0.75rem 0;
+  border-bottom: 1px solid #eee;
+}
+
+#recent_changes_full_list li:last-child {
+  border-bottom: none;
+}
+
+#recent_changes_full_list li > div {
+  margin-bottom: 0.25rem;
+}
+
 /* ============================================================
    Search widgets
    ============================================================ */
diff --git a/test/controllers/page_translations_controller_test.rb b/test/controllers/page_translations_controller_test.rb
index 8fa732f..82f8bce 100644
--- a/test/controllers/page_translations_controller_test.rb
+++ b/test/controllers/page_translations_controller_test.rb
@@ -82,4 +82,19 @@ class PageTranslationsControllerTest < ActionController::TestCase
     assert_equal page_count_before, node.pages.count
     assert_equal "in progress", Globalize.with_locale(:en) { node.autosave.title }
   end
+
+  test "destroy logs a translation_destroy NodeAction" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "translation_destroy_log_test")
+    Globalize.with_locale(:en) { node.draft.update!(:title => "English title") }
+
+    delete :destroy, params: { :node_id => node.id, :translation_locale => "en" }
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal "en", action.locale
+    assert_equal "translation_destroy", action.action
+    assert_equal users(:quentin), action.user
+    assert_redirected_to node_path(node)
+  end
 end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index 959387d..022fff6 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -621,4 +621,87 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Edited directly on autosave", Globalize.with_locale(:en) { autosave.title }
     assert_equal "v2",                          Globalize.with_locale(:de) { autosave.title }
   end
+
+  test "publish_draft! logs a NodeAction crediting the actual publisher" do
+    node = Node.root.children.create!(:slug => "publish_log_test")
+    node.draft.update!(:title => "Version one")
+
+    node.publish_draft!(@user1)
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal node.head, action.page
+    assert_equal @user1, action.user
+    assert_equal "publish", action.action
+  end
+
+  test "publish_draft! called with no user logs no actor, not a guessed one" do
+    node = Node.root.children.create!(:slug => "publish_log_no_user_test")
+    node.draft.update!(:title => "Version one")
+
+    node.publish_draft!
+
+    action = NodeAction.last
+    assert_nil action.user
+    assert_nil action.metadata["username"]
+  end
+
+  test "publish_draft! with nothing pending creates no NodeAction" do
+    node = Node.root.children.create!(:slug => "publish_log_noop_test")
+    node.publish_draft!
+    count_before = NodeAction.count
+
+    result = node.publish_draft!
+
+    assert_nil result
+    assert_equal count_before, NodeAction.count
+  end
+
+  test "revert! logs discard_autosave for an in-progress autosave" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in progress"}, @user1)
+
+    node.revert!(@user1)
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal @user1, action.user
+    assert_equal "discard_autosave", action.action
+  end
+
+  test "revert! logs destroy_draft for a draft with a head behind it" do
+    node = create_node_with_published_page
+    find_or_create_draft(node, @user1)
+
+    node.revert!(@user1)
+
+    action = NodeAction.last
+    assert_equal node, action.node
+    assert_equal @user1, action.user
+    assert_equal "destroy_draft", action.action
+  end
+
+  test "revert! with nothing to revert logs nothing" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    count_before = NodeAction.count
+
+    node.revert!(@user1)
+
+    assert_equal count_before, NodeAction.count
+  end
+
+  test "publish_draft! records the title's from/to in metadata" do
+    node = create_node_with_published_page
+    Globalize.with_locale(:de) { node.head.update!(:title => "Original Title") }
+    find_or_create_draft(node, @user1)
+    Globalize.with_locale(:de) { node.draft.update!(:title => "New Title") }
+
+    node.publish_draft!(@user1)
+
+    action = NodeAction.last
+    assert_equal "Original Title", action.metadata["from"]
+    assert_equal "New Title", action.metadata["to"]
+  end
 end