5 files changed, 157 insertions, 12 deletions

diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index ed5f8ef..b66ea49 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -50,6 +50,9 @@ class NodesController < ApplicationController
       @node.draft.save!
 
       @node.update!(default_template_name: config[:template]) if config && config[:template]
+      NodeAction.record!(:node => @node, :page => @node.draft, :user => current_user,
+                          :action => "create",
+                          :title => params[:title], :path => @node.unique_name)
 
       redirect_to(edit_node_path(@node))
     else
diff --git a/app/controllers/page_translations_controller.rb b/app/controllers/page_translations_controller.rb
index be4f488..38a7c4f 100644
--- a/app/controllers/page_translations_controller.rb
+++ b/app/controllers/page_translations_controller.rb
@@ -63,9 +63,6 @@ class PageTranslationsController < ApplicationController
     draft.translations.where(:locale => @locale).delete_all
     draft.reload
 
-    NodeAction.record!(:node => @node, :page => draft, :user => current_user,
-                        :action => "translation_destroy", :locale => @locale)
-
     flash[:notice] = "#{@locale.upcase} translation removed from the draft. Publish to make this permanent."
     redirect_to node_path(@node)
   rescue LockedByAnotherUser => e
diff --git a/app/controllers/revisions_controller.rb b/app/controllers/revisions_controller.rb
index c5932a4..c1237a9 100644
--- a/app/controllers/revisions_controller.rb
+++ b/app/controllers/revisions_controller.rb
@@ -49,7 +49,7 @@ class RevisionsController < ApplicationController
 
   def restore
     page = Page.find(params[:id])
-    page.node.restore_revision! page.revision
+    page.node.restore_revision! page.revision, current_user
     flash[:notice] = "Revision #{page.revision} restored"
     redirect_to node_path(page.node)
   end
diff --git a/app/models/node.rb b/app/models/node.rb
index b41df06..6ca607d 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -194,17 +194,19 @@ class Node < ApplicationRecord
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
+    path_before = self.unique_name
+
     ActiveRecord::Base.transaction do
       if self.draft
-        previous_title = self.head ? Globalize.with_locale(I18n.default_locale) { self.head.title } : nil
+        outgoing_head = self.head
         self.head = self.draft
         self.head.published_at ||= Time.now
         self.head.save!
         self.draft = nil
 
-        new_title = Globalize.with_locale(I18n.default_locale) { self.head.title }
         NodeAction.record!(:node => self, :page => self.head, :user => current_user,
-                            :action => "publish", :from => previous_title, :to => new_title)
+                            :action => "publish", :via => "draft",
+                            **NodeAction.head_diff(outgoing_head, self.head))
       end
 
       if staged_slug && (staged_slug != slug)
@@ -231,17 +233,28 @@ class Node < ApplicationRecord
       self.reload
       self.update_unique_name
       self.send(:update_unique_names_of_children)
+      if self.unique_name != path_before
+        NodeAction.record!(:node => self, :user => current_user, :action => "move",
+                            :path => { "from" => path_before, "to" => self.unique_name })
+      end
       self.unlock!
       self
     end
   end
 
-  def restore_revision! revision
-    if page = self.pages.find_by_revision(revision)
+  def restore_revision! revision, current_user = nil
+    page = self.pages.find_by_revision(revision)
+    return nil unless page
+
+    ActiveRecord::Base.transaction do
+      outgoing_head = self.head
       self.head = page
-      self.save
-    else
-      nil
+      self.save!
+
+      NodeAction.record!(:node => self, :page => page, :user => current_user,
+                          :action => "publish", :via => "revision",
+                          **NodeAction.head_diff(outgoing_head, page))
+      self
     end
   end
 
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
index f32b5b7..39935c7 100644
--- a/app/models/node_action.rb
+++ b/app/models/node_action.rb
@@ -6,6 +6,82 @@ class NodeAction < ApplicationRecord
   validates :action, presence: true
   validates :occurred_at, presence: true
 
+  # == Metadata contract ==
+  #
+  # metadata is written once at creation and never updated. It is the
+  # single place anything that must survive deletion of the referenced
+  # rows lives; node_id/page_id/user_id are lookup and ordering only.
+  # All keys are strings. Pairs are always {"from" => x, "to" => y} --
+  # never _old/_new suffixes. Optional pairs are written only when the
+  # two sides differ; required keys are always present. All titles and
+  # names are read pinned to I18n.default_locale unless inside a
+  # locale-keyed block.
+  #
+  # Baseline, every entry (written here, not by call sites):
+  #   "username"                 -- actor's login at write time
+  #   "human_readable_node_name" -- node title, default locale
+  #
+  # "create":
+  #   "title" -- initial title, default locale
+  #   "path"  -- unique path at creation time. Historical value only:
+  #              later renames/moves do NOT update old entries. Never
+  #              use as a join key; node_id is the join key while the
+  #              node lives.
+  #
+  # "publish" (any promotion of a page to head; the diff against the
+  # outgoing head is computed BEFORE head is re-pointed, over the
+  # union of both pages' locales, by the shared diff function also
+  # used by the backfill):
+  #   "via"    -- "draft" (ordinary publish) | "revision" (rollback
+  #               via restore_revision!). Always written; absent
+  #               means a pre-contract entry.
+  #   "title"  -- pair, always present. "from" is null on a first
+  #               publish (no outgoing head).
+  #   "author" -- pair, only when the byline (page.user) changed
+  #   "tags"   -- pair of arrays, only when changed
+  #   "assets_changed", "template_changed"
+  #            -- booleans, only when true; page_id links to the
+  #               revision for the real diff (never stored here)
+  #   "abstract_changed", "body_changed"
+  #            -- booleans for the default locale, only when true
+  #   "translation_diff" -- only when any non-default locale differs:
+  #     { "<locale>" => {
+  #         "status"           -- "added" | "removed" | "changed"
+  #         "title"            -- pair; "from" null when added,
+  #                               "to" null when removed
+  #         "abstract_changed", "body_changed" -- booleans, only when
+  #                               true, only for status "changed"
+  #     } }
+  #
+  # "move" (reparenting and/or unique-path change; one entry at the
+  # subtree root, descendants get none -- a descendant's own zoomed
+  # view will not show path history):
+  #   "path"  -- pair
+  #
+  # Reserved for the Trash feature, final shape decided there:
+  # "demote" (via "trash" | "depublish"; carries the leaving-public-
+  # view snapshot: head presence, final published_at), "trash",
+  # "restore_from_trash", "destroy" (final path only; publish-state
+  # snapshot lives on the entry that removed it from public view).
+  # Whether trash logs one entry or a trash+demote pair is decided
+  # with that feature.
+  #
+  # Backfilled entries mirror this vocabulary exactly. Their diff
+  # content is computed, not guessed (consecutive revisions still
+  # exist); only actor (from page.editor) and occurred_at are
+  # inferred, and inferred_from names the heuristic per entry
+  # ("from_page_revision", "from_published_at_heuristic").
+  # inferred_from null = witnessed live.
+  #
+  # The "locale" column is currently written by no verb (it belonged
+  # to the retired translation_destroy) and is retained for backfill
+  # or future draft-scoped verbs.
+  #
+  # This log records; it does not undo. Reversibility stays in
+  # restore_revision! and the revisions system. No IP, session, or
+  # user agent, ever. Success only -- rejected attempts are not
+  # logged.
+
   def self.record!(node:, action:, user: nil, page: nil, locale: nil, **extra)
     create!(
       :node        => node,
@@ -23,6 +99,62 @@ class NodeAction < ApplicationRecord
    )
   end
 
+  # Computes the publish-entry diff between an outgoing head and the
+  # page replacing it, in the exact metadata shape the contract above
+  # specifies. Pure function of its two arguments -- shared verbatim by
+  # publish_draft!, restore_revision!, and the backfill task. Reads
+  # translation rows directly, never locale-dependent accessors, so a
+  # fallback value is never mistaken for real content. Returns
+  # symbol-keyed top level for splatting into record!; nested keys are
+  # strings and jsonb serialization stringifies the rest at write time.
+  def self.head_diff old_page, new_page
+    default = I18n.default_locale
+
+    title_of = ->(page) { page&.translations&.find_by(:locale => default)&.title }
+    diff = { :title => { "from" => title_of.call(old_page),
+                         "to"   => title_of.call(new_page) } }
+    return diff unless old_page
+
+    old_author, new_author = old_page.user&.login, new_page.user&.login
+    diff[:author] = { "from" => old_author, "to" => new_author } if old_author != new_author
+
+    old_tags, new_tags = old_page.tag_list.sort, new_page.tag_list.sort
+    diff[:tags] = { "from" => old_tags, "to" => new_tags } if old_tags != new_tags
+
+    diff[:template_changed] = true if old_page.template_name != new_page.template_name
+    diff[:assets_changed]   = true if old_page.assets.map(&:id) != new_page.assets.map(&:id)
+
+    old_t = old_page.translations.find_by(:locale => default)
+    new_t = new_page.translations.find_by(:locale => default)
+    diff[:abstract_changed] = true if old_t&.abstract != new_t&.abstract
+    diff[:body_changed]     = true if old_t&.body != new_t&.body
+
+    locales = (old_page.translated_locales | new_page.translated_locales) - [default]
+    translation_diff = {}
+
+    locales.sort_by(&:to_s).each do |locale|
+      o = old_page.translations.find_by(:locale => locale)
+      n = new_page.translations.find_by(:locale => locale)
+
+      if o.nil?
+        translation_diff[locale.to_s] = { "status" => "added",
+                                          "title" => { "from" => nil, "to" => n.title } }
+      elsif n.nil?
+        translation_diff[locale.to_s] = { "status" => "removed",
+                                          "title" => { "from" => o.title, "to" => nil } }
+      elsif o.title != n.title || o.abstract != n.abstract || o.body != n.body
+        entry = { "status" => "changed" }
+        entry["title"]            = { "from" => o.title, "to" => n.title } if o.title != n.title
+        entry["abstract_changed"] = true if o.abstract != n.abstract
+        entry["body_changed"]     = true if o.body != n.body
+        translation_diff[locale.to_s] = entry
+      end
+    end
+
+    diff[:translation_diff] = translation_diff if translation_diff.any?
+    diff
+  end
+
   def actor_name
     metadata["username"] || "unknown"
   end