From 4fcff2367a094b891bd148d5bfc91908b66335c3 Mon Sep 17 00:00:00 2001 From: "bert.hausmans" Date: Fri, 24 Apr 2026 22:51:09 +0200 Subject: [PATCH] =?UTF-8?q?docs(backlog):=20open=20FORM-BUILDER-LIBRARY-AU?= =?UTF-8?q?DIT-LOG=20=E2=80=94=20library-level=20activity-log=20gap=20surf?= =?UTF-8?q?aced=20during=20WS-5b=20review?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dev-docs/BACKLOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dev-docs/BACKLOG.md b/dev-docs/BACKLOG.md index 098a39b1..64ff7dd0 100644 --- a/dev-docs/BACKLOG.md +++ b/dev-docs/BACKLOG.md @@ -336,6 +336,15 @@ shifts claimen zonder toegang tot de Organizer app. --- +### FORM-BUILDER-LIBRARY-AUDIT-LOG — Audit FormFieldLibrary-level changes to bindings, validation rules, and configs + +**Aanleiding:** Post-WS-5b, three form-builder child-table services (`FormFieldBindingService`, `FormFieldValidationRuleService`, `FormFieldConfigService`) emit activity-log events on FormField subjects only. Changes to FormFieldLibrary entries — which affect organisation-wide reusable field definitions — land silently in the audit log. This is the consistent behaviour inherited from WS-5a and extended through WS-5b, but it represents an audit-trail gap for library administration. +**Wat:** introduce parallel `library.*` activity-log events (`library.bindings_replaced`, `library.validation_rules_replaced`, `library.configs_replaced`) emitted by the same three services when the owner is a `FormFieldLibrary`. Document the convention addition in `ARCH-FORM-BUILDER.md` §6.7 and §17.4.2 + §17.5.2. Single cross-cutting work package. +**Prioriteit:** Middel — geen blocker; candidate sprint post-WS-5, before any external audit tooling is wired up (consumers shouldn't have to deal with the asymmetry). +**Related:** WS-5a §6.7 activity log events paragraph; WS-5b §17.4.2 / §17.5.2 paragraphs. + +--- + ### FORM-04 — `grace_days` configurable on public_token rotation **Aanleiding:** S2c §10.4 opgeleverd met een hardgecodeerd 7-daagse grace window in `PublicFormTokenResolver`. `rotatePublicToken` endpoint accepteert wel een `grace_days` request param maar schrijft die nergens naartoe; `form_schemas` heeft geen `grace_days` kolom.