Repository navigation
Conversation
… out of shared caches `Publisher::redactAll()` redacted only the `is_current` versions before flipping the publication to Redacted. Every superseded version kept its sealed payload readable in the database, so a GDPR Art. 17 erasure held only for as long as nothing ever read history. Now every not-yet-redacted version of the publication is redacted; versions already redacted on their own are left untouched. The public tombstone changes with it. A redacted passport answers `410 Gone` (the state is irreversible), while a withdrawn one stays `200` because it can be reinstated. Both tombstones are now `private, no-store` and `noindex`: the package has no cache purge hook, so a shared cache must never hold a tombstone that a reinstatement would have to displace, and the tombstone must not be indexed regardless of the channel's `indexable` setting. Tests: redactAll nulls superseded payloads and stamps the reason on them; a version redacted individually earlier keeps its own reason; the redacted route is 410 + no-store + noindex; the withdrawn route is 200 + no-store + noindex.
This was referenced Sep 4, 2026
Contributor
Author
|
Context, motivation and suggested review order for this and the related PRs: #683 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Publisher::redactAll()redacts only theis_currentversions and then flips the publication toRedacted. Every superseded version keeps its sealed payload readable in the database.The method's own docblock frames it as GDPR Art. 17 erasure. As written, that erasure holds only for as long as nothing reads history: an admin export, an audit view, or any future per-version route would find earlier payloads intact under a publication that claims to be redacted.
Fix
Redact every version of the publication that has not been redacted yet, superseded ones included. Versions redacted individually earlier keep their own
redacted_at/ reason and are skipped, soredactAll()cannot throw on them. The empty-publication guard is unchanged.The public tombstone is adjusted alongside, since both are about what a redaction guarantees:
410 Gone. The state is irreversible, and 410 still resolves (a 404 would let a caller infer a passport never existed, which the enum docblock rightly avoids).200, because it can be reinstated.private, no-storeandnoindex, nofollow. The package has no cache-purge hook, so a shared cache must never hold a tombstone that a reinstatement would have to displace, and a tombstone must not be indexed regardless of the channel'sindexablesetting. Live pages keep the existings-maxagebehaviour.The
If-None-Matchpath already keys the ETag on status, so it is unaffected.Tests
redacts superseded versions too, not only the current oneleaves a version that was already redacted individually untouchedanswers 410 Gone, uncacheable and unindexable, for a redacted passportkeeps a withdrawn tombstone out of shared caches while still answering 200Existing redaction, tombstone and 304 tests pass unchanged.
Related
Third in a series on making sealed passport states trustworthy over the product lifetime, after #677 (keep the document index of superseded versions) and #678 (content-addressed document copies).