From 742705eadd67b25a51f0b678ea8616d8eb75f014 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 20 Oct 2026 11:01:19 +0200 Subject: [PATCH] docs(audit): say why two import refusals stay audit rows The export imports log a refused upload as a signal. The admin import and the medication intake import kickoff keep audit rows on purpose: one is an administrator acting on another account, the other is shown to the record's owner in the activity feed. --- src/app/api/admin/import-apple-health-export/route.ts | 4 ++++ src/lib/medications/intake-import-admission.ts | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/app/api/admin/import-apple-health-export/route.ts b/src/app/api/admin/import-apple-health-export/route.ts index ab4b03e51..798061698 100644 --- a/src/app/api/admin/import-apple-health-export/route.ts +++ b/src/app/api/admin/import-apple-health-export/route.ts @@ -55,6 +55,10 @@ export const POST = apiHandler(async (request: NextRequest) => { throw new HttpError(429, "Too many import uploads, try again later"); } + // A refused upload is an audit row here, not the signal the user-facing + // import routes emit for the same refusals: this is an administrator + // acting on another person's account, and every attempt at that, refused + // ones included, belongs in the trail an operator reviews. const declaredBytes = Number(request.headers.get("content-length") ?? 0); if (declaredBytes > MAX_UPLOAD_BYTES) { await auditLog("admin.import-apple-health.kickoff.denied", { diff --git a/src/lib/medications/intake-import-admission.ts b/src/lib/medications/intake-import-admission.ts index abd0d4197..591140da9 100644 --- a/src/lib/medications/intake-import-admission.ts +++ b/src/lib/medications/intake-import-admission.ts @@ -171,6 +171,10 @@ export async function admitIntakeImportJob({ completedAt, }, }); + // An audit row, unlike the upload refusals of the export imports, which + // are signals: this one is shown to the record's owner in the activity + // feed (`record-activity/activity-verb.ts`) as an import that was + // admitted and never ran, and it carries the delegate who started it. await auditLog("medication.intake.import.kickoff.denied", { userId: recordUserId, actorUserId,