Add a reader for the action log at admin/log

NodeActionsController#index lists entries newest-first, filterable
by node_id or user_id -- the two zoom shapes the log was designed
around. Rendering goes through NodeActionsHelper.action_summary,
which builds one sentence per entry from metadata alone, so entries
referencing deleted users or nodes render from their snapshots;
live associations only upgrade names to links. Unknown verbs
degrade to a generic sentence rather than an error, since the log
outlives its vocabulary. The helper is the escaping boundary:
every metadata value passes through h() before assembly.

Actor names link to the log's own user zoom rather than the unused
users page -- inspecting a suspicious user's other actions is the
intended workflow. Publish entries with a translation_diff expose
a collapsed per-locale change table linking out to the revision
itself. Sentences live in en.yml/de.yml following the existing
widget-string convention. nodes#show links to its node's zoomed
log.

10 files changed, 309 insertions, 0 deletions

diff --git a/app/controllers/node_actions_controller.rb b/app/controllers/node_actions_controller.rb
new file mode 100644
index 0000000..6e46719
--- /dev/null
+++ b/app/controllers/node_actions_controller.rb
@@ -0,0 +1,14 @@
+class NodeActionsController < ApplicationController
+
+  before_action :login_required
+
+  layout 'admin'
+
+  def index
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc)
+    @actions = @actions.where(:node_id => params[:node_id]) if params[:node_id].present?
+    @actions = @actions.where(:user_id => params[:user_id]) if params[:user_id].present?
+    @actions = @actions.includes(:node, :user)
+                       .paginate(:page => params[:page], :per_page => 50)
+  end
+end
diff --git a/app/helpers/node_actions_helper.rb b/app/helpers/node_actions_helper.rb
new file mode 100644
index 0000000..ef42b75
--- /dev/null
+++ b/app/helpers/node_actions_helper.rb
@@ -0,0 +1,68 @@
+module NodeActionsHelper
+  include ERB::Util
+
+  # One sentence per entry, rendered from metadata alone, so entries
+  # stay renderable after the rows they reference are gone. Live
+  # associations only upgrade plain names to links. Every metadata
+  # value passes through h() here -- this helper is the escaping
+  # boundary; the locale sentences are trusted, the data never is.
+  def action_summary action
+    renderer = "summarize_#{action.action}"
+    return send(renderer, action) if respond_to?(renderer, true)
+
+    # Unknown-verb fallback: the log outlives the vocabulary. A renamed
+    # or future verb degrades to an ugly sentence, never to a 500.
+    t("node_actions.unknown", :actor => actor_ref(action),
+       :action => h(action.action), :subject => subject_ref(action)).html_safe
+  end
+
+  private
+
+  def actor_ref action
+    if action.user && respond_to?(:current_user) && action.user == current_user
+      return t("node_actions.actor_self")
+    end
+    action.user ? link_to(h(action.actor_name), admin_log_path(:user_id => action.user_id))
+                : h(action.actor_name)
+  end
+
+  def subject_ref action
+    action.node ? link_to(h(action.subject_name), node_path(action.node))
+                : h(action.subject_name)
+  end
+
+  def summarize_publish action
+    key = if action.metadata["via"] == "revision"
+            "node_actions.publish_rollback"
+          elsif action.metadata.dig("title", "from").nil?
+            "node_actions.publish_first"
+          else
+            "node_actions.publish"
+          end
+
+    t(key, :actor => actor_ref(action), :subject => subject_ref(action),
+            :from => h(action.metadata.dig("title", "from")),
+            :to   => h(action.metadata.dig("title", "to"))).html_safe
+  end
+
+  def summarize_move action
+    t("node_actions.move", :actor => actor_ref(action), :subject => subject_ref(action),
+       :from => h(action.metadata.dig("path", "from")),
+       :to   => h(action.metadata.dig("path", "to"))).html_safe
+  end
+
+  def summarize_create action
+    t("node_actions.create", :actor => actor_ref(action), :subject => subject_ref(action),
+       :path => h(action.metadata["path"])).html_safe
+  end
+
+  def summarize_discard_autosave action
+    t("node_actions.discard_autosave",
+       :actor => actor_ref(action), :subject => subject_ref(action)).html_safe
+  end
+
+  def summarize_destroy_draft action
+    t("node_actions.destroy_draft",
+       :actor => actor_ref(action), :subject => subject_ref(action)).html_safe
+  end
+end
diff --git a/app/views/node_actions/_change_details.html.erb b/app/views/node_actions/_change_details.html.erb
new file mode 100644
index 0000000..383f53a
--- /dev/null
+++ b/app/views/node_actions/_change_details.html.erb
@@ -0,0 +1,27 @@
+<details class="node_action_details">
+  <summary><%= t("node_actions.show_changes") %></summary>
+  <table>
+    <% action_entry.metadata["translation_diff"].each do |locale, diff| %>
+      <tr>
+        <th><%= locale.upcase %></th>
+        <td>
+          <% case diff["status"] %>
+          <% when "added" %>
+            <%= t("node_actions.locale_added", :title => diff.dig("title", "to")) %>
+          <% when "removed" %>
+            <%= t("node_actions.locale_removed", :title => diff.dig("title", "from")) %>
+          <% else %>
+            <% if diff["title"] %>
+              <%= diff.dig("title", "from") %> → <%= diff.dig("title", "to") %>
+            <% end %>
+            <%= t("node_actions.abstract_changed") if diff["abstract_changed"] %>
+            <%= t("node_actions.body_changed") if diff["body_changed"] %>
+          <% end %>
+        </td>
+      </tr>
+    <% end %>
+  </table>
+  <% if action_entry.page && action_entry.node %>
+    <%= link_to t("node_actions.view_revision"), node_revision_path(action_entry.node, action_entry.page) %>
+  <% end %>
+</details>
diff --git a/app/views/node_actions/index.html.erb b/app/views/node_actions/index.html.erb
new file mode 100644
index 0000000..92740cd
--- /dev/null
+++ b/app/views/node_actions/index.html.erb
@@ -0,0 +1,22 @@
+<h1><%= t("node_actions.heading") %></h1>
+
+<% if params[:node_id].present? || params[:user_id].present? %>
+  <p><%= link_to t("node_actions.show_all"), admin_log_path %></p>
+<% end %>
+
+<%= will_paginate @actions %>
+
+<ul id="node_action_list">
+  <% @actions.each do |action| %>
+    <li class="node_action node_action--<%= action.action %>">
+      <span class="node_action_time"><%= l(action.occurred_at, :format => :ccc) %></span>
+      <% if action.inferred_from %>
+        <span class="node_action_inferred" title="<%= action.inferred_from %>"><%= t("node_actions.backfilled") %></span>
+      <% end %>
+      <span class="node_action_summary"><%= action_summary(action) %></span>
+      <%= render "change_details", :action_entry => action if action.metadata["translation_diff"].present? %>
+    </li>
+  <% end %>
+</ul>
+
+<%= will_paginate @actions %>
diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index 66f04f9..d0eff60 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -183,6 +183,7 @@
         </ul>
       </details>
       <p class="revisions_full_history_link"><%= link_to 'Full history (diff / restore)', node_revisions_path(@node) %></p>
+      <p class)"revisions_full_history_link"><%= link_to t("node_actions.heading"), admin_log_path(:node_id => @node.id) %></p>
     </div>
 
 
diff --git a/config/locales/de.yml b/config/locales/de.yml
index 74cd183..4e7b11d 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -82,3 +82,23 @@ de:
     page_gap: "&hellip;"
     container_aria_label: "Seitennavigation"
     page_aria_label: "Seite %{page}"
+
+  node_actions:
+    heading: "Letzte Änderungen"
+    show_all: "Alle Einträge zeigen"
+    backfilled: "rekonstruiert"
+    show_changes: "Änderungen an Übersetzungen"
+    view_revision: "Diese Revision ansehen"
+    actor_self: "du"
+    unknown: "%{actor} hat %{action} auf %{subject} aus"
+    publish: "%{actor} hat %{subject} veröffentlicht, (vorher: %{from})"
+    publish_first: "%{actor} hat %{subject} zum ersten Mal veröffentlicht"
+    publish_rollback: "%{actor} hat %{subject} auf eine frühere Revision zurückgesetzt (vorher: %{from})"
+    create: "%{actor} hat %{subject} unter %{path} angelegt"
+    move: "%{actor} hat %{subject} von %{from} nach %{to} verschoben"
+    discard_autosave: "%{actor} hat ungespeicherte Änderungen an %{subject} verschoben"
+    destroy_draft: "%{actor} hat den Entwurf von %{subject} verworfen"
+    locale_added: "Übersetzung angelegt, Titel \"%{title}\""
+    locale_removed: "Übersetzung entfernt, letzter Titel \"%{title}\""
+    abstract_changed: "Abstract geändert"
+    body_changed: "Text geändert"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index c52280d..8470778 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -34,3 +34,23 @@ en:
     page_gap: "&hellip;"
     container_aria_label: "Pagination"
     page_aria_label: "Page %{page}"
+
+  node_actions:
+      heading: "Action log"
+      show_all: "Show all entries"
+      backfilled: "backfilled"
+      show_changes: "translation changes"
+      view_revision: "view this revision"
+      actor_self: "you"
+      unknown: "%{actor} did %{action} on %{subject}"
+      publish: "%{actor} published %{subject} (was: %{from})"
+      publish_first: "%{actor} published %{subject} for the first time"
+      publish_rollback: "%{actor} rolled %{subject} back to an earlier revision (was: %{from})"
+      create: "%{actor} created %{subject} at %{path}"
+      move: "%{actor} moved %{subject} from %{from} to %{to}"
+      discard_autosave: "%{actor} discarded unsaved changes on %{subject}"
+      destroy_draft: "%{actor} discarded the draft of %{subject}"
+      locale_added: "translation added, titled \"%{title}\""
+      locale_removed: "translation removed, last titled \"%{title}\""
+      abstract_changed: "abstract changed"
+      body_changed: "body changed"
diff --git a/config/routes.rb b/config/routes.rb
index 8e5ff23..c2b9590 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -86,6 +86,7 @@ Cccms::Application.routes.draw do
       match 'menu_search'      => 'admin#menu_search',      :as => :admin_menu_search,      :via => :get
       match 'conventions'      => 'admin#conventions',      :as => :admin_conventions,      :via => :get
       match 'dashboard_search' => 'admin#dashboard_search', :as => :admin_dashboard_search, :via => :get
+      match 'log'              => 'node_actions#index',     :as => :admin_log,              :via => :get
     end
 
     match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete
diff --git a/test/controllers/node_actions_controller_test.rb b/test/controllers/node_actions_controller_test.rb
new file mode 100644
index 0000000..8bc68ec
--- /dev/null
+++ b/test/controllers/node_actions_controller_test.rb
@@ -0,0 +1,51 @@
+require 'test_helper'
+
+class NodeActionsControllerTest < ActionController::TestCase
+
+  def setup
+    login_as :quentin
+  end
+
+  def logged_node slug, title
+    node = Node.root.children.create!(:slug => slug)
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => title) }
+    node
+  end
+
+  test "index renders" do
+    get :index
+    assert_response :success
+  end
+
+  test "index filters by node" do
+    node_a = logged_node("log_filter_a", "Alpha Subject")
+    node_b = logged_node("log_filter_b", "Beta Subject")
+    NodeAction.record!(:node => node_a, :action => "create", :user => users(:quentin))
+    NodeAction.record!(:node => node_b, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :node_id => node_a.id }
+
+    assert_response :success
+    assert_includes    @response.body, "Alpha Subject"
+    assert_not_includes @response.body, "Beta Subject"
+  end
+
+  test "index filters by user" do
+    node = logged_node("log_filter_user", "Gamma Subject")
+    NodeAction.record!(:node => node, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :user_id => users(:quentin).id }
+    assert_includes @response.body, "Gamma Subject"
+
+    other = User.where.not(:id => users(:quentin).id).first
+    get :index, params: { :user_id => other.id }
+    assert_not_includes @response.body, "Gamma Subject"
+  end
+
+  test "index requires login" do
+    session[:user_id] = nil
+    @controller.instance_variable_set(:@current_user, nil)
+    get :index
+    assert_response :redirect
+  end
+end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
new file mode 100644
index 0000000..93bbdf6
--- /dev/null
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -0,0 +1,85 @@
+require 'test_helper'
+
+class NodeActionsHelperTest < ActionView::TestCase
+  def setup
+    @original_locale = I18n.locale
+    I18n.locale = :en
+  end
+
+  def default_url_options
+    { :locale => nil }
+  end
+
+  def teardown
+    I18n.locale = @original_locale
+  end
+
+  def entry action, metadata = {}, node: nil, user: nil, page: nil
+    NodeAction.create!(:node => node, :user => user, :page => page,
+                        :action => action, :occurred_at => Time.now,
+                        :metadata => { "username" => "quentin",
+                                       "human_readable_node_name" => "Subject" }.merge(metadata))
+  end
+
+  test "publish renders the title pair" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_includes out, "quentin"
+    assert_includes out, "Old"
+  end
+
+  test "first publish uses its own sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => nil, "to" => "New" } }))
+
+    assert_includes out, "for the first time"
+  end
+
+  test "rollback publishes get the rollback sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "revision", "title" => { "from" => "Now", "to" => "Then" } }))
+
+    assert_includes out, "rolled"
+  end
+
+  test "move renders the path pair" do
+    out = action_summary(entry("move",
+      { "path" => { "from" => "a/b", "to" => "a/c" } }))
+
+    assert_includes out, "a/b"
+    assert_includes out, "a/c"
+  end
+
+  test "unknown verbs degrade to a generic sentence, never an error" do
+    out = action_summary(entry("frobnicate"))
+
+    assert_includes out, "frobnicate"
+    assert_includes out, "quentin"
+  end
+
+  test "dead references render as plain names from metadata, no links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_not_includes out, "<a "
+    assert_includes out, "Subject"
+  end
+
+  test "metadata values are escaped" do
+    out = action_summary(entry("publish",
+      { "human_readable_node_name" => "<b>bold</b>",
+        "title" => { "from" => "<script>alert(1)</script>", "to" => "x" } }))
+
+    assert_not_includes out, "<script>"
+    assert_not_includes out, "<b>"
+  end
+
+  test "live associations upgrade names to links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } },
+      :user => users(:quentin)))
+
+    assert_includes out, "<a "
+  end
+end