* feat(audit): log trusted-role committed_at overrides to behandlingshistorik (#1444)
Migrations 20260806150000/160000 let backend writers (service_role,
no-claims direct SQL) preserve a preset committed_at on the draft-to-posted
transition, but nothing recorded that the transition timestamp was
overridden: BFNAR 2013:2 kap 8 wants a log of who did what, when. If a
trusted-role connection is ever used against a live company, there is now
an audit row separating real from preset commit time.
- audit_log accepts action COMMITTED_AT_OVERRIDE (types + Zod filter too)
- log_committed_at_override() SECURITY DEFINER writer: audit_log has RLS
with no INSERT policy and service_role is not guaranteed BYPASSRLS in
every harness; EXECUTE revoked from anon/authenticated so PostgREST
cannot expose it as an RPC
- set_committed_at() calls the writer in the preserve branch; the stamping
branch is unchanged from 20260806160000
- pg tests: override row content (preset value, wall clock, jwt role) for
postgres and service_role writers, absence on the stamp paths, and the
writer's privilege lockdown
Closes#1444
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* review(audit): stamp wall_clock with clock_timestamp(), not now()
Seeding flows post many entries inside one transaction; now() would pin
every override row's wall_clock to the BEGIN instead of the actual
transition moment. Captured once so new_state and description agree.
Test posts inside an explicit transaction after pg_sleep and asserts
wall_clock moved past the transaction start.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
