feat: activity log producers

Taskfile.yml

@@ -178,8 +178,7 @@ tasks:
   mutate:
     desc: Gremlins mutation testing of the use cases → tmp/gremlins.json
     cmds:
-      - mkdir -p tmp
-      - gremlins unleash --integration --tags nofrontend --coverpkg=./internal/infrastructure/useCases/...,./api/middleware/...,./api/pkg/claims/... --timeout-coefficient 10 --output tmp/gremlins.json ./internal/infrastructure/useCases ./api/middleware ./api/pkg/claims
+      - bash scripts/mutate.sh
 
   test:web:
     desc: Run the SPA test suite (Vitest) in run mode

api/dependecyInjection.go

@@ -264,43 +264,43 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 	hasher := hashing.NewBcryptHasher()
 	renderer := markdown.NewConverter()
 	keyGenerator := hashing.NewSHA256KeyGenerator()
-	mergeMedia := useCases.NewMergeMediaUseCase(repos.ImageRepo, repos.ArticleRepo, imageStorage)
-
-	runPurge := useCases.NewRunPurgeUseCase(repos.ImageRepo, repos.ArticleRepo, mergeMedia, repos.PurgeSettingsRepo, time.Now, log.Default())
-	purgeScheduler := useCases.NewPurgeSchedulerUseCase(repos.PurgeSettingsRepo, runPurge)
 	recorder := auditing.NewRecorder(repos.AuditRepo, time.Now, log.Default())
+	mergeMedia := useCases.NewMergeMediaUseCase(repos.ImageRepo, repos.ArticleRepo, imageStorage, recorder)
+
+	runPurge := useCases.NewRunPurgeUseCase(repos.ImageRepo, repos.ArticleRepo, mergeMedia, repos.PurgeSettingsRepo, time.Now, log.Default(), recorder)
+	purgeScheduler := useCases.NewPurgeSchedulerUseCase(repos.PurgeSettingsRepo, runPurge, recorder)
 	activityCleanup := useCases.NewCleanupActivityUseCase(repos.AuditRepo, repos.AuditSettingsRepo, recorder)
 
 	return &UseCases{
 		PurgeScheduler:                 scheduler.NewSystemRunner(purgeScheduler, log.Default()),
 		ActivityCleanupScheduler:       scheduler.NewSystemCleanupRunner(activityCleanup, log.Default()),
 		Token:                          jwtauth.New("HS256", []byte(settings.JWTSecret), nil),
-		CreateArticleUseCase:           useCases.NewCreateArticleUseCase(repos.ArticleRepo, renderer),
+		CreateArticleUseCase:           useCases.NewCreateArticleUseCase(repos.ArticleRepo, renderer, recorder),
 		GetArticleUseCase:              useCases.NewGetArticleUseCase(repos.ArticleRepo, renderer),
 		ListArticlesUseCase:            useCases.NewListArticlesUseCase(repos.ArticleRepo, renderer),
-		UpdateArticleUseCase:           useCases.NewUpdateArticleUseCase(repos.ArticleRepo, renderer),
-		DeleteArticleUseCase:           useCases.NewDeleteArticleUseCase(repos.ArticleRepo),
+		UpdateArticleUseCase:           useCases.NewUpdateArticleUseCase(repos.ArticleRepo, renderer, recorder),
+		DeleteArticleUseCase:           useCases.NewDeleteArticleUseCase(repos.ArticleRepo, recorder),
 		GetUserUseCase:                 useCases.NewGetUserUseCase(repos.UserRepo),
-		CreateUserUseCase:              useCases.NewCreateUserUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL),
+		CreateUserUseCase:              useCases.NewCreateUserUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL, recorder),
 		AuthenticateUserUseCase:        useCases.NewAuthenticateUserUseCase(repos.UserRepo, hasher, recorder),
-		VerifyUserUseCase:              useCases.NewVerifyUserUseCase(repos.UserRepo, hasher),
+		VerifyUserUseCase:              useCases.NewVerifyUserUseCase(repos.UserRepo, hasher, recorder),
 		CancelRegistrationUseCase:      useCases.NewCancelRegistrationUseCase(repos.UserRepo),
 		RequestPasswordResetUseCase:    useCases.NewRequestPasswordResetUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL, recorder),
 		ResetPasswordUseCase:           useCases.NewResetPasswordUseCase(repos.UserRepo, hasher, repos.APIKeyRepo, time.Now, recorder),
-		UpdateUserProfileUseCase:       useCases.NewUpdateUserProfileUseCase(repos.UserRepo),
+		UpdateUserProfileUseCase:       useCases.NewUpdateUserProfileUseCase(repos.UserRepo, recorder),
 		ListUsersUseCase:               useCases.NewListUsersUseCase(repos.UserRepo),
-		CreateInviteUseCase:            useCases.NewCreateInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL),
-		CancelInviteUseCase:            useCases.NewCancelInviteUseCase(repos.InviteRepo),
-		RenewInviteUseCase:             useCases.NewRenewInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL),
+		CreateInviteUseCase:            useCases.NewCreateInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL, recorder),
+		CancelInviteUseCase:            useCases.NewCancelInviteUseCase(repos.InviteRepo, recorder),
+		RenewInviteUseCase:             useCases.NewRenewInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL, recorder),
 		ListUsersAndInvitesUseCase:     useCases.NewListUsersAndInvitesUseCase(repos.UserRepo, repos.InviteRepo),
 		GetInviteUseCase:               useCases.NewGetInviteUseCase(repos.InviteRepo, hasher),
-		AcceptInviteUseCase:            useCases.NewAcceptInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher),
+		AcceptInviteUseCase:            useCases.NewAcceptInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, recorder),
 		SendMailUseCase:                useCases.NewSendMailUseCase(repos.MailRepo),
-		CreateImageUseCase:             useCases.NewCreateImageUseCase(repos.ImageRepo, imageStorage),
+		CreateImageUseCase:             useCases.NewCreateImageUseCase(repos.ImageRepo, imageStorage, recorder),
 		OpenMediaUseCase:               useCases.NewOpenMediaUseCase(imageStorage),
 		ListMediaUseCase:               useCases.NewListMediaUseCase(repos.ImageRepo, repos.ArticleRepo, repos.UserRepo),
-		RenameMediaUseCase:             useCases.NewRenameMediaUseCase(repos.ImageRepo),
-		DeleteMediaUseCase:             useCases.NewDeleteMediaUseCase(repos.ImageRepo, imageStorage),
+		RenameMediaUseCase:             useCases.NewRenameMediaUseCase(repos.ImageRepo, recorder),
+		DeleteMediaUseCase:             useCases.NewDeleteMediaUseCase(repos.ImageRepo, imageStorage, recorder),
 		MergeMediaUseCase:              mergeMedia,
 		GetMediaUsageUseCase:           useCases.NewGetMediaUsageUseCase(repos.ImageRepo, repos.ArticleRepo),
 		GetPurgeSettingsUseCase:        useCases.NewGetPurgeSettingsUseCase(repos.PurgeSettingsRepo),
@@ -309,9 +309,9 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 		RunPurgeUseCase:                runPurge,
 		GetSettingsUseCase:             useCases.NewGetSettingsUseCase(settings.Version),
 		GetUpdateStatusUseCase:         useCases.NewGetUpdateStatusUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, settings.Container, time.Now),
-		CheckForUpdateUseCase:          useCases.NewCheckForUpdateUseCase(repos.ReleaseFeed, repos.UpdateStore, settings.Version, time.Now),
-		StartUpdateDownloadUseCase:     startUpdateDownloadUseCase(repos, settings),
-		RequestRestartUseCase:          useCases.NewRequestRestartUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, time.Now),
+		CheckForUpdateUseCase:          useCases.NewCheckForUpdateUseCase(repos.ReleaseFeed, repos.UpdateStore, settings.Version, time.Now, recorder),
+		StartUpdateDownloadUseCase:     startUpdateDownloadUseCase(repos, settings, recorder),
+		RequestRestartUseCase:          useCases.NewRequestRestartUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, time.Now, recorder),
 		RecordRunningInfoUseCase:       useCases.NewRecordRunningInfoUseCase(repos.RunningInfo, settings.Version, os.Getpid(), time.Now),
 		CreateAPIKeyUseCase:            useCases.NewCreateAPIKeyUseCase(repos.APIKeyRepo, keyGenerator, time.Now, recorder),
 		ListAPIKeysUseCase:             useCases.NewListAPIKeysUseCase(repos.APIKeyRepo, repos.UserRepo, time.Now),
@@ -325,7 +325,7 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 	}
 }
 
-func startUpdateDownloadUseCase(repos *Repositories, settings config.Settings) *useCases.StartUpdateDownloadUseCase {
+func startUpdateDownloadUseCase(repos *Repositories, settings config.Settings, recorder domainAudit.Recorder) *useCases.StartUpdateDownloadUseCase {
 	return useCases.NewStartUpdateDownloadUseCase(useCases.StartUpdateDownloadDependencies{
 		Store:          repos.UpdateStore,
 		Jobs:           repos.UpdateJobs,
@@ -342,6 +342,7 @@ func startUpdateDownloadUseCase(repos *Repositories, settings config.Settings) *
 		Platform:       domainUpdate.Platform{OS: runtime.GOOS, Arch: runtime.GOARCH},
 		FeedURL:        settings.UpdateFeedURL,
 		Now:            time.Now,
+		Recorder:       recorder,
 	})
 }
 

api/handlers/article/articleHandler.go

@@ -149,7 +149,7 @@ func (h *Handler) PostArticle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	createdArticle, err := h.CreateUseCase.CreateArticle(useCases.CreateArticleCommand{
+	createdArticle, err := h.CreateUseCase.CreateArticle(r.Context(), useCases.CreateArticleCommand{
 		Title:  localArticle.Title,
 		Body:   localArticle.Body,
 		Format: format,
@@ -201,7 +201,7 @@ func (h *Handler) setIsOnline(w http.ResponseWriter, r *http.Request, isOnline b
 		return
 	}
 
-	updatedArticle, err := h.UpdateUseCase.UpdateIsOnline(id, isOnline, format)
+	updatedArticle, err := h.UpdateUseCase.UpdateIsOnline(r.Context(), id, isOnline, format)
 	if err != nil {
 		writeArticleErrorResponse(w, err)
 		return
@@ -237,7 +237,7 @@ func (h *Handler) UpdateArticleBody(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	updatedArticle, err := h.UpdateUseCase.UpdateBody(id, localArticle.Body, format)
+	updatedArticle, err := h.UpdateUseCase.UpdateBody(r.Context(), id, localArticle.Body, format)
 	if err != nil {
 		writeArticleErrorResponse(w, err)
 		return
@@ -314,7 +314,7 @@ func (h *Handler) DeleteArticle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.DeleteUseCase.DeleteArticle(id); err != nil {
+	if err := h.DeleteUseCase.DeleteArticle(r.Context(), id); err != nil {
 		if errors.Is(err, domain.ErrArticleNotFound) {
 			http.Error(w, apperr.ArticleNotFoundErrorMessage, http.StatusNotFound)
 			return

api/handlers/auth/acceptInviteHandler.go

@@ -67,7 +67,7 @@ func (h *AcceptInviteHandler) AcceptInvite(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	createdUser, err := h.AcceptInviteUseCase.AcceptInvite(useCases.AcceptInviteCommand{
+	createdUser, err := h.AcceptInviteUseCase.AcceptInvite(r.Context(), useCases.AcceptInviteCommand{
 		Code:     request.Code,
 		Username: request.Username,
 		Password: request.Password,

api/handlers/auth/loginHandler.go

@@ -113,7 +113,7 @@ func (h *LoginHandler) Register(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	createdUser, err := h.CreateUseCase.CreateUser(useCases.CreateUserCommand{
+	createdUser, err := h.CreateUseCase.CreateUser(r.Context(), useCases.CreateUserCommand{
 		Username: credentials.Username,
 		Password: credentials.Password,
 		Email:    credentials.Email,

api/handlers/auth/verificationHandler.go

@@ -50,7 +50,7 @@ func (h *VerificationHandler) Verify(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	verifiedUser, err := h.VerifyUseCase.Verify(userId, credentials.Code)
+	verifiedUser, err := h.VerifyUseCase.Verify(r.Context(), userId, credentials.Code)
 	if err != nil {
 		if errors.Is(err, user.ErrUserNotFound) {
 			http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)

api/handlers/media/mediaHandler.go

@@ -213,7 +213,7 @@ func (h *Handler) Upload(w http.ResponseWriter, r *http.Request) {
 	}
 	defer closeFile()
 
-	created, err := h.CreateUseCase.CreateImage(input)
+	created, err := h.CreateUseCase.CreateImage(r.Context(), input)
 	if err != nil {
 		upload.WriteCreateError(w, err)
 		return
@@ -247,7 +247,7 @@ func (h *Handler) Rename(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	renamed, err := h.RenameUseCase.Rename(id, request.Filename)
+	renamed, err := h.RenameUseCase.Rename(r.Context(), id, request.Filename)
 	if err != nil {
 		if errors.Is(err, domainImage.ErrInvalidFilename) {
 			http.Error(w, apperr.MediaFilenameErrorMessage, http.StatusBadRequest)
@@ -266,7 +266,7 @@ func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.DeleteUseCase.Delete(id); err != nil {
+	if err := h.DeleteUseCase.Delete(r.Context(), id); err != nil {
 		writeImageError(w, err)
 		return
 	}
@@ -304,7 +304,7 @@ func (h *Handler) Merge(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	result, err := h.MergeUseCase.Merge(request.KeepID, request.MergeIDs)
+	result, err := h.MergeUseCase.Merge(r.Context(), request.KeepID, request.MergeIDs)
 	if err != nil {
 		writeMergeError(w, err)
 		return

api/handlers/media/purgeHandler.go

@@ -154,7 +154,7 @@ func (h *Handler) RunPurge(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	result, err := h.RunPurgeUseCase.Run(request.Fingerprint)
+	result, err := h.RunPurgeUseCase.Run(r.Context(), request.Fingerprint)
 	if err != nil {
 		writePurgeError(w, err)
 		return

api/handlers/update/updateHandler.go

@@ -47,7 +47,7 @@ func (h *Handler) GetStatus(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) Check(w http.ResponseWriter, r *http.Request) {
-	if _, err := h.CheckForUpdateUseCase.Check(); err != nil {
+	if _, err := h.CheckForUpdateUseCase.Check(r.Context()); err != nil {
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}
@@ -58,8 +58,8 @@ func (h *Handler) Check(w http.ResponseWriter, r *http.Request) {
 	writeStatus(w, http.StatusOK, h.GetUpdateStatusUseCase.GetStatus(isOwner))
 }
 
-func (h *Handler) Download(w http.ResponseWriter, _ *http.Request) {
-	status, err := h.StartUpdateDownloadUseCase.Start()
+func (h *Handler) Download(w http.ResponseWriter, r *http.Request) {
+	status, err := h.StartUpdateDownloadUseCase.Start(r.Context())
 	if err != nil {
 		writeDownloadError(w, err)
 		return
@@ -77,7 +77,7 @@ func (h *Handler) Restart(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized)
 		return
 	}
-	status, err := h.RequestRestartUseCase.Request(userId, kind)
+	status, err := h.RequestRestartUseCase.Request(r.Context(), userId, kind)
 	if err != nil {
 		writeRestartError(w, err)
 		return

api/handlers/user/inviteHandler.go

@@ -82,7 +82,7 @@ func (h *InviteHandler) CreateInvite(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	created, err := h.CreateInviteUseCase.CreateInvite(useCases.CreateInviteCommand{
+	created, err := h.CreateInviteUseCase.CreateInvite(r.Context(), useCases.CreateInviteCommand{
 		Email:     request.Email,
 		InvitedBy: userId,
 	})
@@ -124,7 +124,7 @@ func (h *InviteHandler) CancelInvite(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.CancelInviteUseCase.CancelInvite(id); err != nil {
+	if err := h.CancelInviteUseCase.CancelInvite(r.Context(), id); err != nil {
 		writeManageInviteError(w, err)
 		return
 	}
@@ -144,7 +144,7 @@ func (h *InviteHandler) RenewInvite(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	renewed, err := h.RenewInviteUseCase.RenewInvite(useCases.RenewInviteCommand{ID: id, RenewedBy: userId})
+	renewed, err := h.RenewInviteUseCase.RenewInvite(r.Context(), useCases.RenewInviteCommand{ID: id, RenewedBy: userId})
 	if err != nil {
 		writeManageInviteError(w, err)
 		return

api/handlers/user/userHandler.go

@@ -46,7 +46,7 @@ func (h *Handler) UpdateMe(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	updatedUser, err := h.UpdateProfileUseCase.UpdateDisplayName(userId, *request.DisplayName)
+	updatedUser, err := h.UpdateProfileUseCase.UpdateDisplayName(r.Context(), userId, *request.DisplayName)
 	if err != nil {
 		if errors.Is(err, user.ErrInvalidDisplayName) {
 			http.Error(w, apperr.DisplayNameErrorMessage, http.StatusBadRequest)

api/router.go

@@ -47,9 +47,10 @@ func (c *UseCases) apiKeyAuth() func(http.Handler) http.Handler {
 	return c.apiKeyAuthMiddleware
 }
 
-func NewArticleRouter(container *UseCases) http.Handler {
+func NewArticleRouter(container *UseCases, trustedProxies []string) http.Handler {
 	r := chi.NewRouter()
 	r.Use(container.apiKeyAuth())
+	r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
 
 	articleHandler := article.NewHandler(container.CreateArticleUseCase, container.GetArticleUseCase, container.ListArticlesUseCase, container.DeleteArticleUseCase, container.UpdateArticleUseCase, container.GetUserUseCase)
 
@@ -127,6 +128,7 @@ func NewUserRouter(container *UseCases, rateLimit config.AuthRateLimitSettings,
 
 	r.Use(jwtauth.Verifier(container.Token))
 	r.Use(container.apiKeyAuth())
+	r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
 	r.Use(jwtauth.Authenticator(container.Token))
 	r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 	r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
@@ -198,13 +200,14 @@ const (
 	updateDownloadWindow      = time.Minute
 )
 
-func NewSystemRouter(container *UseCases) http.Handler {
+func NewSystemRouter(container *UseCases, trustedProxies []string) http.Handler {
 	r := chi.NewRouter()
 
 	updateHandler := update.NewHandler(container.GetUpdateStatusUseCase, container.CheckForUpdateUseCase, container.StartUpdateDownloadUseCase, container.RequestRestartUseCase, container.GetUserUseCase)
 
 	r.Use(middleware.RequireSession)
 	r.Use(jwtauth.Verifier(container.Token))
+	r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
 	r.Use(jwtauth.Authenticator(container.Token))
 	r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 	r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
@@ -243,13 +246,14 @@ func NewAPIKeyRouter(container *UseCases, trustedProxies []string) http.Handler
 	return r
 }
 
-func NewMediaRouter(container *UseCases) http.Handler {
+func NewMediaRouter(container *UseCases, trustedProxies []string) http.Handler {
 	r := chi.NewRouter()
 
 	mediaHandler := media.NewHandler(container.CreateImageUseCase, container.ListMediaUseCase, container.RenameMediaUseCase, container.DeleteMediaUseCase, container.MergeMediaUseCase, container.GetMediaUsageUseCase, container.GetPurgeSettingsUseCase, container.UpdatePurgeSettingsUseCase, container.PreviewPurgeUseCase, container.RunPurgeUseCase)
 
 	r.Use(jwtauth.Verifier(container.Token))
 	r.Use(container.apiKeyAuth())
+	r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies))
 	r.Use(jwtauth.Authenticator(container.Token))
 	r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 	r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
@@ -279,14 +283,14 @@ func InitBackendRoutes(container *UseCases, settings config.Settings) *chi.Mux {
 	r.Get("/", GetHelloWorld)
 	r.Group(func(r chi.Router) {
 		r.Use(jwtauth.Verifier(container.Token))
-		r.Mount("/article", NewArticleRouter(container))
+		r.Mount("/article", NewArticleRouter(container, settings.TrustedProxies))
 	})
 	r.Mount("/user", NewUserRouter(container, settings.AuthRateLimit, settings.TrustedProxies))
 	r.Mount("/settings", NewSettingsRouter(container, settings.TrustedProxies))
 	r.Mount("/activity", NewActivityRouter(container, settings.TrustedProxies))
-	r.Mount("/media", NewMediaRouter(container))
+	r.Mount("/media", NewMediaRouter(container, settings.TrustedProxies))
 	r.Mount("/api-key", NewAPIKeyRouter(container, settings.TrustedProxies))
-	r.Mount("/system", NewSystemRouter(container))
+	r.Mount("/system", NewSystemRouter(container, settings.TrustedProxies))
 	r.Mount("/auth", NewAuthRouter(container, settings.IsProduction(), settings.AuthRateLimit, settings.TrustedProxies))
 
 	return r

docs/api.md

@@ -49,6 +49,40 @@ are UTC. The list answers `{ items, total, page, size }`, newest first (`created
 `{"activity_retention_days": 30}` is session only and owner only (403 "Only the owner can do this.");
 any other value answers 400.
 
+### What is recorded
+Every real action is recorded by its use case, once, after the change was made (outcome `success`)
+or after the use case refused it (outcome `failed`, with a plain `failure_reason`). Nothing is
+recorded for a read (no `GET`, no list, no public article read, no status poll), for a request that
+fails validation, or for a target that does not exist (404). A failed audit write is logged and
+never changes the response or the change itself.
+
+| Category | Actions |
+| --- | --- |
+| `articles` | `article.create`, `article.edit`, `article.publish`, `article.unpublish`, `article.delete` |
+| `media` | `media.upload`, `media.rename`, `media.delete`, `media.merge`, `media.purge` |
+| `users` | `user.register`, `user.verify`, `user.update_profile`, `invite.create`, `invite.cancel`, `invite.renew`, `invite.accept` |
+| `system` | `system.media_purge` (scheduled), `system.update_checked`, `system.update_downloaded`, `system.restart_requested`, `system.activity_cleanup`, `system.activity_retention_changed` |
+
+Target types: `article`, `image`, `user`, `invite`, `api_key` and `release` (id and name are the tag).
+Only the fields `title`, `online`, `body`, `filename` and `display_name` appear in `changes`, with the
+kinds `text` and `body`; a body edit carries a signed character count delta and never the text. A
+change that leaves a value as it was (same body, same publish state, same file name, same display
+name) records nothing. Params: `media.merge` and `media.purge` and `system.media_purge` carry
+`merged` and `articles_updated`, plus `failed_groups` when a group failed (still outcome `success`);
+`system.update_checked` carries `update_available`; `system.restart_requested` carries `kind` and,
+for an update, `tag` (it has no target). `system.update_downloaded` is recorded when the job reaches
+`ready` or `failed`, with the origin captured at request time; a refusal at the start is recorded
+immediately. A failed registration or invite acceptance has an `anonymous` actor named by the
+attempted username.
+
+`failure_reason` is one fixed sentence per domain error, matched with `errors.Is`, at most 255
+characters, for example "The title must be between 3 and 200 characters.", "That file name is not
+valid.", "The merge request is not valid.", "A purge is already running.", "Registration is closed
+on this site.", "That invitation has expired.", "The release feed could not be reached." or "The
+update could not be downloaded.". Any other error becomes "Something went wrong on our side. Please
+try again."; the text of the error never reaches the event, the API or the CSV. Passwords, hashes,
+codes, article bodies, file bytes, storage paths and asset urls are never recorded.
+
 Article routes accept `?format=markdown|html|json` (default `markdown`). `GET /v1/media/` accepts
 `q`, `hash`, `cursor`, `filter`, `sort` and `limit`.
 

docs/architecture.md

@@ -67,6 +67,8 @@ The use cases `ListActivity`, `GetActivitySummary` and `ExportActivity` turn the
 
 `CleanupActivityUseCase.Tick(now)` follows the `PurgeScheduler` model. With a retention of 0 it never runs. Otherwise it is due once a day, at or after 03:00 in the location of `now` and when the last cleanup is before today's 03:00. It deletes events older than `now` minus the retention days (never newer than 24 hours), records the run (`activity_last_cleanup_at`, `activity_last_cleanup_removed`) even when nothing was removed, and only then records a `system.activity_cleanup` event when something was removed. A failing delete returns the error and leaves the last-cleanup fields as they were, so the next tick retries. `scheduler.Runner` now wraps a task with a label: `NewRunner` keeps the purge behaviour and log line, and `NewCleanupRunner` ticks the cleanup. `UseCases.RunSchedulers` runs both runners and `cmd/server/main.go` starts it with the server's signal context.
 
+Producers: `ArticleChanges`, `TextChange` and `BodyChange` in `internal/domain/audit` build the change lists (the body change holds only a signed rune count delta), and `NewTarget` and `ReleaseTarget` build the target snapshots (types `article`, `image`, `user`, `invite`, `api_key`, `release`). The use cases create, edit, publish, unpublish and delete article, upload, rename, delete, merge and purge media, register, verify, update profile, create, cancel, renew and accept invite, check, download and restart take the request context first and an `audit.Recorder` last, and record exactly one event after the change or the refusal (the action catalogue is in `docs/api.md`). Events are never written by handlers, middleware or GORM hooks, and nothing is recorded for reads or for a target that does not exist. `useCases/auditFailures.go` holds the fixed table of failure sentences keyed by domain `Err...` sentinels (matched with `errors.Is`, each at most 255 characters; the restart action overrides `ErrJobInProgress`) with the generic fallback "Something went wrong on our side. Please try again."; raw error text is never stored. The manual purge runs the groups through the non-recording `MergeMediaUseCase.merge`, so only one `media.purge` event is written; `RunPurgeUseCase.Execute` is the non-recording run that `PurgeSchedulerUseCase.Tick(now)` uses to record one `system.media_purge` event with the system actor and `context.Background()`. `StartUpdateDownloadUseCase` hands `context.WithoutCancel(ctx)` to its job goroutine so the `system.update_downloaded` event, written when the job becomes `ready` or `failed`, keeps the origin of the request. `middleware.AuditContext` is mounted on the article, user, media and system routers (after the API key middleware where keys are accepted), so API key calls are attributed to the key.
+
 ### Image metadata backfill
 
 At boot, `BackfillImageMetadataUseCase` (through `image.Repository.ListMissingMetadata` and `UpdateMetadata`) fills `filename`, `size`, `content_type`, `width`, `height` and `sha256` for image rows that lack them, reading the bytes through `image.Storage` (the files in `UPLOAD_DIR` with the local adapter, the bucket objects with the S3 adapter). It is idempotent, and a row whose file is missing or unreadable is left as it is without stopping the boot. The old `article_id` column and the `article_images` table are kept and never written.

features/activity-log-producers.feature

@@ -0,0 +1,506 @@
+Feature: Every real action of the back-office is recorded in the activity log from inside its use case
+
+  As the owner of a RenewCMS site
+  I want articles, media, users and invites, and system tasks to leave an activity event
+  So that the Activity screen shows who did what, and a failed attempt says why in plain words
+
+  Background:
+    Given the spec of record is docs/design/screens/activity.md ("What is recorded", "API contract") and the foundation slice features/activity-log-backend.feature
+    And this slice is backend only: no SPA, no new env var, no new table, no change to docs/design
+    And events are recorded by the use cases through audit.Recorder, never by handlers, middleware or GORM hooks
+    And every mutating use case method takes the request context as its first parameter and hands it to Recorder.Record, which fills actor, source, ip and user agent from the audit context
+    And system events set the system actor and source "system" themselves, with ip and user_agent null
+    And an event is recorded once, after the change was made (success) or after the use case decided to refuse or abort it (failed), never before
+    And no read is recorded: no GET, no list, no public article read, no status poll
+    And error responses are plain text from http.Error and success responses are JSON with snake_case fields, unchanged by this slice
+    And the layering rule holds: use cases see only domain interfaces, no comment is added anywhere
+
+  Rule: The audit context reaches every producing route
+
+    Scenario Outline: A producing route carries the origin of the request
+      When <request> is sent with <credentials>
+      Then the stored event has actor <actor>, source "<source>" and the request ip and user agent
+
+      Examples:
+        | request                      | credentials            | actor                            | source  |
+        | POST /v1/article             | the owner's jwt cookie | the owner, named by display name | web     |
+        | POST /v1/article             | an API key "Deploy bot"| api_key id 7 named "Deploy bot"  | api_key |
+        | POST /v1/media               | an API key "Deploy bot"| api_key id 7 named "Deploy bot"  | api_key |
+        | POST /v1/system/update/check | the owner's jwt cookie | the owner                        | web     |
+
+  Rule: A failed audit write never changes the user's action
+
+    Scenario Outline: A failing or panicking repository leaves the response untouched
+      Given the audit repository <fault> on Append
+      When <request> succeeds
+      Then the response status and body equal those of the same request with a healthy repository
+      And the change itself was applied
+      And the process log names the failed audit write
+
+      Examples:
+        | fault  | request                        |
+        | fails  | POST /v1/article               |
+        | fails  | DELETE /v1/article/8           |
+        | panics | PATCH /v1/article/8/publish    |
+        | fails  | POST /v1/media                 |
+        | fails  | POST /v1/media/merge           |
+        | fails  | POST /v1/user/invite           |
+        | fails  | POST /v1/system/update/restart |
+
+  Rule: Articles
+
+    Scenario: Creating an article is recorded
+      When the owner sends POST /v1/article with {"title": "Spring release", "body": "Hello"}
+      Then one event exists with action "article.create", category "articles", actor the owner, source "web", target {"type": "article", "id": "<new id>", "name": "Spring release"}, outcome "success", failure_reason null and no changes
+      And the stored event holds no article body
+
+    Scenario: Editing the body records a size delta and never the text
+      Given the article 8 "Spring release" has a body of 100 characters
+      When the owner sends PATCH /v1/article/8 with a body of 412 characters
+      Then one event exists with action "article.edit", target {"type": "article", "id": "8", "name": "Spring release"} and changes [{"field": "body", "kind": "body", "delta": 312}]
+      And no stored field and no /v1/activity response contains any text of either body
+
+    Scenario Outline: The delta is signed and counts characters
+      Given the article 8 has a body of <before> characters
+      When its body is replaced by one of <after> characters
+      Then the change delta is <delta>
+
+      Examples:
+        | before | after | delta |
+        | 100    | 412   | 312   |
+        | 412    | 100   | -312  |
+        | 5      | 5     | 0     |
+
+    Scenario: A body with multi-byte characters is counted in characters
+      Given the article 8 has the body "héllo"
+      When its body is replaced by "héllo wörld"
+      Then the change delta is 6
+
+    Scenario: Saving an identical body records nothing
+      Given the article 8 has the body "Same text"
+      When the owner sends PATCH /v1/article/8 with the body "Same text"
+      Then the response is 200 and no event is recorded
+
+    Scenario: A title change is recorded as a text diff when a title edit exists
+      Given a use case that changes an article's title from "Spring release" to "Spring release 2"
+      Then its event has action "article.edit" and changes [{"field": "title", "kind": "text", "before": "Spring release", "after": "Spring release 2"}]
+      And only the fields title, online and body can ever appear in an article event's changes
+
+    Scenario: Publishing is recorded with the publish state
+      Given the article 8 "Spring release" is offline
+      When the owner sends PATCH /v1/article/8/publish
+      Then one event exists with action "article.publish", category "articles" and changes [{"field": "online", "kind": "text", "before": "false", "after": "true"}]
+
+    Scenario: Unpublishing is recorded with the publish state
+      Given the article 8 is online
+      When the owner sends PATCH /v1/article/8/unpublish
+      Then one event exists with action "article.unpublish" and changes [{"field": "online", "kind": "text", "before": "true", "after": "false"}]
+
+    Scenario Outline: A publish state that does not change records nothing
+      Given the article 8 is <state>
+      When the owner sends PATCH /v1/article/8/<path>
+      Then the response is 200 and no event is recorded
+
+      Examples:
+        | state   | path      |
+        | online  | publish   |
+        | offline | unpublish |
+
+    Scenario: Deleting an article is recorded with its name snapshot
+      Given the article 8 "Spring release" exists
+      When the owner sends DELETE /v1/article/8
+      Then one event exists with action "article.delete", target {"type": "article", "id": "8", "name": "Spring release"} and outcome "success"
+      And GET /v1/activity shows that target with exists false
+
+    Scenario Outline: A refused article action is recorded as failed with a plain reason
+      Given <state>
+      When <request>
+      Then one event exists with action "<action>", outcome "failed" and failure_reason "<reason>"
+      And the response is unchanged
+
+      Examples:
+        | state                                    | request                                    | action          | reason                                              |
+        | no article has this title                | POST /v1/article with a 2 character title  | article.create  | The title must be between 3 and 200 characters.     |
+        | the repository fails with "db is locked" | POST /v1/article with a valid title        | article.create  | Something went wrong on our side. Please try again. |
+        | the repository fails with "db is locked" | PATCH /v1/article/8/publish                | article.publish | Something went wrong on our side. Please try again. |
+
+    Scenario: An article that does not exist records nothing
+      When the owner sends DELETE /v1/article/99, PATCH /v1/article/99, PATCH /v1/article/99/publish and PATCH /v1/article/99/unpublish
+      Then every response is 404 and no event is recorded
+
+    Scenario: A request that fails validation records nothing
+      When the owner sends POST /v1/article with an empty body or a malformed id such as /v1/article/abc
+      Then the response is 400 and no event is recorded
+
+    Scenario Outline: Reads are never recorded
+      When <request> is sent
+      Then no event is recorded
+
+      Examples:
+        | request                         |
+        | GET /v1/article                 |
+        | GET /v1/article/8               |
+        | GET /v1/article/8 as the public |
+
+  Rule: Media
+
+    Scenario: Uploading an image is recorded
+      When the owner sends POST /v1/media with the PNG "spring-banner.png"
+      Then one event exists with action "media.upload", category "media", actor the owner, target {"type": "image", "id": "<new id>", "name": "spring-banner.png"} and outcome "success"
+      And the stored event holds no file content and no storage path
+
+    Scenario Outline: A refused upload is recorded as failed
+      When the owner uploads <file>
+      Then one event exists with action "media.upload", outcome "failed" and failure_reason "<reason>"
+      And the target name is the file name as sent, normalised the way a stored upload would be named, or empty when it is unusable
+      And the response is unchanged
+
+      Examples:
+        | file                        | reason                                           |
+        | a GIF                       | The file must be a PNG, JPEG, WEBP or SVG image. |
+        | a PNG larger than the limit | The file is too large to upload.                 |
+        | a corrupt PNG               | The image could not be read.                     |
+
+    Scenario: Renaming an image records the filename diff
+      Given the image 5 "banner.png"
+      When the owner sends PATCH /v1/media/5 with {"filename": "spring-banner"}
+      Then one event exists with action "media.rename", target {"type": "image", "id": "5", "name": "spring-banner.png"} and changes [{"field": "filename", "kind": "text", "before": "banner.png", "after": "spring-banner.png"}]
+
+    Scenario: Renaming to the same name records nothing
+      Given the image 5 "banner.png"
+      When the owner renames it to "banner"
+      Then no event is recorded
+
+    Scenario: A refused rename is recorded as failed
+      Given the image 5 "banner.png"
+      When the owner sends PATCH /v1/media/5 with an invalid filename
+      Then one event exists with action "media.rename", outcome "failed", failure_reason "That file name is not valid." and target {"type": "image", "id": "5", "name": "banner.png"}
+
+    Scenario: Deleting an image is recorded with its name snapshot
+      Given the image 5 "banner.png"
+      When the owner sends DELETE /v1/media/5
+      Then one event exists with action "media.delete", target {"type": "image", "id": "5", "name": "banner.png"} and outcome "success"
+      And GET /v1/activity shows that target with exists false
+
+    Scenario: Merging images is recorded once with its counts
+      Given the images 5 "banner.png", 6 "banner-copy.png" and 7 "banner-copy-2.png" share one content hash
+      And two articles reference the copies
+      When the owner sends POST /v1/media/merge keeping 5 and merging [6, 7]
+      Then one event exists with action "media.merge", target {"type": "image", "id": "5", "name": "banner.png"} and params {"merged": 2, "articles_updated": 2}
+      And no event names a removed copy as a separate action
+
+    Scenario Outline: A refused merge is recorded as failed
+      When the owner sends POST /v1/media/merge that fails with <error>
+      Then one event exists with action "media.merge", outcome "failed" and failure_reason "<reason>"
+
+      Examples:
+        | error                  | reason                              |
+        | ErrInvalidMergeRequest | The merge request is not valid.     |
+        | ErrMergeCopyMissing    | One of the copies no longer exists. |
+        | ErrMergeHashMismatch   | The images are not identical copies.|
+
+    Scenario: A manual purge is recorded once and not as separate merges
+      Given a purge plan with 2 groups, 3 copies and 5 articles to update
+      When the owner sends POST /v1/media/purge
+      Then one event exists with action "media.purge", category "media", actor the owner, source "web", outcome "success" and params {"merged": 3, "articles_updated": 5}
+      And no "media.merge" event is recorded for its groups
+
+    Scenario: A partly failed manual purge is a success with the failed group count
+      Given a purge plan with 3 groups where 1 group fails
+      When the owner sends POST /v1/media/purge
+      Then one event exists with action "media.purge", outcome "success" and params that include "failed_groups": 1
+
+    Scenario Outline: A refused manual purge is recorded as failed
+      When the owner sends POST /v1/media/purge and the use case returns <error>
+      Then one event exists with action "media.purge", outcome "failed" and failure_reason "<reason>"
+
+      Examples:
+        | error            | reason                                                  |
+        | ErrPurgeConflict | The library changed since the preview. Review it again. |
+        | ErrPurgeBusy     | A purge is already running.                             |
+
+    Scenario: The scheduled purge is a system event
+      Given the purge is due and merges 3 copies and updates 5 articles
+      When PurgeSchedulerUseCase.Tick runs
+      Then one event exists with action "system.media_purge", category "system", actor type system named "System", source "system", ip null, user_agent null, outcome "success" and params {"merged": 3, "articles_updated": 5}
+
+    Scenario: A scheduled purge with a failed group records the failed group count
+      Given the purge is due and 1 group fails while others merge
+      When Tick runs
+      Then one event exists with action "system.media_purge", outcome "success" and params that include "failed_groups": 1
+
+    Scenario: A scheduled purge that is not due or merges nothing records nothing
+      Given the purge is not due, or is due and finds no duplicate
+      When Tick runs
+      Then no event is recorded
+
+    Scenario: A scheduled purge that cannot record its run is a failed system event
+      Given the purge is due and the run result cannot be saved
+      When Tick runs
+      Then one event exists with action "system.media_purge", outcome "failed" and failure_reason "Something went wrong on our side. Please try again."
+
+    Scenario: Browsing and the media usage lookup are never recorded
+      When the owner sends GET /v1/media, GET /v1/media/5/usage, GET /v1/media/purge-preview and GET /v1/media/purge-settings
+      Then no event is recorded
+
+  Rule: Users and invites
+
+    Scenario: Registering is recorded with the new account as actor
+      Given registration is open
+      When POST /v1/auth/register is sent with the username "marta"
+      Then one event exists with action "user.register", category "users", actor user "marta" with the new id, source "web", target {"type": "user", "id": "<new id>", "name": "marta"} and outcome "success"
+      And the stored event holds no password, no hash and no verification code
+
+    Scenario Outline: A refused registration is recorded as failed
+      When POST /v1/auth/register is sent and <cause>
+      Then one event exists with action "user.register", outcome "failed", failure_reason "<reason>", actor anonymous named by the attempted username and no target
+      And the response is unchanged
+
+      Examples:
+        | cause                                 | reason                                    |
+        | registration is closed                | Registration is closed on this site.      |
+        | the verification email cannot be sent | The verification email could not be sent. |
+
+    Scenario: Verifying an account is recorded
+      Given the unverified user 4 "lea" with a valid code
+      When user 4 sends POST /v1/auth/verify with that code
+      Then one event exists with action "user.verify", category "users", actor user 4, target {"type": "user", "id": "4", "name": "lea"} and outcome "success"
+      And the stored event does not hold the code or its hash
+
+    Scenario Outline: A refused verification is recorded as failed
+      Given the unverified user 4 "lea"
+      When user 4 sends POST /v1/auth/verify and the use case returns <error>
+      Then one event exists with action "user.verify", outcome "failed" and failure_reason "<reason>"
+
+      Examples:
+        | error                      | reason                              |
+        | ErrInvalidVerificationCode | The verification code is not valid. |
+        | ErrVerificationCodeExpired | The verification code has expired.  |
+
+    Scenario: Changing the display name records a before and after
+      Given user 3 has the display name "Marta"
+      When user 3 sends PATCH /v1/user/me with {"display_name": "Marta Alves"}
+      Then one event exists with action "user.update_profile", category "users", target {"type": "user", "id": "3", "name": "Marta Alves"} and changes [{"field": "display_name", "kind": "text", "before": "Marta", "after": "Marta Alves"}]
+      And the actor snapshot name is the name held when the request began
+
+    Scenario Outline: Setting a display name that does not change records nothing
+      Given user 3 has the display name "<current>"
+      When user 3 sends PATCH /v1/user/me with {"display_name": "<sent>"}
+      Then no event is recorded
+
+      Examples:
+        | current | sent    |
+        | Marta   | Marta   |
+        | Marta   |  Marta  |
+        |         |         |
+
+    Scenario: A display name that is too long is recorded as failed
+      When user 3 sends PATCH /v1/user/me with a 61 character name
+      Then one event exists with action "user.update_profile", outcome "failed" and failure_reason "That display name is too long."
+      And the stored event holds no changes
+
+    Scenario: Creating an invite is recorded
+      When the owner sends POST /v1/user/invite with {"email": "new@example.com"}
+      Then one event exists with action "invite.create", category "users", actor the owner, target {"type": "invite", "id": "<invite id>", "name": "new@example.com"} and outcome "success"
+      And the stored event holds no invite code and no hash
+
+    Scenario Outline: A refused invite action is recorded as failed
+      When the owner <request> and the use case returns <error>
+      Then one event exists with action "<action>", outcome "failed" and failure_reason "<reason>"
+
+      Examples:
+        | request                            | error                    | action        | reason                                           |
+        | sends POST /v1/user/invite         | ErrEmailHasAccount       | invite.create | That email already has an account.               |
+        | sends POST /v1/user/invite         | ErrPendingInvite         | invite.create | An invitation is already pending for that email. |
+        | sends POST /v1/user/invite         | ErrInviteEmailNotSent    | invite.create | The invitation email could not be sent.          |
+        | sends POST /v1/user/invite/4/renew | ErrInviteEmailNotSent    | invite.renew  | The invitation email could not be sent.          |
+        | sends POST /v1/user/invite/4/renew | ErrInviteAlreadyAccepted | invite.renew  | That invitation was already accepted.            |
+        | sends DELETE /v1/user/invite/4     | ErrInviteAlreadyAccepted | invite.cancel | That invitation was already accepted.            |
+
+    Scenario: Cancelling an invite is recorded
+      Given the pending invite 4 for "new@example.com"
+      When the owner sends DELETE /v1/user/invite/4
+      Then one event exists with action "invite.cancel", target {"type": "invite", "id": "4", "name": "new@example.com"} and outcome "success"
+
+    Scenario: Renewing an invite is recorded
+      Given the pending invite 4 for "new@example.com"
+      When the owner sends POST /v1/user/invite/4/renew
+      Then one event exists with action "invite.renew", target {"type": "invite", "id": "4", "name": "new@example.com"} and outcome "success"
+      And a renewal whose email fails is rolled back and recorded only as failed
+
+    Scenario: Accepting an invite is recorded with the new account as actor
+      Given the pending invite 4 for "new@example.com"
+      When POST /v1/auth/invite/accept is sent with a valid code and the username "sam"
+      Then one event exists with action "invite.accept", category "users", actor user "sam" with the new id, source "web", target {"type": "invite", "id": "4", "name": "new@example.com"} and outcome "success"
+      And the stored event holds no code, no hash and no password
+
+    Scenario Outline: A refused acceptance is recorded as failed
+      When POST /v1/auth/invite/accept is sent and the use case returns <error>
+      Then one event exists with action "invite.accept", outcome "failed", failure_reason "<reason>" and actor anonymous named by the attempted username
+      And the stored event has no target when the invite could not be identified
+
+      Examples:
+        | error                    | reason                                |
+        | ErrInviteInvalid         | That invitation is not valid.         |
+        | ErrInviteExpired         | That invitation has expired.          |
+        | ErrInviteAlreadyAccepted | That invitation was already accepted. |
+        | ErrUsernameTaken         | That username is already taken.       |
+        | ErrEmailHasAccount       | That email already has an account.    |
+
+    Scenario: An invite or user that does not exist records nothing
+      When the owner sends DELETE /v1/user/invite/99 or POST /v1/user/invite/99/renew
+      Then every response is 404 and no event is recorded
+
+    Scenario Outline: Reads and checks are never recorded
+      When <request> is sent
+      Then no event is recorded
+
+      Examples:
+        | request                         |
+        | GET /v1/user                    |
+        | GET /v1/auth/me                 |
+        | GET /v1/auth/invite?code=<code> |
+        | GET /v1/auth/registration       |
+
+  Rule: System tasks
+
+    Scenario: Checking for an update is recorded
+      Given the release feed answers v1.4.0 while the running version is v1.3.2
+      When the owner sends POST /v1/system/update/check
+      Then one event exists with action "system.update_checked", category "system", actor the owner, source "web", target {"type": "release", "id": "v1.4.0", "name": "v1.4.0"}, outcome "success" and params {"update_available": true}
+
+    Scenario Outline: A failed update check is recorded with a plain reason
+      When the owner sends POST /v1/system/update/check and the use case returns <error>
+      Then one event exists with action "system.update_checked", outcome "failed", failure_reason "<reason>" and no target
+
+      Examples:
+        | error              | reason                                 |
+        | ErrFeedUnavailable | The release feed could not be reached. |
+        | ErrNoRelease       | No release was found.                  |
+
+    Scenario: The status poll is never recorded
+      When the owner sends GET /v1/system/update
+      Then no event is recorded
+
+    Scenario: A download that completes is recorded when the job is ready
+      Given a newer release v1.4.0 is available and the update helper is installed
+      When the owner sends POST /v1/system/update/download
+      Then the response is returned before the job ends and no event exists yet
+      And when the job reaches the ready state one event exists with action "system.update_downloaded", actor the owner, source "web", target {"type": "release", "id": "v1.4.0", "name": "v1.4.0"} and outcome "success"
+      And the origin (actor, ip, user agent) is the one captured at request time
+
+    Scenario Outline: A download that fails is recorded with a reason that hides the cause
+      Given a newer release v1.4.0 is available and the job fails with the error kind "<kind>"
+      Then one event exists with action "system.update_downloaded", outcome "failed" and failure_reason "<reason>"
+      And the stored event holds no url, no path and no raw error text
+
+      Examples:
+        | kind         | reason                                            |
+        | download     | The update could not be downloaded.               |
+        | verification | The downloaded update failed its integrity check. |
+
+    Scenario Outline: A download refused at the start is recorded as failed
+      When the owner sends POST /v1/system/update/download and the use case returns <error>
+      Then one event exists with action "system.update_downloaded", outcome "failed" and failure_reason "<reason>"
+      And the response is unchanged
+
+      Examples:
+        | error               | reason                                 |
+        | ErrNotPrepared      | This server cannot apply updates.      |
+        | ErrJobInProgress    | An update is already being downloaded. |
+        | ErrRestartPending   | A restart is already pending.          |
+        | ErrNothingToUpdate  | There is nothing to update.            |
+        | ErrPreflightRefused | The update cannot be downloaded.       |
+
+    Scenario: A restart request is recorded
+      Given the update helper is installed and no job is running
+      When the owner sends POST /v1/system/update/restart
+      Then one event exists with action "system.restart_requested", category "system", actor the owner, source "web", outcome "success" and params {"kind": "restart"}
+
+    Scenario: A restart that applies a downloaded update records the kind and version
+      Given a downloaded update v1.4.0 is ready
+      When the owner sends POST /v1/system/update/restart
+      Then the event has params {"kind": "update", "tag": "v1.4.0"}
+
+    Scenario Outline: A refused restart is recorded as failed
+      When the owner sends POST /v1/system/update/restart and the use case returns <error>
+      Then one event exists with action "system.restart_requested", outcome "failed" and failure_reason "<reason>"
+
+      Examples:
+        | error                  | reason                                                 |
+        | ErrNotPrepared         | This server cannot apply updates.                      |
+        | ErrJobInProgress       | An update is still being downloaded.                   |
+        | ErrRestartPending      | A restart is already pending.                          |
+        | ErrRestartKindMismatch | The requested restart does not match the server state. |
+
+  Rule: A failed outcome never exposes more than the plain-language reason
+
+    Scenario: Failure reasons are mapped from domain sentinels
+      Given a table that maps each domain Err sentinel above to a fixed sentence
+      When a use case fails with an error that wraps one of them
+      Then failure_reason is that sentence, matched with errors.Is
+
+    Scenario Outline: Unmapped errors become the generic sentence
+      When a use case fails with <error>
+      Then failure_reason is "Something went wrong on our side. Please try again."
+      And neither the event, the activity API nor the CSV export holds the text of the error
+
+      Examples:
+        | error                                        |
+        | errors.New("db is locked")                   |
+        | an error carrying an SMTP host and password  |
+        | an error carrying a file system path        |
+        | an error wrapping a sentinel and a raw cause |
+
+    Scenario: Every failure reason fits the stored limit
+      Then every mapped sentence is at most 255 characters
+
+    Scenario: A failed event keeps its target when the target is known
+      Given the image 5 "banner.png" exists
+      When a rename of image 5 is refused
+      Then the failed event keeps the target snapshot of image 5
+
+  Rule: Secrets and bodies never reach the log
+
+    Scenario Outline: Sensitive values are absent everywhere
+      Given the action <action> handled <secret>
+      When it is recorded, listed through GET /v1/activity and exported through GET /v1/activity/export
+      Then no stored field, no params, no change, no response, no CSV cell and no process log line contains <secret>
+
+      Examples:
+        | action                   | secret                                           |
+        | user.register            | the password, its hash and the verification code |
+        | user.verify              | the verification code and its hash               |
+        | invite.create            | the invite code and its hash                     |
+        | invite.accept            | the invite code, its hash and the password       |
+        | article.edit             | the old and the new article body                 |
+        | media.upload             | the file bytes and the storage path              |
+        | system.update_downloaded | the asset url and the staging path               |
+
+    Scenario: Only allowlisted fields appear in changes
+      Then the only change fields any producer emits are title, online, body, filename and display_name
+      And the only change kinds are text and body
+
+  Rule: The recorded events read back through the existing API
+
+    Scenario: Producer events are listed with their documented shape
+      Given an article was created, edited, published and deleted by the owner
+      When the owner sends GET /v1/activity?category=articles
+      Then the four events are listed newest first, with category "articles", the documented item shape and the article target exists false after the delete
+
+    Scenario Outline: Categories filter the producers
+      Given one event of each producer was recorded
+      When the owner sends GET /v1/activity?category=<category>
+      Then the items are exactly the events listed in <actions>
+
+      Examples:
+        | category | actions                                                                                                    |
+        | articles | article.create, article.edit, article.publish, article.unpublish, article.delete                           |
+        | media    | media.upload, media.rename, media.delete, media.merge, media.purge                                         |
+        | users    | user.register, user.verify, user.update_profile, invite.create, invite.cancel, invite.renew, invite.accept |
+        | system   | system.media_purge, system.update_checked, system.update_downloaded, system.restart_requested              |
+
+    Scenario: A failed producer event is filterable
+      Given a refused merge and a successful rename were recorded
+      When the owner sends GET /v1/activity?outcome=failed
+      Then only the refused merge is listed with its failure_reason

features/activity-log-producers.qa.md

@@ -0,0 +1,67 @@
+# QA procedure: activity-log-producers
+
+Go only, no SPA. Package `test` (black-box). New files: `test/activity_producers_articles_test.go`, `test/activity_producers_media_test.go`, `test/activity_producers_users_test.go`, `test/activity_producers_system_test.go`, `test/activity_producers_reasons_test.go`. Reuse the foundation helpers in `test/activity_support_test.go` (`mockAuditRepo`, `fakeAuditClock`, `seedEvents`). Extend the existing hand-written fakes (`mockArticleRepo`, the image, user, invite, purge, update and status fakes) with failure switches and call counters. New fake type names must be unique across the package. No live server, no real SMTP, no real SQLite file, no real sleeping, no `time.Ticker`. Secrets in tests are fixed test strings only.
+
+## Setup shared by every case
+1. `validator.InitValidator()` once. `jwtauth.New("HS256", []byte("test-secret"), nil)` stands in for `JWT_SECRET`.
+2. One `auditing.NewRecorder(mockAuditRepo, fakeAuditClock.Now, logger)` shared by every use case. `logger` writes to a `bytes.Buffer` (restore with `t.Cleanup`).
+3. Users: owner 1, admin 2, verified user 3 "Marta", unverified user 4 "lea" (with a hashed code). API key 7 "Deploy bot" in the fake key repo.
+4. A fresh `chi.NewRouter()` per test that mirrors `api/router.go` for the article, user, media, system and auth routers, with `middleware.AuditContext(getUser, trustedProxies)` placed exactly where the router wires it (after `apiKeyAuth()` on the article, user and media routers). Cookies are real signed `jwt` cookies with `user_id` and `token_version`. `httptest.NewRecorder` per request.
+5. Helpers: `eventsOf(repo)`, `onlyEvent(t, repo)` (fails unless exactly one event), `assertNoEvent(t, repo)`.
+6. Each mutating use case method takes `ctx context.Context` first. A method called with a context holding no origin still works.
+
+## A. Origin and routing
+7. Table (feature rule 1): each request with the cookie or the API key yields the expected actor type, id, name and source, plus the request ip and user agent. Proves `AuditContext` is mounted on the article, user, media and system routers.
+8. A route without credentials, or answered 401/403/429, records nothing.
+
+## B. Articles
+9. Create: one `article.create` event, target id string, name as typed, no changes, no body anywhere (marshal the event and assert absence).
+10. Edit: table `(before, after, delta)`: 100 to 412 (312), 412 to 100 (-312), 5 to 5 with different content (0, still recorded), `héllo` to `héllo wörld` (6, characters not bytes). Identical body records nothing. Change kind `body`, `Delta` set, `Before` and `After` nil.
+11. Publish and unpublish: `online` text change (`"false"`/`"true"`). Repeating the same state records nothing and returns 200.
+12. Delete: event keeps the name snapshot. After it, `GET /v1/activity` shows `target.exists` false.
+13. Title diff: unit-test the change builder with title, online and body only; any other field name is rejected.
+14. Failure table: 2 character title, repository failing with `errors.New("db is locked")` (generic reason). 404 on delete, edit, publish, unpublish of id 99 and 400 on malformed id or body record nothing.
+15. Reads (list, get, public get) record nothing.
+
+## C. Media
+16. Upload: in-memory PNG, target name equals the normalised filename, no bytes and no path. Failed upload table: GIF, oversize, corrupt PNG, each with its mapped reason.
+17. Rename: `filename` text change `banner.png` to `spring-banner.png`. Same name records nothing. Invalid stem records a failed event keeping the target. Missing image records nothing (404).
+18. Delete: event with name snapshot. Missing image records nothing.
+19. Merge: three images with one hash, two articles referencing the copies. One `media.merge` event with `{"merged":2,"articles_updated":2}`, target the kept image. Failure table: `ErrInvalidMergeRequest`, `ErrMergeCopyMissing`, `ErrMergeHashMismatch`.
+20. Manual purge: plan with 2 groups, 3 copies, 5 articles. Exactly one `media.purge` event with `{"merged":3,"articles_updated":5}` and zero `media.merge` events. A plan with one failing group: outcome success with `failed_groups` 1. `ErrPurgeConflict` and `ErrPurgeBusy` give failed events. Preview, usage, list and settings GETs record nothing.
+21. Scheduled purge: drive `PurgeSchedulerUseCase.Tick(now)` with the fake purge repo and clock. Due and merging 3: one `system.media_purge` event with system actor, source system, ip nil, user agent nil. Due with a failed group: success with `failed_groups`. Not due, or no duplicates: none. A fake `SaveLastRun` failure: failed event with the generic reason.
+22. Manual purge after the scheduler in the same test yields two events with sources `web` and `system`.
+
+## D. Users and invites
+23. Register: open registration records `user.register` with the new account as actor and target. Closed registration and a failing mailer (error carrying a fake SMTP password) record failed events with the mapped reason, anonymous actor named by the attempted username, no raw text. Marshal the event and assert password, hash and code are absent.
+24. Verify: success, invalid code, expired code.
+25. Display name: before/after diff, trimmed no-op records nothing, empty to empty records nothing, 61 characters records a failed event with no changes. Actor snapshot name is the pre-change name.
+26. Invites: create, cancel, renew, accept each record the documented event with the invited email as target name. Failure table covers every error in the feature. A renew whose mail fails is rolled back and records one failed event only. Unknown ids (404) record nothing.
+27. Accept: actor is the new account, source `web`; failed accept actor is anonymous with the attempted username.
+28. Reads (`GET /v1/user`, `/v1/auth/me`, `/v1/auth/invite`, `/v1/auth/registration`) record nothing.
+
+## E. System tasks
+29. Check: success event with `{"update_available":true}` and a release target. `ErrFeedUnavailable` and `ErrNoRelease` give failed events without target. Status `GET` records nothing.
+30. Download: fakes complete the job through a hand-fed channel (no `time.Sleep`). No event before the job ends, one after `ready`; actor, ip and user agent are those captured at request time even though the request context was cancelled. Failure kinds `download` and `verification` give the two reasons, no URL or path. Start-time refusals give failed events. Run with `-race`.
+31. Restart: `{"kind":"restart"}` and `{"kind":"update","tag":"v1.4.0"}`. Refusals for `ErrNotPrepared`, `ErrJobInProgress`, `ErrRestartPending`, `ErrRestartKindMismatch`.
+
+## F. Reasons, secrets and recorder faults
+32. Reason table: wrap each sentinel with `fmt.Errorf("%w: %w", sentinel, errors.New("secret detail"))`, assert the sentence equals the table and the extra text is absent. Unmapped errors give the generic sentence. Every sentence is at most 255 characters.
+33. Recorder fault: for each producer row of the fault table, run with failing, panicking and healthy `mockAuditRepo`. Identical status and body, change applied, log line naming the failed write.
+34. Secret sweep: after exercising every producer, marshal every stored event, the `/v1/activity` response and the `/v1/activity/export` file; assert none contains the password, hash, verification code, invite code, raw API key, article body, file bytes, asset URL or staging path. The log buffer is free of them too.
+35. Allowlist: every `Change.Field` is in `{title, online, body, filename, display_name}` and every kind is `text` or `body`.
+36. Read-back: list by `category=articles|media|users|system` and `outcome=failed`; compare action sets with the feature tables.
+
+## G. Mutation guard (gremlins stays clean)
+37. `task mutate` scope is `./internal/infrastructure/useCases`. Each new branch needs a killing assertion: every no-op guard (body, online, filename, display name) with equal and differing values; delta sign and rune-versus-byte count; success versus failed outcome and recorded once after the change (event count and order against the repository call); every `errors.Is` row of the reason map plus the generic fallback; every `ctx` forwarding; the system-actor defaults. Bare-bool conditions produce no mutant, so cover both branches with tests regardless.
+
+## H. Layering and hygiene
+38. Touched use cases import no `gorm`, `persistence`, `mailer`, `net/http`, chi or `api/...`; handlers only pass `r.Context()`; `internal/domain/audit` imports only stdlib and domain packages.
+39. No comments in new or edited Go files, test files and docs, except tool directives.
+40. Docs (`docs/api.md`, `docs/architecture.md`) list the action catalogue, target types, reason sentences and the rule that no read is recorded.
+
+## Manual (not automated)
+41. Real boot with `task dev:api` and SMTP: register, verify, invite, renew, accept and cancel an invite, change display name, create/edit/publish/unpublish/delete an article, upload/rename/merge/delete images, manual purge; read `/v1/activity` and the CSV export and read every sentence.
+42. Real update helper on Linux systemd (or the Docker QA flow): check, download until `ready`, restart; one event each, real asset names absent. Skip in a container.
+43. Leave the scheduled purge due and wait for the hourly tick: a single `system.media_purge` event, source `system`, no ip or user agent.
+44. Remove the database file's write access during one article edit: edit result unchanged, process log names the audit write failure.

internal/domain/audit/auditChanges.go

@@ -0,0 +1,30 @@
+package audit
+
+import (
+	"RenewCMS/internal/domain/article"
+	"strconv"
+	"unicode/utf8"
+)
+
+func TextChange(field string, before string, after string) Change {
+	return Change{Field: field, Kind: ChangeText, Before: &before, After: &after}
+}
+
+func BodyChange(before string, after string) Change {
+	delta := utf8.RuneCountInString(after) - utf8.RuneCountInString(before)
+	return Change{Field: FieldBody, Kind: ChangeBody, Delta: &delta}
+}
+
+func ArticleChanges(before article.Article, after article.Article) []Change {
+	changes := []Change{}
+	if before.Title != after.Title {
+		changes = append(changes, TextChange(FieldTitle, before.Title, after.Title))
+	}
+	if before.IsOnline != after.IsOnline {
+		changes = append(changes, TextChange(FieldOnline, strconv.FormatBool(before.IsOnline), strconv.FormatBool(after.IsOnline)))
+	}
+	if before.Body != after.Body {
+		changes = append(changes, BodyChange(before.Body, after.Body))
+	}
+	return changes
+}

internal/domain/audit/auditDomain.go

@@ -66,11 +66,36 @@ const (
 	ActionAPIKeyRevoke         = "api_key.revoke"
 	ActionRetentionChanged     = "system.activity_retention_changed"
 	ActionCleanup              = "system.activity_cleanup"
+	ActionArticleCreate        = "article.create"
+	ActionArticleEdit          = "article.edit"
+	ActionArticlePublish       = "article.publish"
+	ActionArticleUnpublish     = "article.unpublish"
+	ActionArticleDelete        = "article.delete"
+	ActionMediaUpload          = "media.upload"
+	ActionMediaRename          = "media.rename"
+	ActionMediaDelete          = "media.delete"
+	ActionMediaMerge           = "media.merge"
+	ActionMediaPurge           = "media.purge"
+	ActionUserRegister         = "user.register"
+	ActionUserVerify           = "user.verify"
+	ActionUserUpdateProfile    = "user.update_profile"
+	ActionInviteCreate         = "invite.create"
+	ActionInviteCancel         = "invite.cancel"
+	ActionInviteRenew          = "invite.renew"
+	ActionInviteAccept         = "invite.accept"
+	ActionMediaPurgeScheduled  = "system.media_purge"
+	ActionUpdateChecked        = "system.update_checked"
+	ActionUpdateDownloaded     = "system.update_downloaded"
+	ActionRestartRequested     = "system.restart_requested"
 )
 
 const (
 	TargetAPIKey  = "api_key"
 	TargetUser    = "user"
+	TargetArticle = "article"
+	TargetImage   = "image"
+	TargetInvite  = "invite"
+	TargetRelease = "release"
 )
 
 const (
@@ -80,6 +105,17 @@ const (
 	ParamRemoved         = "removed"
 	ParamFrom            = "from"
 	ParamTo              = "to"
+	ParamMerged          = "merged"
+	ParamArticlesUpdated = "articles_updated"
+	ParamFailedGroups    = "failed_groups"
+	ParamUpdateAvailable = "update_available"
+	ParamKind            = "kind"
+	ParamTag             = "tag"
+	FieldTitle           = "title"
+	FieldOnline          = "online"
+	FieldBody            = "body"
+	FieldFilename        = "filename"
+	FieldDisplayName     = "display_name"
 	maxNameLength        = 255
 	maxActionLength      = 64
 	maxFailureReasonSize = 255

internal/domain/audit/auditTargets.go

@@ -0,0 +1,11 @@
+package audit
+
+import "strconv"
+
+func NewTarget(targetType string, id uint32, name string) Target {
+	return Target{Type: targetType, ID: strconv.FormatUint(uint64(id), 10), Name: name}
+}
+
+func ReleaseTarget(tag string) Target {
+	return Target{Type: TargetRelease, ID: tag, Name: tag}
+}

internal/domain/user/userDomain.go

@@ -15,6 +15,7 @@ var ErrInvalidPasswordResetCode = errors.New("invalid password reset code")
 var ErrPasswordResetCodeExpired = errors.New("password reset code expired")
 var ErrInvalidDisplayName = errors.New("invalid display name")
 var ErrUsernameTaken = errors.New("username taken")
+var ErrVerificationEmailNotSent = errors.New("verification email not sent")
 
 type Role string
 

internal/infrastructure/useCases/AcceptInvite.go

@@ -1,9 +1,11 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/invite"
 	"RenewCMS/internal/domain/user"
+	"context"
 	"errors"
 	"strings"
 	"time"
@@ -13,6 +15,7 @@ type AcceptInviteUseCase struct {
 	userRepository   user.Repository
 	inviteRepository invite.Repository
 	hasher           hash.Hasher
+	recorder         audit.Recorder
 }
 
 type AcceptInviteCommand struct {
@@ -21,18 +24,37 @@ type AcceptInviteCommand struct {
 	Password string
 }
 
-func NewAcceptInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher) *AcceptInviteUseCase {
-	return &AcceptInviteUseCase{userRepository, inviteRepository, hasher}
+func NewAcceptInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher, recorder audit.Recorder) *AcceptInviteUseCase {
+	return &AcceptInviteUseCase{userRepository, inviteRepository, hasher, recorder}
 }
 
-func (a *AcceptInviteUseCase) AcceptInvite(command AcceptInviteCommand) (user.User, error) {
+func (a *AcceptInviteUseCase) AcceptInvite(ctx context.Context, command AcceptInviteCommand) (user.User, error) {
+	event := audit.NewEvent(audit.ActionInviteAccept, audit.CategoryUsers)
 	now := time.Now()
 
 	pending, err := findUsableInvite(a.inviteRepository, a.hasher, command.Code, now)
 	if err != nil {
+		a.recordRefusal(ctx, event, command, err)
 		return user.User{}, err
 	}
+	event.Target = inviteTarget(pending)
 
+	created, err := a.accept(command, pending, now)
+	if err != nil {
+		a.recordRefusal(ctx, event, command, err)
+		return user.User{}, err
+	}
+	event.Actor = audit.UserActor(created)
+	a.recorder.Record(ctx, event)
+	return created, nil
+}
+
+func (a *AcceptInviteUseCase) recordRefusal(ctx context.Context, event audit.Event, command AcceptInviteCommand, cause error) {
+	event.Actor = audit.AnonymousActor(command.Username)
+	recordFailure(ctx, a.recorder, event, cause)
+}
+
+func (a *AcceptInviteUseCase) accept(command AcceptInviteCommand, pending invite.Invite, now time.Time) (user.User, error) {
 	if a.emailHasAccount(pending.Email) {
 		if _, err := findUsableInvite(a.inviteRepository, a.hasher, command.Code, now); err != nil {
 			return user.User{}, err

internal/infrastructure/useCases/CancelInvite.go

@@ -1,18 +1,36 @@
 package useCases
 
-import "RenewCMS/internal/domain/invite"
+import (
+	"RenewCMS/internal/domain/audit"
+	"RenewCMS/internal/domain/invite"
+	"context"
+)
 
 type CancelInviteUseCase struct {
 	inviteRepository invite.Repository
+	recorder         audit.Recorder
 }
 
-func NewCancelInviteUseCase(inviteRepository invite.Repository) *CancelInviteUseCase {
-	return &CancelInviteUseCase{inviteRepository}
+func NewCancelInviteUseCase(inviteRepository invite.Repository, recorder audit.Recorder) *CancelInviteUseCase {
+	return &CancelInviteUseCase{inviteRepository, recorder}
 }
 
-func (c *CancelInviteUseCase) CancelInvite(id uint32) error {
-	if _, err := findManageableInvite(c.inviteRepository, id); err != nil {
+func (c *CancelInviteUseCase) CancelInvite(ctx context.Context, id uint32) error {
+	event := audit.NewEvent(audit.ActionInviteCancel, audit.CategoryUsers)
+	pending, err := findManageableInvite(c.inviteRepository, id)
+	if err != nil {
+		recordFailure(ctx, c.recorder, event, err)
 		return err
 	}
-	return c.inviteRepository.Delete(id)
+	event.Target = inviteTarget(pending)
+	if err := c.inviteRepository.Delete(id); err != nil {
+		recordFailure(ctx, c.recorder, event, err)
+		return err
+	}
+	c.recorder.Record(ctx, event)
+	return nil
+}
+
+func inviteTarget(i invite.Invite) audit.Target {
+	return audit.NewTarget(audit.TargetInvite, i.ID, i.Email)
 }

internal/infrastructure/useCases/CheckForUpdate.go

@@ -1,7 +1,9 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/update"
+	"context"
 	"time"
 )
 
@@ -10,13 +12,27 @@ type CheckForUpdateUseCase struct {
 	store          update.StatusStore
 	currentVersion string
 	now            func() time.Time
+	recorder       audit.Recorder
 }
 
-func NewCheckForUpdateUseCase(feed update.ReleaseFeed, store update.StatusStore, currentVersion string, now func() time.Time) *CheckForUpdateUseCase {
-	return &CheckForUpdateUseCase{feed: feed, store: store, currentVersion: currentVersion, now: now}
+func NewCheckForUpdateUseCase(feed update.ReleaseFeed, store update.StatusStore, currentVersion string, now func() time.Time, recorder audit.Recorder) *CheckForUpdateUseCase {
+	return &CheckForUpdateUseCase{feed: feed, store: store, currentVersion: currentVersion, now: now, recorder: recorder}
 }
 
-func (c *CheckForUpdateUseCase) Check() (update.UpdateStatus, error) {
+func (c *CheckForUpdateUseCase) Check(ctx context.Context) (update.UpdateStatus, error) {
+	event := audit.NewEvent(audit.ActionUpdateChecked, audit.CategorySystem)
+	status, err := c.check()
+	if err != nil {
+		recordFailure(ctx, c.recorder, event, err)
+		return update.UpdateStatus{}, err
+	}
+	event.Target = audit.ReleaseTarget(status.Latest)
+	event.Params = map[string]any{audit.ParamUpdateAvailable: status.Available}
+	c.recorder.Record(ctx, event)
+	return status, nil
+}
+
+func (c *CheckForUpdateUseCase) check() (update.UpdateStatus, error) {
 	release, err := c.feed.Latest()
 	if err != nil {
 		return update.UpdateStatus{}, err

internal/infrastructure/useCases/CreateArticle.go

@@ -2,11 +2,14 @@ package useCases
 
 import (
 	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
+	"context"
 )
 
 type CreateArticleUseCase struct {
 	articleRepository article.Repository
 	bodyRenderer      article.BodyRenderer
+	recorder          audit.Recorder
 }
 
 type CreateArticleCommand struct {
@@ -15,12 +18,14 @@ type CreateArticleCommand struct {
 	Format article.BodyFormat
 }
 
-func NewCreateArticleUseCase(articleRepository article.Repository, bodyRenderer article.BodyRenderer) *CreateArticleUseCase {
-	return &CreateArticleUseCase{articleRepository, bodyRenderer}
+func NewCreateArticleUseCase(articleRepository article.Repository, bodyRenderer article.BodyRenderer, recorder audit.Recorder) *CreateArticleUseCase {
+	return &CreateArticleUseCase{articleRepository, bodyRenderer, recorder}
 }
 
-func (g *CreateArticleUseCase) CreateArticle(createArticle CreateArticleCommand) (article.Article, error) {
+func (g *CreateArticleUseCase) CreateArticle(ctx context.Context, createArticle CreateArticleCommand) (article.Article, error) {
+	event := audit.NewEvent(audit.ActionArticleCreate, audit.CategoryArticles)
 	if err := article.ValidateTitle(createArticle.Title); err != nil {
+		recordFailure(ctx, g.recorder, event, err)
 		return article.Article{}, err
 	}
 
@@ -30,7 +35,15 @@ func (g *CreateArticleUseCase) CreateArticle(createArticle CreateArticleCommand)
 		IsOnline: false,
 	})
 	if err != nil {
+		recordFailure(ctx, g.recorder, event, err)
 		return article.Article{}, err
 	}
+
+	event.Target = articleTarget(created)
+	g.recorder.Record(ctx, event)
 	return renderArticle(g.bodyRenderer, created, createArticle.Format)
 }
+
+func articleTarget(a article.Article) audit.Target {
+	return audit.NewTarget(audit.TargetArticle, a.ID, a.Title)
+}

internal/infrastructure/useCases/CreateImage.go

@@ -1,13 +1,16 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/image"
 	"bytes"
+	"context"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/xml"
 	stdimage "image"
 	"io"
+	"strings"
 
 	_ "golang.org/x/image/webp"
 	_ "image/jpeg"
@@ -25,13 +28,38 @@ var rasterFormats = map[string]string{
 type CreateImageUseCase struct {
 	imageRepository image.Repository
 	storage         image.Storage
+	recorder        audit.Recorder
 }
 
-func NewCreateImageUseCase(imageRepository image.Repository, storage image.Storage) *CreateImageUseCase {
-	return &CreateImageUseCase{imageRepository, storage}
+func NewCreateImageUseCase(imageRepository image.Repository, storage image.Storage, recorder audit.Recorder) *CreateImageUseCase {
+	return &CreateImageUseCase{imageRepository, storage, recorder}
 }
 
-func (g *CreateImageUseCase) CreateImage(input image.ImageInput) (image.Image, error) {
+func (g *CreateImageUseCase) CreateImage(ctx context.Context, input image.ImageInput) (image.Image, error) {
+	created, err := g.create(input)
+	event := audit.NewEvent(audit.ActionMediaUpload, audit.CategoryMedia)
+	if err != nil {
+		event.Target = attemptedUploadTarget(input)
+		recordFailure(ctx, g.recorder, event, err)
+		return image.Image{}, err
+	}
+	event.Target = imageTarget(created)
+	g.recorder.Record(ctx, event)
+	return created, nil
+}
+
+func imageTarget(img image.Image) audit.Target {
+	return audit.NewTarget(audit.TargetImage, img.ID, img.Filename)
+}
+
+func attemptedUploadTarget(input image.ImageInput) audit.Target {
+	if strings.TrimSpace(input.Filename) == "" {
+		return audit.Target{}
+	}
+	return audit.Target{Type: audit.TargetImage, Name: image.NormalizeUploadFilename(input.Filename, input.ContentType)}
+}
+
+func (g *CreateImageUseCase) create(input image.ImageInput) (image.Image, error) {
 	if !image.IsAllowedContentType(input.ContentType) {
 		return image.Image{}, image.ErrImageTypeNotAllowed
 	}

internal/infrastructure/useCases/CreateInvite.go

@@ -1,10 +1,12 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/invite"
 	"RenewCMS/internal/domain/mail"
 	"RenewCMS/internal/domain/user"
+	"context"
 	"errors"
 	"strings"
 	"time"
@@ -15,6 +17,7 @@ type CreateInviteUseCase struct {
 	inviteRepository invite.Repository
 	hasher           hash.Hasher
 	mailer           inviteMailer
+	recorder         audit.Recorder
 }
 
 type CreateInviteCommand struct {
@@ -22,11 +25,23 @@ type CreateInviteCommand struct {
 	InvitedBy uint32
 }
 
-func NewCreateInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string) *CreateInviteUseCase {
-	return &CreateInviteUseCase{userRepository, inviteRepository, hasher, inviteMailer{mailRepository, publicURL}}
+func NewCreateInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string, recorder audit.Recorder) *CreateInviteUseCase {
+	return &CreateInviteUseCase{userRepository, inviteRepository, hasher, inviteMailer{mailRepository, publicURL}, recorder}
 }
 
-func (g *CreateInviteUseCase) CreateInvite(command CreateInviteCommand) (invite.Invite, error) {
+func (g *CreateInviteUseCase) CreateInvite(ctx context.Context, command CreateInviteCommand) (invite.Invite, error) {
+	event := audit.NewEvent(audit.ActionInviteCreate, audit.CategoryUsers)
+	created, err := g.create(command)
+	if err != nil {
+		recordFailure(ctx, g.recorder, event, err)
+		return invite.Invite{}, err
+	}
+	event.Target = inviteTarget(created)
+	g.recorder.Record(ctx, event)
+	return created, nil
+}
+
+func (g *CreateInviteUseCase) create(command CreateInviteCommand) (invite.Invite, error) {
 	email := strings.ToLower(command.Email)
 	now := time.Now()
 

internal/infrastructure/useCases/CreateUser.go

@@ -1,9 +1,11 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/mail"
 	"RenewCMS/internal/domain/user"
+	"context"
 	"errors"
 	"fmt"
 	"time"
@@ -16,6 +18,7 @@ type CreateUserUseCase struct {
 	hasher         hash.Hasher
 	mailRepository mail.Repository
 	publicURL      string
+	recorder       audit.Recorder
 }
 
 type CreateUserCommand struct {
@@ -29,11 +32,25 @@ type MailValidationData struct {
 	VerificationCode string
 }
 
-func NewCreateUserUseCase(userRepository user.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string) *CreateUserUseCase {
-	return &CreateUserUseCase{userRepository, hasher, mailRepository, publicURL}
+func NewCreateUserUseCase(userRepository user.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string, recorder audit.Recorder) *CreateUserUseCase {
+	return &CreateUserUseCase{userRepository, hasher, mailRepository, publicURL, recorder}
 }
 
-func (g *CreateUserUseCase) CreateUser(createUser CreateUserCommand) (user.User, error) {
+func (g *CreateUserUseCase) CreateUser(ctx context.Context, createUser CreateUserCommand) (user.User, error) {
+	event := audit.NewEvent(audit.ActionUserRegister, audit.CategoryUsers)
+	created, err := g.create(createUser)
+	if err != nil {
+		event.Actor = audit.AnonymousActor(createUser.Username)
+		recordFailure(ctx, g.recorder, event, err)
+		return user.User{}, err
+	}
+	event.Actor = audit.UserActor(created)
+	event.Target = audit.NewTarget(audit.TargetUser, created.ID, created.Username)
+	g.recorder.Record(ctx, event)
+	return created, nil
+}
+
+func (g *CreateUserUseCase) create(createUser CreateUserCommand) (user.User, error) {
 	if g.registrationClosed() {
 		return user.User{}, user.ErrRegistrationClosed
 	}
@@ -70,7 +87,7 @@ func (g *CreateUserUseCase) CreateUser(createUser CreateUserCommand) (user.User,
 		Host:             g.publicURL,
 		VerificationCode: rawUuid,
 	}); err != nil {
-		sendErr := fmt.Errorf("failed to send verification email: %w", err)
+		sendErr := fmt.Errorf("%w: %w", user.ErrVerificationEmailNotSent, err)
 		if deleteErr := g.userRepository.Delete(createdUser.ID); deleteErr != nil {
 			return user.User{}, errors.Join(sendErr, deleteErr)
 		}

internal/infrastructure/useCases/DeleteArticle.go

@@ -1,15 +1,32 @@
 package useCases
 
-import "RenewCMS/internal/domain/article"
+import (
+	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
+	"context"
+)
 
 type DeleteArticleUseCase struct {
 	articleRepository article.Repository
+	recorder          audit.Recorder
 }
 
-func NewDeleteArticleUseCase(articleRepository article.Repository) *DeleteArticleUseCase {
-	return &DeleteArticleUseCase{articleRepository}
+func NewDeleteArticleUseCase(articleRepository article.Repository, recorder audit.Recorder) *DeleteArticleUseCase {
+	return &DeleteArticleUseCase{articleRepository, recorder}
 }
 
-func (g *DeleteArticleUseCase) DeleteArticle(id uint32) error {
-	return g.articleRepository.Delete(id)
+func (g *DeleteArticleUseCase) DeleteArticle(ctx context.Context, id uint32) error {
+	target, err := g.articleRepository.Get(id)
+	if err != nil {
+		return err
+	}
+
+	event := audit.NewEvent(audit.ActionArticleDelete, audit.CategoryArticles)
+	event.Target = articleTarget(target)
+	if err := g.articleRepository.Delete(id); err != nil {
+		recordFailure(ctx, g.recorder, event, err)
+		return err
+	}
+	g.recorder.Record(ctx, event)
+	return nil
 }

internal/infrastructure/useCases/DeleteMedia.go

@@ -1,20 +1,33 @@
 package useCases
 
-import "RenewCMS/internal/domain/image"
+import (
+	"RenewCMS/internal/domain/audit"
+	"RenewCMS/internal/domain/image"
+	"context"
+)
 
 type DeleteMediaUseCase struct {
 	imageRepository image.Repository
 	remover         mediaRemover
+	recorder        audit.Recorder
 }
 
-func NewDeleteMediaUseCase(imageRepository image.Repository, storage image.Storage) *DeleteMediaUseCase {
-	return &DeleteMediaUseCase{imageRepository, mediaRemover{imageRepository, storage}}
+func NewDeleteMediaUseCase(imageRepository image.Repository, storage image.Storage, recorder audit.Recorder) *DeleteMediaUseCase {
+	return &DeleteMediaUseCase{imageRepository, mediaRemover{imageRepository, storage}, recorder}
 }
 
-func (u *DeleteMediaUseCase) Delete(id uint32) error {
+func (u *DeleteMediaUseCase) Delete(ctx context.Context, id uint32) error {
 	img, err := u.imageRepository.Get(id)
 	if err != nil {
 		return err
 	}
-	return u.remover.remove(img)
+
+	event := audit.NewEvent(audit.ActionMediaDelete, audit.CategoryMedia)
+	event.Target = imageTarget(img)
+	if err := u.remover.remove(img); err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return err
+	}
+	u.recorder.Record(ctx, event)
+	return nil
 }

internal/infrastructure/useCases/ListActivity.go

@@ -11,11 +11,6 @@ import (
 	"time"
 )
 
-const (
-	targetArticle = "article"
-	targetImage   = "image"
-)
-
 type ListActivityUseCase struct {
 	events   audit.Repository
 	users    user.Repository
@@ -118,7 +113,7 @@ func (l *ListActivityUseCase) targetExists(target audit.Target) (bool, error) {
 		return true, nil
 	}
 	switch target.Type {
-	case targetArticle:
+	case audit.TargetArticle:
 		_, err = l.articles.Get(uint32(id))
 		return existsUnless(err, article.ErrArticleNotFound)
 	case audit.TargetUser:
@@ -127,7 +122,7 @@ func (l *ListActivityUseCase) targetExists(target audit.Target) (bool, error) {
 	case audit.TargetAPIKey:
 		_, err = l.apiKeys.Get(uint32(id))
 		return existsUnless(err, apikey.ErrAPIKeyNotFound)
-	case targetImage:
+	case audit.TargetImage:
 		_, err = l.images.Get(uint32(id))
 		return existsUnless(err, image.ErrImageNotFound)
 	default:

internal/infrastructure/useCases/MergeMedia.go

@@ -2,8 +2,10 @@ package useCases
 
 import (
 	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/image"
 	"cmp"
+	"context"
 	"errors"
 	"slices"
 	"strings"
@@ -19,10 +21,11 @@ type MergeMediaUseCase struct {
 	imageRepository   image.Repository
 	articleRepository article.Repository
 	remover           mediaRemover
+	recorder          audit.Recorder
 }
 
-func NewMergeMediaUseCase(imageRepository image.Repository, articleRepository article.Repository, storage image.Storage) *MergeMediaUseCase {
-	return &MergeMediaUseCase{imageRepository, articleRepository, mediaRemover{imageRepository, storage}}
+func NewMergeMediaUseCase(imageRepository image.Repository, articleRepository article.Repository, storage image.Storage, recorder audit.Recorder) *MergeMediaUseCase {
+	return &MergeMediaUseCase{imageRepository, articleRepository, mediaRemover{imageRepository, storage}, recorder}
 }
 
 type bodyRewrite struct {
@@ -31,7 +34,30 @@ type bodyRewrite struct {
 	rewritten string
 }
 
-func (u *MergeMediaUseCase) Merge(keepId uint32, mergeIds []uint32) (MergeMediaResult, error) {
+func (u *MergeMediaUseCase) Merge(ctx context.Context, keepId uint32, mergeIds []uint32) (MergeMediaResult, error) {
+	result, err := u.merge(keepId, mergeIds)
+	event := audit.NewEvent(audit.ActionMediaMerge, audit.CategoryMedia)
+	if kept, found := u.keptImage(keepId); found {
+		event.Target = imageTarget(kept)
+	}
+	if err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return MergeMediaResult{}, err
+	}
+	event.Params = map[string]any{audit.ParamMerged: result.Merged, audit.ParamArticlesUpdated: result.ArticlesUpdated}
+	u.recorder.Record(ctx, event)
+	return result, nil
+}
+
+func (u *MergeMediaUseCase) keptImage(keepId uint32) (image.Image, bool) {
+	if keepId == 0 {
+		return image.Image{}, false
+	}
+	kept, err := u.imageRepository.Get(keepId)
+	return kept, err == nil
+}
+
+func (u *MergeMediaUseCase) merge(keepId uint32, mergeIds []uint32) (MergeMediaResult, error) {
 	if err := validateMergeRequest(keepId, mergeIds); err != nil {
 		return MergeMediaResult{}, err
 	}

internal/infrastructure/useCases/PurgeScheduler.go

@@ -1,21 +1,25 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/purge"
+	"context"
+	"errors"
 	"time"
 )
 
 type PurgeRunner interface {
-	Run(fingerprint *string) (purge.RunResult, error)
+	Execute(fingerprint *string) (purge.RunResult, error)
 }
 
 type PurgeSchedulerUseCase struct {
 	repository purge.Repository
 	runner     PurgeRunner
+	recorder   audit.Recorder
 }
 
-func NewPurgeSchedulerUseCase(repository purge.Repository, runner PurgeRunner) *PurgeSchedulerUseCase {
-	return &PurgeSchedulerUseCase{repository, runner}
+func NewPurgeSchedulerUseCase(repository purge.Repository, runner PurgeRunner, recorder audit.Recorder) *PurgeSchedulerUseCase {
+	return &PurgeSchedulerUseCase{repository, runner, recorder}
 }
 
 func (u *PurgeSchedulerUseCase) Tick(now time.Time) (purge.RunResult, bool, error) {
@@ -27,9 +31,29 @@ func (u *PurgeSchedulerUseCase) Tick(now time.Time) (purge.RunResult, bool, erro
 	if next == nil || now.Before(*next) {
 		return purge.RunResult{}, false, nil
 	}
-	result, err := u.runner.Run(nil)
+	result, err := u.runner.Execute(nil)
 	if err != nil {
+		u.recordFailedRun(err)
 		return purge.RunResult{}, false, err
 	}
+	if result.GroupsTotal > 0 {
+		event := systemPurgeEvent()
+		event.Params = purgeParams(result)
+		u.recorder.Record(context.Background(), event)
+	}
 	return result, true, nil
 }
+
+func (u *PurgeSchedulerUseCase) recordFailedRun(err error) {
+	if errors.Is(err, purge.ErrPurgeBusy) {
+		return
+	}
+	failFrom(context.Background(), u.recorder, systemPurgeEvent(), reasonFor(err))
+}
+
+func systemPurgeEvent() audit.Event {
+	event := audit.NewEvent(audit.ActionMediaPurgeScheduled, audit.CategorySystem)
+	event.Actor = audit.SystemActor()
+	event.Source = audit.SourceSystem
+	return event
+}

internal/infrastructure/useCases/RenameMedia.go

@@ -1,25 +1,43 @@
 package useCases
 
-import "RenewCMS/internal/domain/image"
+import (
+	"RenewCMS/internal/domain/audit"
+	"RenewCMS/internal/domain/image"
+	"context"
+)
 
 type RenameMediaUseCase struct {
 	imageRepository image.Repository
+	recorder        audit.Recorder
 }
 
-func NewRenameMediaUseCase(imageRepository image.Repository) *RenameMediaUseCase {
-	return &RenameMediaUseCase{imageRepository}
-}
-
-func (u *RenameMediaUseCase) Rename(id uint32, stem string) (image.Image, error) {
-	validStem, err := image.ValidateFilenameStem(stem)
-	if err != nil {
-		return image.Image{}, err
+func NewRenameMediaUseCase(imageRepository image.Repository, recorder audit.Recorder) *RenameMediaUseCase {
+	return &RenameMediaUseCase{imageRepository, recorder}
 }
 
+func (u *RenameMediaUseCase) Rename(ctx context.Context, id uint32, stem string) (image.Image, error) {
 	current, err := u.imageRepository.Get(id)
 	if err != nil {
 		return image.Image{}, err
 	}
 
-	return u.imageRepository.Rename(id, validStem+image.ExtensionOf(current.Filename))
+	event := audit.NewEvent(audit.ActionMediaRename, audit.CategoryMedia)
+	event.Target = imageTarget(current)
+	validStem, err := image.ValidateFilenameStem(stem)
+	if err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return image.Image{}, err
+	}
+
+	renamed, err := u.imageRepository.Rename(id, validStem+image.ExtensionOf(current.Filename))
+	if err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return image.Image{}, err
+	}
+	if renamed.Filename != current.Filename {
+		event.Target = imageTarget(renamed)
+		event.Changes = []audit.Change{audit.TextChange(audit.FieldFilename, current.Filename, renamed.Filename)}
+		u.recorder.Record(ctx, event)
+	}
+	return renamed, nil
 }

internal/infrastructure/useCases/RenewInvite.go

@@ -1,10 +1,12 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/invite"
 	"RenewCMS/internal/domain/mail"
 	"RenewCMS/internal/domain/user"
+	"context"
 	"errors"
 	"time"
 )
@@ -14,6 +16,7 @@ type RenewInviteUseCase struct {
 	inviteRepository invite.Repository
 	hasher           hash.Hasher
 	mailer           inviteMailer
+	recorder         audit.Recorder
 }
 
 type RenewInviteCommand struct {
@@ -21,11 +24,23 @@ type RenewInviteCommand struct {
 	RenewedBy uint32
 }
 
-func NewRenewInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string) *RenewInviteUseCase {
-	return &RenewInviteUseCase{userRepository, inviteRepository, hasher, inviteMailer{mailRepository, publicURL}}
+func NewRenewInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string, recorder audit.Recorder) *RenewInviteUseCase {
+	return &RenewInviteUseCase{userRepository, inviteRepository, hasher, inviteMailer{mailRepository, publicURL}, recorder}
 }
 
-func (u *RenewInviteUseCase) RenewInvite(command RenewInviteCommand) (invite.Invite, error) {
+func (u *RenewInviteUseCase) RenewInvite(ctx context.Context, command RenewInviteCommand) (invite.Invite, error) {
+	event := audit.NewEvent(audit.ActionInviteRenew, audit.CategoryUsers)
+	renewed, err := u.renew(command)
+	if err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return invite.Invite{}, err
+	}
+	event.Target = inviteTarget(renewed)
+	u.recorder.Record(ctx, event)
+	return renewed, nil
+}
+
+func (u *RenewInviteUseCase) renew(command RenewInviteCommand) (invite.Invite, error) {
 	now := time.Now()
 
 	renewer, err := u.userRepository.Get(command.RenewedBy)

internal/infrastructure/useCases/RequestRestart.go

@@ -1,7 +1,9 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/update"
+	"context"
 	"sync"
 	"time"
 )
@@ -13,10 +15,11 @@ type RequestRestartUseCase struct {
 	requests update.RestartRequestStore
 	status   updateStatusBuilder
 	now      func() time.Time
+	recorder audit.Recorder
 	mu       sync.Mutex
 }
 
-func NewRequestRestartUseCase(store update.StatusStore, jobs update.JobStore, helper update.HelperDetector, results update.ResultStore, requests update.RestartRequestStore, currentVersion string, now func() time.Time) *RequestRestartUseCase {
+func NewRequestRestartUseCase(store update.StatusStore, jobs update.JobStore, helper update.HelperDetector, results update.ResultStore, requests update.RestartRequestStore, currentVersion string, now func() time.Time, recorder audit.Recorder) *RequestRestartUseCase {
 	return &RequestRestartUseCase{
 		jobs:     jobs,
 		helper:   helper,
@@ -24,12 +27,33 @@ func NewRequestRestartUseCase(store update.StatusStore, jobs update.JobStore, he
 		requests: requests,
 		status:   updateStatusBuilder{store: store, jobs: jobs, results: results, requests: requests, currentVersion: currentVersion, now: now},
 		now:      now,
+		recorder: recorder,
 	}
 }
 
-func (r *RequestRestartUseCase) Request(userId uint32, kind string) (update.UpdateStatus, error) {
+func (r *RequestRestartUseCase) Request(ctx context.Context, userId uint32, kind string) (update.UpdateStatus, error) {
+	event := audit.NewEvent(audit.ActionRestartRequested, audit.CategorySystem)
+	status, request, err := r.request(userId, kind)
+	if err != nil {
+		recordFailure(ctx, r.recorder, event, err, restartFailureReasons...)
+		return update.UpdateStatus{}, err
+	}
+	event.Params = restartParams(request)
+	r.recorder.Record(ctx, event)
+	return status, nil
+}
+
+func restartParams(request update.RestartRequest) map[string]any {
+	params := map[string]any{audit.ParamKind: request.Kind}
+	if request.Kind == update.RestartKindUpdate {
+		params[audit.ParamTag] = request.Tag
+	}
+	return params
+}
+
+func (r *RequestRestartUseCase) request(userId uint32, kind string) (update.UpdateStatus, update.RestartRequest, error) {
 	if !r.helper.Installed() {
-		return update.UpdateStatus{}, update.ErrNotPrepared
+		return update.UpdateStatus{}, update.RestartRequest{}, update.ErrNotPrepared
 	}
 
 	r.mu.Lock()
@@ -37,19 +61,19 @@ func (r *RequestRestartUseCase) Request(userId uint32, kind string) (update.Upda
 
 	current := r.status.build(true)
 	if err := refuseWhileBusy(current); err != nil {
-		return update.UpdateStatus{}, err
+		return update.UpdateStatus{}, update.RestartRequest{}, err
 	}
 	request, err := r.requestFor(kind, userId)
 	if err != nil {
-		return update.UpdateStatus{}, err
+		return update.UpdateStatus{}, update.RestartRequest{}, err
 	}
 	if err := r.results.Delete(); err != nil {
-		return update.UpdateStatus{}, err
+		return update.UpdateStatus{}, update.RestartRequest{}, err
 	}
 	if err := r.requests.Write(request); err != nil {
-		return update.UpdateStatus{}, err
+		return update.UpdateStatus{}, update.RestartRequest{}, err
 	}
-	return r.status.build(true), nil
+	return r.status.build(true), request, nil
 }
 
 func refuseWhileBusy(status update.UpdateStatus) error {

internal/infrastructure/useCases/RunPurge.go

@@ -2,8 +2,10 @@ package useCases
 
 import (
 	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/image"
 	"RenewCMS/internal/domain/purge"
+	"context"
 	"log"
 	"slices"
 	"sync"
@@ -16,20 +18,42 @@ type RunPurgeUseCase struct {
 	repository purge.Repository
 	now        func() time.Time
 	logger     *log.Logger
+	recorder   audit.Recorder
 	guard      sync.Mutex
 }
 
-func NewRunPurgeUseCase(imageRepository image.Repository, articleRepository article.Repository, merge *MergeMediaUseCase, repository purge.Repository, now func() time.Time, logger *log.Logger) *RunPurgeUseCase {
+func NewRunPurgeUseCase(imageRepository image.Repository, articleRepository article.Repository, merge *MergeMediaUseCase, repository purge.Repository, now func() time.Time, logger *log.Logger, recorder audit.Recorder) *RunPurgeUseCase {
 	return &RunPurgeUseCase{
 		planner:    &purgePlanner{imageRepository, articleRepository},
 		merge:      merge,
 		repository: repository,
 		now:        now,
 		logger:     logger,
+		recorder:   recorder,
 	}
 }
 
-func (u *RunPurgeUseCase) Run(fingerprint *string) (purge.RunResult, error) {
+func (u *RunPurgeUseCase) Run(ctx context.Context, fingerprint *string) (purge.RunResult, error) {
+	result, err := u.Execute(fingerprint)
+	event := audit.NewEvent(audit.ActionMediaPurge, audit.CategoryMedia)
+	if err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return purge.RunResult{}, err
+	}
+	event.Params = purgeParams(result)
+	u.recorder.Record(ctx, event)
+	return result, nil
+}
+
+func purgeParams(result purge.RunResult) map[string]any {
+	params := map[string]any{audit.ParamMerged: result.Merged, audit.ParamArticlesUpdated: result.ArticlesUpdated}
+	if result.FailedGroups > 0 {
+		params[audit.ParamFailedGroups] = result.FailedGroups
+	}
+	return params
+}
+
+func (u *RunPurgeUseCase) Execute(fingerprint *string) (purge.RunResult, error) {
 	if !u.guard.TryLock() {
 		return purge.RunResult{}, purge.ErrPurgeBusy
 	}
@@ -55,7 +79,7 @@ func (u *RunPurgeUseCase) mergeGroups(plan purgePlan) purge.RunResult {
 	result := purge.RunResult{GroupsTotal: len(plan.groups)}
 	updated := map[uint32]bool{}
 	for _, group := range plan.groups {
-		merged, err := u.merge.Merge(group.kept.ID, slices.Clone(group.mergedIds))
+		merged, err := u.merge.merge(group.kept.ID, slices.Clone(group.mergedIds))
 		if err != nil {
 			result.FailedGroups++
 			continue

internal/infrastructure/useCases/StartUpdateDownload.go

@@ -1,7 +1,9 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/update"
+	"context"
 	"errors"
 	"fmt"
 	"sync"
@@ -24,6 +26,7 @@ type StartUpdateDownloadUseCase struct {
 	platform       update.Platform
 	feedHost       string
 	now            func() time.Time
+	recorder       audit.Recorder
 	mu             sync.Mutex
 }
 
@@ -43,6 +46,7 @@ type StartUpdateDownloadDependencies struct {
 	Platform       update.Platform
 	FeedURL        string
 	Now            func() time.Time
+	Recorder       audit.Recorder
 }
 
 type jobFailure struct {
@@ -78,10 +82,19 @@ func NewStartUpdateDownloadUseCase(dependencies StartUpdateDownloadDependencies)
 		platform:       dependencies.Platform,
 		feedHost:       update.HostOf(dependencies.FeedURL),
 		now:            dependencies.Now,
+		recorder:       dependencies.Recorder,
 	}
 }
 
-func (s *StartUpdateDownloadUseCase) Start() (update.UpdateStatus, error) {
+func (s *StartUpdateDownloadUseCase) Start(ctx context.Context) (update.UpdateStatus, error) {
+	status, err := s.start(ctx)
+	if err != nil {
+		recordFailure(ctx, s.recorder, audit.NewEvent(audit.ActionUpdateDownloaded, audit.CategorySystem), err)
+	}
+	return status, err
+}
+
+func (s *StartUpdateDownloadUseCase) start(ctx context.Context) (update.UpdateStatus, error) {
 	if !s.helper.Installed() {
 		return update.UpdateStatus{}, update.ErrNotPrepared
 	}
@@ -118,7 +131,7 @@ func (s *StartUpdateDownloadUseCase) Start() (update.UpdateStatus, error) {
 		return update.UpdateStatus{}, err
 	}
 	status := s.status.build(true)
-	go s.run(job, binary, checksums, signature)
+	go s.run(context.WithoutCancel(ctx), job, binary, checksums, signature)
 
 	return status, nil
 }
@@ -139,15 +152,19 @@ func (s *StartUpdateDownloadUseCase) preflight(result update.CheckResult) (binar
 	return found[0], found[1], found[2], nil
 }
 
-func (s *StartUpdateDownloadUseCase) run(job update.Job, binary, checksums, signature update.Asset) {
+func (s *StartUpdateDownloadUseCase) run(ctx context.Context, job update.Job, binary, checksums, signature update.Asset) {
 	defer func() {
 		if recovered := recover(); recovered != nil {
-			s.fail(job, downloadFailure(fmt.Errorf("panic: %v", recovered)))
+			s.fail(ctx, job, downloadFailure(fmt.Errorf("panic: %v", recovered)))
 		}
 	}()
 	if err := s.execute(&job, binary, checksums, signature); err != nil {
-		s.fail(job, err)
+		s.fail(ctx, job, err)
+		return
 	}
+	event := audit.NewEvent(audit.ActionUpdateDownloaded, audit.CategorySystem)
+	event.Target = audit.ReleaseTarget(job.Tag)
+	s.recorder.Record(ctx, event)
 }
 
 func (s *StartUpdateDownloadUseCase) execute(job *update.Job, binary, checksums, signature update.Asset) error {
@@ -263,7 +280,7 @@ func downloadFailure(err error) error {
 	return jobFailure{kind: update.ErrorKindDownload, reason: err}
 }
 
-func (s *StartUpdateDownloadUseCase) fail(job update.Job, err error) {
+func (s *StartUpdateDownloadUseCase) fail(ctx context.Context, job update.Job, err error) {
 	kind := update.ErrorKindDownload
 	var failure jobFailure
 	if errors.As(err, &failure) {
@@ -279,4 +296,7 @@ func (s *StartUpdateDownloadUseCase) fail(job update.Job, err error) {
 	if saveErr := s.jobs.Save(job); saveErr != nil {
 		s.logger.Printf("update job record could not be saved: %v", saveErr)
 	}
+	event := audit.NewEvent(audit.ActionUpdateDownloaded, audit.CategorySystem)
+	event.Target = audit.ReleaseTarget(job.Tag)
+	failFrom(ctx, s.recorder, event, downloadFailureReasons[kind])
 }

internal/infrastructure/useCases/UpdateArticle.go

@@ -1,28 +1,69 @@
 package useCases
 
-import "RenewCMS/internal/domain/article"
+import (
+	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
+	"context"
+)
 
 type UpdateArticleUseCase struct {
 	articleRepository article.Repository
 	bodyRenderer      article.BodyRenderer
+	recorder          audit.Recorder
 }
 
-func NewUpdateArticleUseCase(articleRepository article.Repository, bodyRenderer article.BodyRenderer) *UpdateArticleUseCase {
-	return &UpdateArticleUseCase{articleRepository, bodyRenderer}
+func NewUpdateArticleUseCase(articleRepository article.Repository, bodyRenderer article.BodyRenderer, recorder audit.Recorder) *UpdateArticleUseCase {
+	return &UpdateArticleUseCase{articleRepository, bodyRenderer, recorder}
 }
 
-func (g *UpdateArticleUseCase) UpdateBody(id uint32, body string, format article.BodyFormat) (article.Article, error) {
+func (g *UpdateArticleUseCase) UpdateBody(ctx context.Context, id uint32, body string, format article.BodyFormat) (article.Article, error) {
+	before, err := g.articleRepository.Get(id)
+	if err != nil {
+		return article.Article{}, err
+	}
 	updated, err := g.articleRepository.UpdateBody(id, body)
 	if err != nil {
+		g.recordFailure(ctx, audit.ActionArticleEdit, before, err)
 		return article.Article{}, err
 	}
+	g.recordChange(ctx, audit.ActionArticleEdit, before, updated)
 	return renderArticle(g.bodyRenderer, updated, format)
 }
 
-func (g *UpdateArticleUseCase) UpdateIsOnline(id uint32, isOnline bool, format article.BodyFormat) (article.Article, error) {
-	updated, err := g.articleRepository.UpdateIsOnline(id, isOnline)
+func (g *UpdateArticleUseCase) UpdateIsOnline(ctx context.Context, id uint32, isOnline bool, format article.BodyFormat) (article.Article, error) {
+	before, err := g.articleRepository.Get(id)
 	if err != nil {
 		return article.Article{}, err
 	}
+	updated, err := g.articleRepository.UpdateIsOnline(id, isOnline)
+	if err != nil {
+		g.recordFailure(ctx, publishAction(isOnline), before, err)
+		return article.Article{}, err
+	}
+	g.recordChange(ctx, publishAction(isOnline), before, updated)
 	return renderArticle(g.bodyRenderer, updated, format)
 }
+
+func publishAction(isOnline bool) string {
+	if isOnline {
+		return audit.ActionArticlePublish
+	}
+	return audit.ActionArticleUnpublish
+}
+
+func (g *UpdateArticleUseCase) recordChange(ctx context.Context, action string, before article.Article, after article.Article) {
+	changes := audit.ArticleChanges(before, after)
+	if len(changes) == 0 {
+		return
+	}
+	event := audit.NewEvent(action, audit.CategoryArticles)
+	event.Target = articleTarget(after)
+	event.Changes = changes
+	g.recorder.Record(ctx, event)
+}
+
+func (g *UpdateArticleUseCase) recordFailure(ctx context.Context, action string, before article.Article, cause error) {
+	event := audit.NewEvent(action, audit.CategoryArticles)
+	event.Target = articleTarget(before)
+	recordFailure(ctx, g.recorder, event, cause)
+}

internal/infrastructure/useCases/UpdateUserProfile.go

@@ -1,7 +1,9 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/user"
+	"context"
 	"strings"
 	"unicode/utf8"
 )
@@ -10,16 +12,40 @@ const maxDisplayNameRunes = 60
 
 type UpdateUserProfileUseCase struct {
 	userRepository user.Repository
+	recorder       audit.Recorder
 }
 
-func NewUpdateUserProfileUseCase(userRepository user.Repository) *UpdateUserProfileUseCase {
-	return &UpdateUserProfileUseCase{userRepository}
+func NewUpdateUserProfileUseCase(userRepository user.Repository, recorder audit.Recorder) *UpdateUserProfileUseCase {
+	return &UpdateUserProfileUseCase{userRepository, recorder}
 }
 
-func (u *UpdateUserProfileUseCase) UpdateDisplayName(userId uint32, displayName string) (user.User, error) {
+func (u *UpdateUserProfileUseCase) UpdateDisplayName(ctx context.Context, userId uint32, displayName string) (user.User, error) {
+	before, err := u.userRepository.Get(userId)
+	if err != nil {
+		return user.User{}, err
+	}
+
+	event := audit.NewEvent(audit.ActionUserUpdateProfile, audit.CategoryUsers)
+	event.Target = userTarget(before)
 	trimmed := strings.TrimSpace(displayName)
 	if utf8.RuneCountInString(trimmed) > maxDisplayNameRunes {
+		recordFailure(ctx, u.recorder, event, user.ErrInvalidDisplayName)
 		return user.User{}, user.ErrInvalidDisplayName
 	}
-	return u.userRepository.UpdateDisplayName(userId, trimmed)
+
+	updated, err := u.userRepository.UpdateDisplayName(userId, trimmed)
+	if err != nil {
+		recordFailure(ctx, u.recorder, event, err)
+		return user.User{}, err
+	}
+	if updated.DisplayName != before.DisplayName {
+		event.Target = userTarget(updated)
+		event.Changes = []audit.Change{audit.TextChange(audit.FieldDisplayName, before.DisplayName, updated.DisplayName)}
+		u.recorder.Record(ctx, event)
+	}
+	return updated, nil
+}
+
+func userTarget(u user.User) audit.Target {
+	return audit.NewTarget(audit.TargetUser, u.ID, audit.UserActor(u).Name)
 }

internal/infrastructure/useCases/VerifyUser.go

@@ -1,26 +1,42 @@
 package useCases
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/user"
+	"context"
 	"time"
 )
 
 type VerifyUserUseCase struct {
 	userRepository user.Repository
 	hasher         hash.Hasher
+	recorder       audit.Recorder
 }
 
-func NewVerifyUserUseCase(userRepository user.Repository, hasher hash.Hasher) *VerifyUserUseCase {
-	return &VerifyUserUseCase{userRepository, hasher}
+func NewVerifyUserUseCase(userRepository user.Repository, hasher hash.Hasher, recorder audit.Recorder) *VerifyUserUseCase {
+	return &VerifyUserUseCase{userRepository, hasher, recorder}
 }
 
-func (v *VerifyUserUseCase) Verify(userId uint32, code string) (user.User, error) {
+func (v *VerifyUserUseCase) Verify(ctx context.Context, userId uint32, code string) (user.User, error) {
 	dbUser, err := v.userRepository.Get(userId)
 	if err != nil {
 		return user.User{}, err
 	}
 
+	event := audit.NewEvent(audit.ActionUserVerify, audit.CategoryUsers)
+	event.Actor = audit.UserActor(dbUser)
+	event.Target = audit.NewTarget(audit.TargetUser, dbUser.ID, dbUser.Username)
+	verified, err := v.verify(dbUser, code)
+	if err != nil {
+		recordFailure(ctx, v.recorder, event, err)
+		return user.User{}, err
+	}
+	v.recorder.Record(ctx, event)
+	return verified, nil
+}
+
+func (v *VerifyUserUseCase) verify(dbUser user.User, code string) (user.User, error) {
 	if dbUser.VerificationCode == "" || v.hasher.Compare(dbUser.VerificationCode, code) != nil {
 		return user.User{}, user.ErrInvalidVerificationCode
 	}
@@ -29,5 +45,5 @@ func (v *VerifyUserUseCase) Verify(userId uint32, code string) (user.User, error
 		return user.User{}, user.ErrVerificationCodeExpired
 	}
 
-	return v.userRepository.ClearVerificationCode(userId)
+	return v.userRepository.ClearVerificationCode(dbUser.ID)
 }

internal/infrastructure/useCases/auditFailures.go

@@ -0,0 +1,101 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
+	"RenewCMS/internal/domain/image"
+	"RenewCMS/internal/domain/invite"
+	"RenewCMS/internal/domain/purge"
+	"RenewCMS/internal/domain/update"
+	"RenewCMS/internal/domain/user"
+	"context"
+	"errors"
+	"slices"
+)
+
+const GenericFailureReason = "Something went wrong on our side. Please try again."
+
+type failureReason struct {
+	cause  error
+	reason string
+}
+
+var failureReasons = []failureReason{
+	{article.ErrInvalidTitle, "The title must be between 3 and 200 characters."},
+	{image.ErrImageTypeNotAllowed, "The file must be a PNG, JPEG, WEBP or SVG image."},
+	{image.ErrImageTooLarge, "The file is too large to upload."},
+	{image.ErrImageUnreadable, "The image could not be read."},
+	{image.ErrInvalidFilename, "That file name is not valid."},
+	{image.ErrInvalidMergeRequest, "The merge request is not valid."},
+	{image.ErrMergeCopyMissing, "One of the copies no longer exists."},
+	{image.ErrMergeHashMismatch, "The images are not identical copies."},
+	{purge.ErrPurgeConflict, "The library changed since the preview. Review it again."},
+	{purge.ErrPurgeBusy, "A purge is already running."},
+	{user.ErrRegistrationClosed, "Registration is closed on this site."},
+	{user.ErrVerificationEmailNotSent, "The verification email could not be sent."},
+	{user.ErrInvalidVerificationCode, "The verification code is not valid."},
+	{user.ErrVerificationCodeExpired, "The verification code has expired."},
+	{user.ErrInvalidDisplayName, "That display name is too long."},
+	{user.ErrUsernameTaken, "That username is already taken."},
+	{invite.ErrEmailHasAccount, "That email already has an account."},
+	{invite.ErrPendingInvite, "An invitation is already pending for that email."},
+	{invite.ErrInviteEmailNotSent, "The invitation email could not be sent."},
+	{invite.ErrInviteAlreadyAccepted, "That invitation was already accepted."},
+	{invite.ErrInviteInvalid, "That invitation is not valid."},
+	{invite.ErrInviteExpired, "That invitation has expired."},
+	{update.ErrFeedUnavailable, "The release feed could not be reached."},
+	{update.ErrNoRelease, "No release was found."},
+	{update.ErrNotPrepared, "This server cannot apply updates."},
+	{update.ErrJobInProgress, "An update is already being downloaded."},
+	{update.ErrRestartPending, "A restart is already pending."},
+	{update.ErrNothingToUpdate, "There is nothing to update."},
+	{update.ErrPreflightRefused, "The update cannot be downloaded."},
+	{update.ErrRestartKindMismatch, "The requested restart does not match the server state."},
+}
+
+var restartFailureReasons = []failureReason{
+	{update.ErrJobInProgress, "An update is still being downloaded."},
+}
+
+var downloadFailureReasons = map[string]string{
+	update.ErrorKindDownload:     "The update could not be downloaded.",
+	update.ErrorKindVerification: "The downloaded update failed its integrity check.",
+}
+
+var notFoundCauses = []error{
+	article.ErrArticleNotFound,
+	image.ErrImageNotFound,
+	invite.ErrInviteNotFound,
+	user.ErrUserNotFound,
+}
+
+func reasonFor(err error, overrides ...failureReason) string {
+	for _, candidate := range slices.Concat(overrides, failureReasons) {
+		if errors.Is(err, candidate.cause) {
+			return candidate.reason
+		}
+	}
+	return GenericFailureReason
+}
+
+func isNotFound(err error) bool {
+	for _, cause := range notFoundCauses {
+		if errors.Is(err, cause) {
+			return true
+		}
+	}
+	return false
+}
+
+func recordFailure(ctx context.Context, recorder audit.Recorder, event audit.Event, err error, overrides ...failureReason) {
+	if isNotFound(err) {
+		return
+	}
+	failFrom(ctx, recorder, event, reasonFor(err, overrides...))
+}
+
+func failFrom(ctx context.Context, recorder audit.Recorder, event audit.Event, reason string) {
+	event.Outcome = audit.OutcomeFailed
+	event.FailureReason = &reason
+	recorder.Record(ctx, event)
+}

scripts/mutate.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+native() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		printf '%s' "$1"
+	fi
+}
+
+repo="$work/repo"
+mkdir -p "$repo" "$work/tmp" "$root/tmp"
+
+tar -C "$root" -c \
+	--exclude=./bin --exclude=./web --exclude=./node_modules --exclude=./.git \
+	--exclude=./.task --exclude=./tmp --exclude=./data --exclude=./.claude \
+	--exclude=./internal/infrastructure/assets/dist --exclude='*.exe' --exclude='*.db' . |
+	tar -C "$repo" -x
+
+export GOCACHE="$(native "$work/gocache")"
+export TEMP="$(native "$work/tmp")"
+export TMP="$TEMP"
+export TMPDIR="$TEMP"
+
+cd "$repo"
+code=0
+gremlins unleash --integration --tags nofrontend --workers 4 \
+	--coverpkg=./internal/infrastructure/useCases/...,./api/middleware/...,./api/pkg/claims/... \
+	--timeout-coefficient 10 --output "$(native "$root/tmp/gremlins.json")" \
+	./internal/infrastructure/useCases ./api/middleware ./api/pkg/claims || code=$?
+go clean -cache >/dev/null 2>&1 || true
+exit "$code"

test/accept_invitation_atomic_test.go

@@ -116,7 +116,7 @@ func newAtomicAcceptFixture(t *testing.T, wrap func(db *gorm.DB, repo invite.Rep
 	hasher := atomicPlainHasher{}
 	handler := auth.NewAcceptInviteHandler(
 		useCases.NewGetInviteUseCase(invites, hasher),
-		useCases.NewAcceptInviteUseCase(users, invites, hasher),
+		useCases.NewAcceptInviteUseCase(users, invites, hasher, discardRecorder),
 		jwtauth.New("HS256", []byte("test-secret"), nil),
 		true,
 	)

test/accept_invitation_test.go

@@ -56,20 +56,20 @@ func newAcceptInviteFixture(t *testing.T, maxAttempts int) *acceptInviteFixture
 	getUser := useCases.NewGetUserUseCase(f.users)
 	acceptHandler := auth.NewAcceptInviteHandler(
 		useCases.NewGetInviteUseCase(f.invites, f.hasher),
-		useCases.NewAcceptInviteUseCase(f.users, f.invites, f.hasher),
+		useCases.NewAcceptInviteUseCase(f.users, f.invites, f.hasher, discardRecorder),
 		f.token,
 		true,
 	)
 	meHandler := auth.NewMeHandler(getUser)
 	listHandler := userhandler.NewInviteHandler(
-		useCases.NewCreateInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL),
+		useCases.NewCreateInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL, discardRecorder),
 		nil,
 		nil,
 		useCases.NewListUsersAndInvitesUseCase(f.users, f.invites),
 	)
 	registerHandler := auth.NewLoginHandler(
 		f.token,
-		useCases.NewCreateUserUseCase(f.users, f.hasher, f.mail, invitePublicURL),
+		useCases.NewCreateUserUseCase(f.users, f.hasher, f.mail, invitePublicURL, discardRecorder),
 		useCases.NewAuthenticateUserUseCase(f.users, f.hasher, discardRecorder),
 		true,
 	)
@@ -500,13 +500,13 @@ func TestAcceptInviteUseCase(t *testing.T) {
 	newUseCase := func() (*useCases.AcceptInviteUseCase, *mockUserRepo, *inviteFakeRepo, *stubHasher) {
 		users, invites, hasher := inviteInviterRepo(""), newInviteFakeRepo(), &stubHasher{}
 		invites.users = users
-		return useCases.NewAcceptInviteUseCase(users, invites, hasher), users, invites, hasher
+		return useCases.NewAcceptInviteUseCase(users, invites, hasher, discardRecorder), users, invites, hasher
 	}
 	command := useCases.AcceptInviteCommand{Code: acceptCode, Username: "lea", Password: acceptPassword}
 
 	t.Run("unknown code is invalid", func(t *testing.T) {
 		uc, _, _, _ := newUseCase()
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, invite.ErrInviteInvalid) {
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, invite.ErrInviteInvalid) {
 			t.Errorf("expected ErrInviteInvalid, got %v", err)
 		}
 	})
@@ -514,7 +514,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 	t.Run("empty code is invalid without hashing", func(t *testing.T) {
 		uc, _, invites, hasher := newUseCase()
 		invites.seed(pendingInvite(acceptEmail))
-		if _, err := uc.AcceptInvite(useCases.AcceptInviteCommand{Username: "lea", Password: acceptPassword}); !errors.Is(err, invite.ErrInviteInvalid) || hasher.compareCalls != 0 {
+		if _, err := uc.AcceptInvite(testCtx, useCases.AcceptInviteCommand{Username: "lea", Password: acceptPassword}); !errors.Is(err, invite.ErrInviteInvalid) || hasher.compareCalls != 0 {
 			t.Errorf("expected ErrInviteInvalid, got %v", err)
 		}
 	})
@@ -524,7 +524,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored := expiredInvite(acceptEmail)
 		stored.HashedCode = "hashed:" + acceptCode
 		invites.seed(stored)
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, invite.ErrInviteExpired) {
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, invite.ErrInviteExpired) {
 			t.Errorf("expected ErrInviteExpired, got %v", err)
 		}
 	})
@@ -534,7 +534,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored := pendingInvite(acceptEmail)
 		stored.HashedCode = "hashed:" + acceptCode
 		invites.seed(stored)
-		_, err := uc.AcceptInvite(useCases.AcceptInviteCommand{Code: acceptCode, Username: "marta", Password: acceptPassword})
+		_, err := uc.AcceptInvite(testCtx, useCases.AcceptInviteCommand{Code: acceptCode, Username: "marta", Password: acceptPassword})
 		if !errors.Is(err, user.ErrUsernameTaken) || len(users.users) != 1 {
 			t.Errorf("expected ErrUsernameTaken, got %v", err)
 		}
@@ -546,7 +546,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored.HashedCode = "hashed:" + acceptCode
 		invites.seed(stored)
 		users.fail.failNext("GetByUsername")
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, errRepositoryFailure) {
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, errRepositoryFailure) {
 			t.Errorf("expected repository failure, got %v", err)
 		}
 	})
@@ -557,7 +557,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored.HashedCode = "hashed:" + acceptCode
 		invites.seed(stored)
 		users.users[8] = user.User{ID: 8, Username: "leam", Email: "LEA.martin@renew.example"}
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, invite.ErrEmailHasAccount) {
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, invite.ErrEmailHasAccount) {
 			t.Errorf("expected ErrEmailHasAccount, got %v", err)
 		}
 	})
@@ -574,8 +574,8 @@ func TestAcceptInviteUseCase(t *testing.T) {
 			invites.invites[seeded.ID] = seeded
 			users.users[8] = user.User{ID: 8, Username: "lea2", Email: acceptEmail}
 		}}
-		uc := useCases.NewAcceptInviteUseCase(users, racing, hasher)
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, invite.ErrInviteInvalid) {
+		uc := useCases.NewAcceptInviteUseCase(users, racing, hasher, discardRecorder)
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, invite.ErrInviteInvalid) {
 			t.Errorf("expected ErrInviteInvalid, got %v", err)
 		}
 	})
@@ -586,7 +586,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored.HashedCode = "hashed:" + acceptCode
 		invites.seed(stored)
 		hasher.hashErr = errors.New("hash boom")
-		if _, err := uc.AcceptInvite(command); err == nil || len(users.users) != 1 {
+		if _, err := uc.AcceptInvite(testCtx, command); err == nil || len(users.users) != 1 {
 			t.Errorf("expected failure without a user, got %v", err)
 		}
 	})
@@ -597,7 +597,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored.HashedCode = "hashed:" + acceptCode
 		seeded := invites.seed(stored)
 		users.fail.failNext("Create")
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, errRepositoryFailure) || invites.invites[seeded.ID].AcceptedAt != nil {
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, errRepositoryFailure) || invites.invites[seeded.ID].AcceptedAt != nil {
 			t.Errorf("expected repository failure and a pending invite, got %v", err)
 		}
 	})
@@ -609,7 +609,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		seeded := invites.seed(stored)
 		invites.fail.failNextWith("MarkAccepted", errors.New("mark down"))
 		users.fail.failNextWith("Delete", errors.New("delete down"))
-		_, err := uc.AcceptInvite(command)
+		_, err := uc.AcceptInvite(testCtx, command)
 		if err == nil || !strings.Contains(err.Error(), "mark down") || strings.Contains(err.Error(), "delete down") {
 			t.Errorf("unexpected error %v", err)
 		}
@@ -624,7 +624,7 @@ func TestAcceptInviteUseCase(t *testing.T) {
 		stored.HashedCode = "hashed:" + acceptCode
 		invites.seed(stored)
 		invites.fail.failNextWith("MarkAccepted", invite.ErrInviteNotFound)
-		if _, err := uc.AcceptInvite(command); !errors.Is(err, invite.ErrInviteInvalid) || len(users.users) != 1 {
+		if _, err := uc.AcceptInvite(testCtx, command); !errors.Is(err, invite.ErrInviteInvalid) || len(users.users) != 1 {
 			t.Errorf("expected ErrInviteInvalid, got %v", err)
 		}
 	})

test/account_verification_http_test.go

@@ -20,7 +20,7 @@ import (
 func newAccountVerificationRouter(userRepo *mockUserRepo, token *jwtauth.JWTAuth) *chi.Mux {
 	hasher := &stubHasher{}
 	verificationHandler := auth.NewVerificationHandler(
-		useCases.NewVerifyUserUseCase(userRepo, hasher),
+		useCases.NewVerifyUserUseCase(userRepo, hasher, discardRecorder),
 		useCases.NewCancelRegistrationUseCase(userRepo),
 		true,
 	)

test/account_verification_test.go

@@ -16,9 +16,9 @@ func TestAccountVerificationUseCase(t *testing.T) {
 			VerificationCode:       "hashed:right-code",
 			VerificationExpiration: time.Now().Add(time.Hour),
 		}
-		uc := useCases.NewVerifyUserUseCase(repo, &stubHasher{})
+		uc := useCases.NewVerifyUserUseCase(repo, &stubHasher{}, discardRecorder)
 
-		_, err := uc.Verify(3, "wrong-code")
+		_, err := uc.Verify(testCtx, 3, "wrong-code")
 
 		if !errors.Is(err, user.ErrInvalidVerificationCode) {
 			t.Fatalf("expected ErrInvalidVerificationCode, got %v", err)
@@ -35,9 +35,9 @@ func TestAccountVerificationUseCase(t *testing.T) {
 			VerificationCode:       "hashed:right-code",
 			VerificationExpiration: time.Now().Add(-time.Hour),
 		}
-		uc := useCases.NewVerifyUserUseCase(repo, &stubHasher{})
+		uc := useCases.NewVerifyUserUseCase(repo, &stubHasher{}, discardRecorder)
 
-		_, err := uc.Verify(3, "right-code")
+		_, err := uc.Verify(testCtx, 3, "right-code")
 
 		if !errors.Is(err, user.ErrVerificationCodeExpired) {
 			t.Fatalf("expected ErrVerificationCodeExpired, got %v", err)
@@ -54,9 +54,9 @@ func TestAccountVerificationUseCase(t *testing.T) {
 			VerificationCode:       "hashed:right-code",
 			VerificationExpiration: time.Now().Add(time.Hour),
 		}
-		uc := useCases.NewVerifyUserUseCase(repo, &stubHasher{})
+		uc := useCases.NewVerifyUserUseCase(repo, &stubHasher{}, discardRecorder)
 
-		result, err := uc.Verify(3, "right-code")
+		result, err := uc.Verify(testCtx, 3, "right-code")
 
 		if err != nil {
 			t.Fatalf("expected no error, got %v", err)

test/activity_log_producers_http_test.go

@@ -0,0 +1,943 @@
+package test
+
+import (
+	"RenewCMS/api"
+	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
+	"RenewCMS/internal/domain/image"
+	"RenewCMS/internal/domain/invite"
+	"RenewCMS/internal/domain/update"
+	"RenewCMS/internal/infrastructure/useCases"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+)
+
+var producersTimestamps = regexp.MustCompile(`"(created_at|expires_at)":"[^"]*",?`)
+
+const (
+	producersUserAgent  = "producers-test/1.0"
+	producersClientIP   = "192.0.2.1"
+	producersOwnerName  = "Marta Alves"
+	producersSpringName = "Spring release"
+	producersBannerPath = "/static/uploadedImages/"
+)
+
+type producersEnv struct {
+	*apiKeyEnv
+	audit *activityHarness
+}
+
+func newProducersEnv(t *testing.T) *producersEnv {
+	t.Helper()
+	h := newActivityHarness(t)
+	env := newAPIKeyEnvRecording(t, h.recorder)
+	owner := env.users.users[apiKeyOwnerId]
+	owner.DisplayName = producersOwnerName
+	env.users.users[apiKeyOwnerId] = owner
+	env.container.ListActivityUseCase = useCases.NewListActivityUseCase(h.store, env.users, env.articles, env.images, env.keys, h.clock)
+	router := chi.NewRouter()
+	router.Mount("/v1", api.InitBackendRoutes(env.container, env.settings))
+	env.router = router
+	return &producersEnv{apiKeyEnv: env, audit: h}
+}
+
+func (p *producersEnv) request(t *testing.T, req *http.Request, userId uint32) *httptest.ResponseRecorder {
+	t.Helper()
+	req.Header.Set("User-Agent", producersUserAgent)
+	if userId != 0 {
+		req.AddCookie(p.cookie(t, userId, 0))
+	}
+	rec := httptest.NewRecorder()
+	p.router.ServeHTTP(rec, req)
+	return rec
+}
+
+func (p *producersEnv) as(t *testing.T, userId uint32, method string, path string, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(method, path, strings.NewReader(body))
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	return p.request(t, req, userId)
+}
+
+func (p *producersEnv) asKey(t *testing.T, raw string, method string, path string, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(method, path, strings.NewReader(body))
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Authorization", "Bearer "+raw)
+	return p.request(t, req, 0)
+}
+
+func (p *producersEnv) upload(t *testing.T, userId uint32, filename string, contentType string, content []byte) *httptest.ResponseRecorder {
+	t.Helper()
+	return p.request(t, newMultipartFileRequest(t, http.MethodPost, "/v1/media", filename, contentType, content), userId)
+}
+
+func (p *producersEnv) events(t *testing.T) []audit.Event {
+	t.Helper()
+	return p.audit.all(t)
+}
+
+func (p *producersEnv) single(t *testing.T) audit.Event {
+	t.Helper()
+	events := p.events(t)
+	if len(events) != 1 {
+		t.Fatalf("expected exactly one event, got %d: %+v", len(events), events)
+	}
+	return events[0]
+}
+
+func (p *producersEnv) noEvent(t *testing.T) {
+	t.Helper()
+	if events := p.events(t); len(events) != 0 {
+		t.Fatalf("expected no event, got %d: %+v", len(events), events)
+	}
+}
+
+func (p *producersEnv) seedSpring(id uint32, body string, online bool) {
+	p.articles.articles[id] = article.Article{ID: id, Title: producersSpringName, Body: body, IsOnline: online}
+}
+
+func (p *producersEnv) seedBanner(id uint32, filename string, hash string) {
+	p.images.images[id] = image.Image{ID: id, Filename: filename, ContentType: "image/png", Path: producersBannerPath + strconv.Itoa(int(id)) + ".png", SHA256: hash, UploadedByID: apiKeyOwnerId}
+}
+
+func (p *producersEnv) seedPendingInvite(email string) invite.Invite {
+	return p.invites.seed(invite.Invite{Email: email, HashedCode: "hashed:code", ExpiresAt: time.Now().Add(24 * time.Hour), InvitedBy: apiKeyOwnerId, CreatedAt: time.Now()})
+}
+
+func paramsJSON(t *testing.T, event audit.Event) string {
+	t.Helper()
+	encoded, err := json.Marshal(event.Params)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(encoded)
+}
+
+func changesJSON(t *testing.T, event audit.Event) string {
+	t.Helper()
+	encoded, err := json.Marshal(event.Changes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(encoded)
+}
+
+func assertProducerEvent(t *testing.T, event audit.Event, action string, category audit.Category, outcome audit.Outcome) {
+	t.Helper()
+	if event.Action != action || event.Category != category || event.Outcome != outcome {
+		t.Fatalf("event = %s/%s/%s, expected %s/%s/%s", event.Action, event.Category, event.Outcome, action, category, outcome)
+	}
+}
+
+func assertProducerTarget(t *testing.T, event audit.Event, targetType string, id string, name string) {
+	t.Helper()
+	if event.Target != (audit.Target{Type: targetType, ID: id, Name: name}) {
+		t.Errorf("target = %+v, expected {%s %s %s}", event.Target, targetType, id, name)
+	}
+}
+
+func assertProducerFailure(t *testing.T, event audit.Event, reason string) {
+	t.Helper()
+	if event.Outcome != audit.OutcomeFailed || event.FailureReason == nil || *event.FailureReason != reason {
+		t.Errorf("outcome = %s, failure_reason = %v, expected failed with %q", event.Outcome, event.FailureReason, reason)
+	}
+}
+
+func assertProducerOwnerOrigin(t *testing.T, event audit.Event) {
+	t.Helper()
+	if event.Actor.Type != audit.ActorUser || event.Actor.ID == nil || *event.Actor.ID != apiKeyOwnerId || event.Actor.Name != producersOwnerName {
+		t.Errorf("actor = %+v", event.Actor)
+	}
+	if event.Source != audit.SourceWeb {
+		t.Errorf("source = %s", event.Source)
+	}
+	if event.IP == nil || *event.IP != producersClientIP || event.UserAgent == nil || *event.UserAgent != producersUserAgent {
+		t.Errorf("ip = %v, user agent = %v", event.IP, event.UserAgent)
+	}
+}
+
+func TestActivityLogProducersRouteContext(t *testing.T) {
+	t.Run("A producing route carries the origin of the request", func(t *testing.T) {
+		t.Run("POST /v1/article with the owner's jwt cookie", func(t *testing.T) {
+			p := newProducersEnv(t)
+			rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/article", `{"title":"Spring release","body":"Hello"}`)
+			assertAPIKeyStatus(t, rec, http.StatusCreated)
+			assertProducerOwnerOrigin(t, p.single(t))
+		})
+
+		t.Run("POST /v1/article with an API key Deploy bot", func(t *testing.T) {
+			p := newProducersEnv(t)
+			raw, keyId := p.issueKey(apiKeyDevId, "Deploy bot")
+			rec := p.asKey(t, raw, http.MethodPost, "/v1/article", `{"title":"Spring release","body":"Hello"}`)
+			assertAPIKeyStatus(t, rec, http.StatusCreated)
+			event := p.single(t)
+			if event.Actor.Type != audit.ActorAPIKey || event.Actor.ID == nil || *event.Actor.ID != keyId || event.Actor.Name != "Deploy bot" || event.Source != audit.SourceAPIKey {
+				t.Errorf("actor = %+v, source = %s", event.Actor, event.Source)
+			}
+			if event.IP == nil || *event.IP != producersClientIP || event.UserAgent == nil || *event.UserAgent != producersUserAgent {
+				t.Errorf("ip = %v, user agent = %v", event.IP, event.UserAgent)
+			}
+		})
+
+		t.Run("POST /v1/media with an API key Deploy bot", func(t *testing.T) {
+			p := newProducersEnv(t)
+			raw, keyId := p.issueKey(apiKeyDevId, "Deploy bot")
+			req := newMultipartFileRequest(t, http.MethodPost, "/v1/media", "spring-banner.png", "image/png", pngBytes(t, 3, 2))
+			req.Header.Set("Authorization", "Bearer "+raw)
+			rec := p.request(t, req, 0)
+			assertAPIKeyStatus(t, rec, http.StatusCreated)
+			event := p.single(t)
+			if event.Actor.Type != audit.ActorAPIKey || event.Actor.ID == nil || *event.Actor.ID != keyId || event.Actor.Name != "Deploy bot" || event.Source != audit.SourceAPIKey {
+				t.Errorf("actor = %+v, source = %s", event.Actor, event.Source)
+			}
+		})
+
+		t.Run("POST /v1/system/update/check with the owner's jwt cookie", func(t *testing.T) {
+			p := newProducersEnv(t)
+			rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/system/update/check", "")
+			assertAPIKeyStatus(t, rec, http.StatusOK)
+			assertProducerOwnerOrigin(t, p.single(t))
+		})
+	})
+}
+
+func TestActivityLogProducersFailedAuditWrite(t *testing.T) {
+	type row struct {
+		name    string
+		panics  bool
+		setup   func(p *producersEnv)
+		send    func(t *testing.T, p *producersEnv) *httptest.ResponseRecorder
+		applied func(t *testing.T, p *producersEnv)
+	}
+	owner := func(method string, path string, body string) func(t *testing.T, p *producersEnv) *httptest.ResponseRecorder {
+		return func(t *testing.T, p *producersEnv) *httptest.ResponseRecorder {
+			return p.as(t, apiKeyOwnerId, method, path, body)
+		}
+	}
+	seedArticle := func(p *producersEnv) { p.seedSpring(8, "Hello", false) }
+	seedCopies := func(p *producersEnv) {
+		p.seedBanner(5, "banner.png", "same")
+		p.seedBanner(6, "banner-copy.png", "same")
+		p.articles.articles[1] = article.Article{ID: 1, Title: "Uses copy", Body: "see 6.png"}
+	}
+	rows := []row{
+		{name: "fails POST /v1/article", setup: func(*producersEnv) {}, send: owner(http.MethodPost, "/v1/article", `{"title":"Spring release","body":"Hello"}`), applied: func(t *testing.T, p *producersEnv) {
+			if len(p.articles.articles) != 1 {
+				t.Errorf("the article was not created")
+			}
+		}},
+		{name: "fails DELETE /v1/article/8", setup: seedArticle, send: owner(http.MethodDelete, "/v1/article/8", ""), applied: func(t *testing.T, p *producersEnv) {
+			if _, found := p.articles.articles[8]; found {
+				t.Errorf("the article was not deleted")
+			}
+		}},
+		{name: "panics PATCH /v1/article/8/publish", panics: true, setup: seedArticle, send: owner(http.MethodPatch, "/v1/article/8/publish", ""), applied: func(t *testing.T, p *producersEnv) {
+			if !p.articles.articles[8].IsOnline {
+				t.Errorf("the article was not published")
+			}
+		}},
+		{name: "fails POST /v1/media", setup: func(*producersEnv) {}, send: func(t *testing.T, p *producersEnv) *httptest.ResponseRecorder {
+			return p.upload(t, apiKeyOwnerId, "spring-banner.png", "image/png", pngBytes(t, 3, 2))
+		}, applied: func(t *testing.T, p *producersEnv) {
+			if len(p.images.images) != 1 {
+				t.Errorf("the image was not stored")
+			}
+		}},
+		{name: "fails POST /v1/media/merge", setup: seedCopies, send: owner(http.MethodPost, "/v1/media/merge", `{"keep_id":5,"merge_ids":[6]}`), applied: func(t *testing.T, p *producersEnv) {
+			if _, found := p.images.images[6]; found {
+				t.Errorf("the copy was not merged")
+			}
+		}},
+		{name: "fails POST /v1/user/invite", setup: func(*producersEnv) {}, send: owner(http.MethodPost, "/v1/user/invite", `{"email":"new@example.com"}`), applied: func(t *testing.T, p *producersEnv) {
+			if len(p.invites.invites) != 1 {
+				t.Errorf("the invite was not created")
+			}
+		}},
+		{name: "fails POST /v1/system/update/restart", setup: func(*producersEnv) {}, send: owner(http.MethodPost, "/v1/system/update/restart", ""), applied: func(*testing.T, *producersEnv) {}},
+	}
+
+	t.Run("A failing or panicking repository leaves the response untouched", func(t *testing.T) {
+		for _, example := range rows {
+			t.Run(example.name, func(t *testing.T) {
+				healthy := newProducersEnv(t)
+				example.setup(healthy)
+				expected := example.send(t, healthy)
+
+				p := newProducersEnv(t)
+				example.setup(p)
+				if example.panics {
+					p.audit.probe.appendPanic = true
+				} else {
+					p.audit.probe.appendErr = errDiskFull
+				}
+				rec := example.send(t, p)
+
+				if rec.Code != expected.Code || producersTimestamps.ReplaceAllString(rec.Body.String(), "") != producersTimestamps.ReplaceAllString(expected.Body.String(), "") {
+					t.Errorf("response = %d %q, healthy response = %d %q", rec.Code, rec.Body.String(), expected.Code, expected.Body.String())
+				}
+				if rec.Code >= http.StatusBadRequest {
+					t.Fatalf("the request was expected to succeed, got %d: %s", rec.Code, rec.Body.String())
+				}
+				example.applied(t, p)
+				if !strings.Contains(p.audit.logs.String(), "audit:") {
+					t.Errorf("the process log does not name the failed audit write: %q", p.audit.logs.String())
+				}
+			})
+		}
+	})
+}
+
+func TestActivityLogProducersArticles(t *testing.T) {
+	t.Run("Creating an article is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/article", `{"title":"Spring release","body":"Hello"}`)
+		assertAPIKeyStatus(t, rec, http.StatusCreated)
+		event := p.single(t)
+		assertProducerEvent(t, event, "article.create", audit.CategoryArticles, audit.OutcomeSuccess)
+		assertProducerOwnerOrigin(t, event)
+		assertProducerTarget(t, event, "article", "1", producersSpringName)
+		if event.FailureReason != nil || len(event.Changes) != 0 {
+			t.Errorf("failure reason = %v, changes = %+v", event.FailureReason, event.Changes)
+		}
+		if encoded, _ := json.Marshal(event); strings.Contains(string(encoded), "Hello") {
+			t.Errorf("the stored event holds the article body: %s", encoded)
+		}
+	})
+
+	t.Run("Editing the body records a size delta and never the text", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedSpring(8, strings.Repeat("a", 100), false)
+		newBody := strings.Repeat("secretbody", 41) + "xx"
+		rec := p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/8", `{"body":"`+newBody+`"}`)
+		assertAPIKeyStatus(t, rec, http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "article.edit", audit.CategoryArticles, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "article", "8", producersSpringName)
+		if got := changesJSON(t, event); got != `[{"field":"body","kind":"body","delta":312}]` {
+			t.Errorf("changes = %s", got)
+		}
+		listing := p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/activity", "")
+		assertAPIKeyStatus(t, listing, http.StatusOK)
+		if strings.Contains(listing.Body.String(), "secretbody") || strings.Contains(listing.Body.String(), "aaaa") {
+			t.Errorf("the activity response holds article text: %s", listing.Body.String())
+		}
+	})
+
+	t.Run("Saving an identical body records nothing", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedSpring(8, "Same text", false)
+		rec := p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/8", `{"body":"Same text"}`)
+		assertAPIKeyStatus(t, rec, http.StatusOK)
+		p.noEvent(t)
+	})
+
+	t.Run("Publishing is recorded with the publish state", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedSpring(8, "Hello", false)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/8/publish", ""), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "article.publish", audit.CategoryArticles, audit.OutcomeSuccess)
+		if got := changesJSON(t, event); got != `[{"field":"online","kind":"text","before":"false","after":"true"}]` {
+			t.Errorf("changes = %s", got)
+		}
+	})
+
+	t.Run("Unpublishing is recorded with the publish state", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedSpring(8, "Hello", true)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/8/unpublish", ""), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "article.unpublish", audit.CategoryArticles, audit.OutcomeSuccess)
+		if got := changesJSON(t, event); got != `[{"field":"online","kind":"text","before":"true","after":"false"}]` {
+			t.Errorf("changes = %s", got)
+		}
+	})
+
+	t.Run("A publish state that does not change records nothing", func(t *testing.T) {
+		for _, example := range []struct {
+			state  bool
+			path   string
+			status int
+		}{{true, "publish", http.StatusOK}, {false, "unpublish", http.StatusOK}} {
+			t.Run(strconv.FormatBool(example.state)+" "+example.path, func(t *testing.T) {
+				p := newProducersEnv(t)
+				p.seedSpring(8, "Hello", example.state)
+				assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/8/"+example.path, ""), example.status)
+				p.noEvent(t)
+			})
+		}
+	})
+
+	t.Run("Deleting an article is recorded with its name snapshot", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedSpring(8, "Hello", false)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodDelete, "/v1/article/8", ""), http.StatusNoContent)
+		event := p.single(t)
+		assertProducerEvent(t, event, "article.delete", audit.CategoryArticles, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "article", "8", producersSpringName)
+
+		listing := p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/activity", "")
+		var page struct {
+			Items []struct {
+				Target struct {
+					Exists bool `json:"exists"`
+				} `json:"target"`
+			} `json:"items"`
+		}
+		if err := json.Unmarshal(listing.Body.Bytes(), &page); err != nil || len(page.Items) != 1 || page.Items[0].Target.Exists {
+			t.Errorf("listing = %s, err = %v", listing.Body.String(), err)
+		}
+	})
+
+	t.Run("A refused article action is recorded as failed with a plain reason", func(t *testing.T) {
+		t.Run("the repository fails with db is locked on create", func(t *testing.T) {
+			p := newProducersEnv(t)
+			p.articles.fail.failNextWith("Create", errors.New("db is locked"))
+			rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/article", `{"title":"Spring release","body":"Hello"}`)
+			assertAPIKeyStatus(t, rec, http.StatusInternalServerError)
+			event := p.single(t)
+			assertProducerEvent(t, event, "article.create", audit.CategoryArticles, audit.OutcomeFailed)
+			assertProducerFailure(t, event, useCases.GenericFailureReason)
+			if strings.Contains(paramsJSON(t, event), "locked") || strings.Contains(*event.FailureReason, "locked") {
+				t.Errorf("the raw error leaked: %+v", event)
+			}
+		})
+
+		t.Run("the repository fails with db is locked on publish", func(t *testing.T) {
+			p := newProducersEnv(t)
+			p.seedSpring(8, "Hello", false)
+			p.articles.fail.failNextWith("UpdateIsOnline", errors.New("db is locked"))
+			assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/8/publish", ""), http.StatusInternalServerError)
+			event := p.single(t)
+			assertProducerEvent(t, event, "article.publish", audit.CategoryArticles, audit.OutcomeFailed)
+			assertProducerFailure(t, event, useCases.GenericFailureReason)
+			assertProducerTarget(t, event, "article", "8", producersSpringName)
+		})
+	})
+
+	t.Run("An article that does not exist records nothing", func(t *testing.T) {
+		p := newProducersEnv(t)
+		for _, call := range []struct{ method, path, body string }{
+			{http.MethodDelete, "/v1/article/99", ""},
+			{http.MethodPatch, "/v1/article/99", `{"body":"x"}`},
+			{http.MethodPatch, "/v1/article/99/publish", ""},
+			{http.MethodPatch, "/v1/article/99/unpublish", ""},
+		} {
+			assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, call.method, call.path, call.body), http.StatusNotFound)
+		}
+		p.noEvent(t)
+	})
+
+	t.Run("A request that fails validation records nothing", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/article", `{}`), http.StatusBadRequest)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/abc", `{"body":"x"}`), http.StatusBadRequest)
+		p.noEvent(t)
+	})
+
+	t.Run("Reads are never recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedSpring(8, "Hello", true)
+		for _, path := range []string{"/v1/article", "/v1/article/8"} {
+			assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodGet, path, ""), http.StatusOK)
+		}
+		assertAPIKeyStatus(t, p.as(t, 0, http.MethodGet, "/v1/article/8", ""), http.StatusOK)
+		p.noEvent(t)
+	})
+}
+
+func TestActivityLogProducersMedia(t *testing.T) {
+	t.Run("Uploading an image is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.upload(t, apiKeyOwnerId, "spring-banner.png", "image/png", pngBytes(t, 3, 2)), http.StatusCreated)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.upload", audit.CategoryMedia, audit.OutcomeSuccess)
+		assertProducerOwnerOrigin(t, event)
+		assertProducerTarget(t, event, "image", "1", "spring-banner.png")
+		if encoded, _ := json.Marshal(event); strings.Contains(string(encoded), "/static/") {
+			t.Errorf("the stored event holds a storage path: %s", encoded)
+		}
+	})
+
+	t.Run("A refused upload is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name        string
+			contentType string
+			content     func(t *testing.T) []byte
+			reason      string
+		}{
+			{"a GIF", "image/gif", func(t *testing.T) []byte { return []byte("GIF89a") }, "The file must be a PNG, JPEG, WEBP or SVG image."},
+			{"a PNG larger than the limit", "image/png", func(t *testing.T) []byte { return paddedPngBytes(t, int(image.MaxImageSize)+10) }, "The file is too large to upload."},
+			{"a corrupt PNG", "image/png", func(t *testing.T) []byte { return []byte("not a png") }, "The image could not be read."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				p := newProducersEnv(t)
+				rec := p.upload(t, apiKeyOwnerId, "spring-banner.png", example.contentType, example.content(t))
+				if rec.Code < http.StatusBadRequest {
+					t.Fatalf("expected a refusal, got %d", rec.Code)
+				}
+				event := p.single(t)
+				assertProducerEvent(t, event, "media.upload", audit.CategoryMedia, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+				if event.Target.Name != "spring-banner.png" {
+					t.Errorf("target = %+v", event.Target)
+				}
+			})
+		}
+	})
+
+	t.Run("Renaming an image records the filename diff", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "h")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/media/5", `{"filename":"spring-banner"}`), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.rename", audit.CategoryMedia, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "image", "5", "spring-banner.png")
+		if got := changesJSON(t, event); got != `[{"field":"filename","kind":"text","before":"banner.png","after":"spring-banner.png"}]` {
+			t.Errorf("changes = %s", got)
+		}
+	})
+
+	t.Run("Renaming to the same name records nothing", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "h")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/media/5", `{"filename":"banner"}`), http.StatusOK)
+		p.noEvent(t)
+	})
+
+	t.Run("A refused rename is recorded as failed", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "h")
+		rec := p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/media/5", `{"filename":"not/valid"}`)
+		assertAPIKeyStatus(t, rec, http.StatusBadRequest)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.rename", audit.CategoryMedia, audit.OutcomeFailed)
+		assertProducerFailure(t, event, "That file name is not valid.")
+		assertProducerTarget(t, event, "image", "5", "banner.png")
+	})
+
+	t.Run("Deleting an image is recorded with its name snapshot", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "h")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodDelete, "/v1/media/5", ""), http.StatusNoContent)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.delete", audit.CategoryMedia, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "image", "5", "banner.png")
+	})
+
+	t.Run("Merging images is recorded once with its counts", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "same")
+		p.seedBanner(6, "banner-copy.png", "same")
+		p.seedBanner(7, "banner-copy-2.png", "same")
+		p.articles.articles[1] = article.Article{ID: 1, Title: "One", Body: "see 6.png"}
+		p.articles.articles[2] = article.Article{ID: 2, Title: "Two", Body: "see 7.png"}
+		rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/media/merge", `{"keep_id":5,"merge_ids":[6,7]}`)
+		assertAPIKeyStatus(t, rec, http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.merge", audit.CategoryMedia, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "image", "5", "banner.png")
+		if got := paramsJSON(t, event); got != `{"articles_updated":2,"merged":2}` {
+			t.Errorf("params = %s", got)
+		}
+	})
+
+	t.Run("A refused merge is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name   string
+			setup  func(p *producersEnv)
+			body   string
+			reason string
+		}{
+			{"ErrInvalidMergeRequest", func(p *producersEnv) { p.seedBanner(5, "banner.png", "same") }, `{"keep_id":5,"merge_ids":[5]}`, "The merge request is not valid."},
+			{"ErrMergeCopyMissing", func(p *producersEnv) { p.seedBanner(5, "banner.png", "same") }, `{"keep_id":5,"merge_ids":[6]}`, "One of the copies no longer exists."},
+			{"ErrMergeHashMismatch", func(p *producersEnv) {
+				p.seedBanner(5, "banner.png", "same")
+				p.seedBanner(6, "other.png", "different")
+			}, `{"keep_id":5,"merge_ids":[6]}`, "The images are not identical copies."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				p := newProducersEnv(t)
+				example.setup(p)
+				rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/media/merge", example.body)
+				if rec.Code < http.StatusBadRequest {
+					t.Fatalf("expected a refusal, got %d", rec.Code)
+				}
+				event := p.single(t)
+				assertProducerEvent(t, event, "media.merge", audit.CategoryMedia, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+			})
+		}
+	})
+
+	t.Run("A manual purge is recorded once and not as separate merges", func(t *testing.T) {
+		p := newProducersEnv(t)
+		seedTwoGroupPurgePlan(p)
+		rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/media/purge", "")
+		assertAPIKeyStatus(t, rec, http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.purge", audit.CategoryMedia, audit.OutcomeSuccess)
+		assertProducerOwnerOrigin(t, event)
+		if got := paramsJSON(t, event); got != `{"articles_updated":5,"merged":3}` {
+			t.Errorf("params = %s", got)
+		}
+	})
+
+	t.Run("A partly failed manual purge is a success with the failed group count", func(t *testing.T) {
+		p := newProducersEnv(t)
+		seedThreeGroupPurgePlan(p, 5)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/media/purge", ""), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.purge", audit.CategoryMedia, audit.OutcomeSuccess)
+		if !strings.Contains(paramsJSON(t, event), `"failed_groups":1`) {
+			t.Errorf("params = %s", paramsJSON(t, event))
+		}
+	})
+
+	t.Run("A refused manual purge is recorded as failed", func(t *testing.T) {
+		p := newProducersEnv(t)
+		seedTwoGroupPurgePlan(p)
+		rec := p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/media/purge", `{"fingerprint":"stale"}`)
+		assertAPIKeyStatus(t, rec, http.StatusConflict)
+		event := p.single(t)
+		assertProducerEvent(t, event, "media.purge", audit.CategoryMedia, audit.OutcomeFailed)
+		assertProducerFailure(t, event, "The library changed since the preview. Review it again.")
+	})
+
+	t.Run("Browsing and the media usage lookup are never recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "h")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/media", ""), http.StatusOK)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/media/5/usage", ""), http.StatusOK)
+		p.noEvent(t)
+	})
+}
+
+func (p *producersEnv) seedArticleUsing(id uint32, body string) {
+	p.articles.articles[id] = article.Article{ID: id, Title: "Article " + strconv.Itoa(int(id)), Body: body}
+}
+
+func seedTwoGroupPurgePlan(p *producersEnv) {
+	p.seedBanner(1, "kept-a.png", "hash-a")
+	p.seedBanner(2, "copy-a1.png", "hash-a")
+	p.seedBanner(3, "copy-a2.png", "hash-a")
+	p.seedBanner(4, "kept-b.png", "hash-b")
+	p.seedBanner(5, "copy-b1.png", "hash-b")
+	for id, body := range map[uint32]string{1: "uses 2.png", 2: "uses 3.png", 3: "uses 5.png", 4: "uses 2.png", 5: "uses 3.png", 6: "1.png 4.png", 7: "1.png 4.png", 8: "1.png 4.png"} {
+		p.seedArticleUsing(id, body)
+	}
+}
+
+func seedThreeGroupPurgePlan(p *producersEnv, failingCopy uint32) {
+	p.seedBanner(1, "kept-a.png", "hash-a")
+	p.seedBanner(2, "copy-a.png", "hash-a")
+	p.seedBanner(4, "kept-b.png", "hash-b")
+	p.seedBanner(5, "copy-b.png", "hash-b")
+	p.seedBanner(7, "kept-c.png", "hash-c")
+	p.seedBanner(8, "copy-c.png", "hash-c")
+	for id, body := range map[uint32]string{1: "uses 2.png", 2: "uses 5.png", 3: "uses 8.png", 4: "1.png 4.png 7.png", 5: "1.png 4.png 7.png"} {
+		p.seedArticleUsing(id, body)
+	}
+	p.images.failDeleteFor = map[uint32]error{failingCopy: errors.New("storage offline")}
+}
+
+func TestActivityLogProducersUsers(t *testing.T) {
+	t.Run("Changing the display name records a before and after", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/user/me", `{"display_name":"Marta Alves 2"}`), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "user.update_profile", audit.CategoryUsers, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "user", "1", "Marta Alves 2")
+		if got := changesJSON(t, event); got != `[{"field":"display_name","kind":"text","before":"Marta Alves","after":"Marta Alves 2"}]` {
+			t.Errorf("changes = %s", got)
+		}
+		if event.Actor.Name != producersOwnerName {
+			t.Errorf("the actor snapshot name = %q, expected the name held when the request began", event.Actor.Name)
+		}
+	})
+
+	t.Run("Setting a display name that does not change records nothing", func(t *testing.T) {
+		for _, sent := range []string{"Marta Alves", "  Marta Alves  "} {
+			p := newProducersEnv(t)
+			assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/user/me", `{"display_name":"`+sent+`"}`), http.StatusOK)
+			p.noEvent(t)
+		}
+	})
+
+	t.Run("A display name that is too long is recorded as failed", func(t *testing.T) {
+		p := newProducersEnv(t)
+		rec := p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/user/me", `{"display_name":"`+strings.Repeat("a", 61)+`"}`)
+		assertAPIKeyStatus(t, rec, http.StatusBadRequest)
+		event := p.single(t)
+		assertProducerEvent(t, event, "user.update_profile", audit.CategoryUsers, audit.OutcomeFailed)
+		assertProducerFailure(t, event, "That display name is too long.")
+		if len(event.Changes) != 0 {
+			t.Errorf("changes = %+v", event.Changes)
+		}
+	})
+
+	t.Run("Creating an invite is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/user/invite", `{"email":"new@example.com"}`), http.StatusCreated)
+		event := p.single(t)
+		assertProducerEvent(t, event, "invite.create", audit.CategoryUsers, audit.OutcomeSuccess)
+		assertProducerOwnerOrigin(t, event)
+		assertProducerTarget(t, event, "invite", "1", "new@example.com")
+		if encoded, _ := json.Marshal(event); strings.Contains(string(encoded), "hashed:") {
+			t.Errorf("the stored event holds a code hash: %s", encoded)
+		}
+	})
+
+	t.Run("A refused invite action is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name   string
+			setup  func(p *producersEnv)
+			method string
+			path   string
+			body   string
+			action string
+			reason string
+		}{
+			{"ErrEmailHasAccount", func(*producersEnv) {}, http.MethodPost, "/v1/user/invite", `{"email":"dev@example.com"}`, "invite.create", "That email already has an account."},
+			{"ErrPendingInvite", func(p *producersEnv) { p.seedPendingInvite("new@example.com") }, http.MethodPost, "/v1/user/invite", `{"email":"new@example.com"}`, "invite.create", "An invitation is already pending for that email."},
+			{"ErrInviteEmailNotSent on create", func(p *producersEnv) { p.mail.fail.failNext("Send") }, http.MethodPost, "/v1/user/invite", `{"email":"new@example.com"}`, "invite.create", "The invitation email could not be sent."},
+			{"ErrInviteEmailNotSent on renew", func(p *producersEnv) { p.seedPendingInvite("new@example.com"); p.mail.fail.failNext("Send") }, http.MethodPost, "/v1/user/invite/1/renew", "", "invite.renew", "The invitation email could not be sent."},
+			{"ErrInviteAlreadyAccepted on renew", func(p *producersEnv) { p.seedAcceptedInvite("new@example.com") }, http.MethodPost, "/v1/user/invite/1/renew", "", "invite.renew", "That invitation was already accepted."},
+			{"ErrInviteAlreadyAccepted on cancel", func(p *producersEnv) { p.seedAcceptedInvite("new@example.com") }, http.MethodDelete, "/v1/user/invite/1", "", "invite.cancel", "That invitation was already accepted."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				p := newProducersEnv(t)
+				example.setup(p)
+				rec := p.as(t, apiKeyOwnerId, example.method, example.path, example.body)
+				if rec.Code < http.StatusBadRequest {
+					t.Fatalf("expected a refusal, got %d", rec.Code)
+				}
+				event := p.single(t)
+				assertProducerEvent(t, event, example.action, audit.CategoryUsers, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+			})
+		}
+	})
+
+	t.Run("Cancelling an invite is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedPendingInvite("new@example.com")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodDelete, "/v1/user/invite/1", ""), http.StatusNoContent)
+		event := p.single(t)
+		assertProducerEvent(t, event, "invite.cancel", audit.CategoryUsers, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "invite", "1", "new@example.com")
+	})
+
+	t.Run("Renewing an invite is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedPendingInvite("new@example.com")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/user/invite/1/renew", ""), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "invite.renew", audit.CategoryUsers, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "invite", "1", "new@example.com")
+	})
+
+	t.Run("An invite or user that does not exist records nothing", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodDelete, "/v1/user/invite/99", ""), http.StatusNotFound)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/user/invite/99/renew", ""), http.StatusNotFound)
+		p.noEvent(t)
+	})
+
+	t.Run("Reads and checks are never recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		for _, path := range []string{"/v1/user", "/v1/auth/me", "/v1/auth/registration"} {
+			rec := p.as(t, apiKeyOwnerId, http.MethodGet, path, "")
+			assertAPIKeyStatus(t, rec, http.StatusOK)
+		}
+		p.noEvent(t)
+	})
+}
+
+func (p *producersEnv) seedAcceptedInvite(email string) {
+	accepted := time.Now().Add(-time.Hour)
+	p.invites.seed(invite.Invite{Email: email, HashedCode: "hashed:code", ExpiresAt: time.Now().Add(24 * time.Hour), InvitedBy: apiKeyOwnerId, AcceptedAt: &accepted, CreatedAt: time.Now().Add(-2 * time.Hour)})
+}
+
+func TestActivityLogProducersSystem(t *testing.T) {
+	t.Run("Checking for an update is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/system/update/check", ""), http.StatusOK)
+		event := p.single(t)
+		assertProducerEvent(t, event, "system.update_checked", audit.CategorySystem, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "release", "v2.3.0-beta", "v2.3.0-beta")
+		if got := paramsJSON(t, event); got != `{"update_available":true}` {
+			t.Errorf("params = %s", got)
+		}
+	})
+
+	t.Run("A failed update check is recorded with a plain reason", func(t *testing.T) {
+		for _, example := range []struct {
+			name   string
+			err    error
+			reason string
+		}{
+			{"ErrFeedUnavailable", update.ErrFeedUnavailable, "The release feed could not be reached."},
+			{"ErrNoRelease", update.ErrNoRelease, "No release was found."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				p := newProducersEnv(t)
+				p.feed.err = example.err
+				assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/system/update/check", ""), http.StatusInternalServerError)
+				event := p.single(t)
+				assertProducerEvent(t, event, "system.update_checked", audit.CategorySystem, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+				if event.Target != (audit.Target{}) {
+					t.Errorf("target = %+v", event.Target)
+				}
+			})
+		}
+	})
+
+	t.Run("The status poll is never recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/system/update", ""), http.StatusOK)
+		p.noEvent(t)
+	})
+
+	t.Run("A restart request is recorded", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/system/update/restart", ""), http.StatusAccepted)
+		event := p.single(t)
+		assertProducerEvent(t, event, "system.restart_requested", audit.CategorySystem, audit.OutcomeSuccess)
+		assertProducerOwnerOrigin(t, event)
+		if got := paramsJSON(t, event); got != `{"kind":"restart"}` {
+			t.Errorf("params = %s", got)
+		}
+		if event.Target != (audit.Target{}) {
+			t.Errorf("target = %+v", event.Target)
+		}
+	})
+}
+
+func (p *producersEnv) listedActions(t *testing.T, category string) []string {
+	t.Helper()
+	listing := p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/activity?category="+category, "")
+	assertAPIKeyStatus(t, listing, http.StatusOK)
+	var page struct {
+		Items []struct {
+			Action   string `json:"action"`
+			Category string `json:"category"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal(listing.Body.Bytes(), &page); err != nil {
+		t.Fatal(err)
+	}
+	actions := []string{}
+	for _, item := range page.Items {
+		if item.Category != category {
+			t.Errorf("item category = %q, expected %q", item.Category, category)
+		}
+		actions = append(actions, item.Action)
+	}
+	return actions
+}
+
+func TestActivityLogProducersReadBackOtherCategories(t *testing.T) {
+	t.Run("Media events are listed under their category", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "same")
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/media/5", `{"filename":"spring"}`), http.StatusOK)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodDelete, "/v1/media/5", ""), http.StatusNoContent)
+		if got := strings.Join(p.listedActions(t, "media"), ","); got != "media.delete,media.rename" {
+			t.Errorf("actions = %s", got)
+		}
+		if got := p.listedActions(t, "articles"); len(got) != 0 {
+			t.Errorf("articles actions = %v", got)
+		}
+	})
+
+	t.Run("User events are listed under their category", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/user/me", `{"display_name":"Marta Alves 2"}`), http.StatusOK)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/user/invite", `{"email":"new@example.com"}`), http.StatusCreated)
+		if got := strings.Join(p.listedActions(t, "users"), ","); got != "invite.create,user.update_profile" {
+			t.Errorf("actions = %s", got)
+		}
+	})
+
+	t.Run("System events are listed under their category", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/system/update/check", ""), http.StatusOK)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/system/update/restart", ""), http.StatusAccepted)
+		if got := strings.Join(p.listedActions(t, "system"), ","); got != "system.restart_requested,system.update_checked" {
+			t.Errorf("actions = %s", got)
+		}
+	})
+}
+
+func TestActivityLogProducersReadBack(t *testing.T) {
+	t.Run("Producer events are listed with their documented shape", func(t *testing.T) {
+		p := newProducersEnv(t)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/article", `{"title":"Spring release","body":"Hello"}`), http.StatusCreated)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/1", `{"body":"Hello world"}`), http.StatusOK)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/article/1/publish", ""), http.StatusOK)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodDelete, "/v1/article/1", ""), http.StatusNoContent)
+
+		listing := p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/activity?category=articles", "")
+		assertAPIKeyStatus(t, listing, http.StatusOK)
+		var page struct {
+			Items []struct {
+				Action   string `json:"action"`
+				Category string `json:"category"`
+				Target   struct {
+					Exists bool `json:"exists"`
+				} `json:"target"`
+			} `json:"items"`
+		}
+		if err := json.Unmarshal(listing.Body.Bytes(), &page); err != nil {
+			t.Fatal(err)
+		}
+		var actions []string
+		for _, item := range page.Items {
+			actions = append(actions, item.Action)
+			if item.Category != "articles" || item.Target.Exists {
+				t.Errorf("item = %+v", item)
+			}
+		}
+		if strings.Join(actions, ",") != "article.delete,article.publish,article.edit,article.create" {
+			t.Errorf("actions = %v", actions)
+		}
+	})
+
+	t.Run("A failed producer event is filterable", func(t *testing.T) {
+		p := newProducersEnv(t)
+		p.seedBanner(5, "banner.png", "same")
+		p.as(t, apiKeyOwnerId, http.MethodPost, "/v1/media/merge", `{"keep_id":5,"merge_ids":[6]}`)
+		assertAPIKeyStatus(t, p.as(t, apiKeyOwnerId, http.MethodPatch, "/v1/media/5", `{"filename":"spring"}`), http.StatusOK)
+
+		listing := p.as(t, apiKeyOwnerId, http.MethodGet, "/v1/activity?outcome=failed", "")
+		assertAPIKeyStatus(t, listing, http.StatusOK)
+		var page struct {
+			Items []struct {
+				Action        string  `json:"action"`
+				FailureReason *string `json:"failure_reason"`
+			} `json:"items"`
+		}
+		if err := json.Unmarshal(listing.Body.Bytes(), &page); err != nil {
+			t.Fatal(err)
+		}
+		if len(page.Items) != 1 || page.Items[0].Action != "media.merge" || page.Items[0].FailureReason == nil || *page.Items[0].FailureReason != "One of the copies no longer exists." {
+			t.Errorf("items = %+v", page.Items)
+		}
+	})
+}

test/activity_log_producers_test.go

@@ -0,0 +1,770 @@
+package test
+
+import (
+	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
+	"RenewCMS/internal/domain/image"
+	"RenewCMS/internal/domain/invite"
+	"RenewCMS/internal/domain/purge"
+	"RenewCMS/internal/domain/update"
+	"RenewCMS/internal/domain/user"
+	"RenewCMS/internal/infrastructure/useCases"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"strings"
+	"testing"
+	"time"
+	"unicode/utf8"
+)
+
+const producerSignalTimeout = 5 * time.Second
+
+type producerSignalRecorder struct {
+	inner    audit.Recorder
+	recorded chan struct{}
+}
+
+var _ audit.Recorder = &producerSignalRecorder{}
+
+func newProducerSignalRecorder(inner audit.Recorder) *producerSignalRecorder {
+	return &producerSignalRecorder{inner: inner, recorded: make(chan struct{}, 16)}
+}
+
+func (r *producerSignalRecorder) Record(ctx context.Context, event audit.Event) {
+	r.inner.Record(ctx, event)
+	r.recorded <- struct{}{}
+}
+
+func (r *producerSignalRecorder) await(t *testing.T) {
+	t.Helper()
+	select {
+	case <-r.recorded:
+	case <-time.After(producerSignalTimeout):
+		t.Fatal("no event was recorded")
+	}
+}
+
+type producerPurgeRunner struct {
+	result purge.RunResult
+	err    error
+	calls  int
+}
+
+var _ useCases.PurgeRunner = &producerPurgeRunner{}
+
+func (r *producerPurgeRunner) Execute(*string) (purge.RunResult, error) {
+	r.calls++
+	return r.result, r.err
+}
+
+type producerBlockingImageRepo struct {
+	*mockImageRepo
+	entered chan struct{}
+	release chan struct{}
+}
+
+func (r *producerBlockingImageRepo) ListDuplicates() ([]image.Image, error) {
+	r.entered <- struct{}{}
+	<-r.release
+	return r.mockImageRepo.ListDuplicates()
+}
+
+func producerContext(actor audit.Actor, source audit.Source) context.Context {
+	return audit.WithOrigin(context.Background(), audit.Origin{Actor: actor, Source: source, IP: "192.0.2.1", UserAgent: "producers-test/1.0"})
+}
+
+func producerOwnerContext() context.Context {
+	id := uint32(1)
+	return producerContext(audit.Actor{Type: audit.ActorUser, ID: &id, Name: "Marta Alves"}, audit.SourceWeb)
+}
+
+func producerAnonymousContext() context.Context {
+	return producerContext(audit.AnonymousActor(""), audit.SourceWeb)
+}
+
+func onlyEvent(t *testing.T, h *activityHarness) audit.Event {
+	t.Helper()
+	events := h.all(t)
+	if len(events) != 1 {
+		t.Fatalf("expected exactly one event, got %d: %+v", len(events), events)
+	}
+	return events[0]
+}
+
+func assertNoEvents(t *testing.T, h *activityHarness) {
+	t.Helper()
+	if events := h.all(t); len(events) != 0 {
+		t.Fatalf("expected no event, got %+v", events)
+	}
+}
+
+func assertEventsHoldNothing(t *testing.T, h *activityHarness, forbidden ...string) {
+	t.Helper()
+	encoded, err := json.Marshal(h.all(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, secret := range forbidden {
+		if strings.Contains(string(encoded), secret) || strings.Contains(h.logs.String(), secret) {
+			t.Errorf("an event or the log holds %q: %s", secret, encoded)
+		}
+	}
+}
+
+func TestActivityLogProducersArticleChanges(t *testing.T) {
+	t.Run("The delta is signed and counts characters", func(t *testing.T) {
+		for _, example := range []struct {
+			before int
+			after  int
+			delta  int
+		}{{100, 412, 312}, {412, 100, -312}, {5, 5, 0}} {
+			t.Run(fmt.Sprintf("%d to %d", example.before, example.after), func(t *testing.T) {
+				h := newActivityHarness(t)
+				repo := newMockArticleRepo()
+				repo.articles[8] = article.Article{ID: 8, Title: "Spring release", Body: strings.Repeat("a", example.before)}
+				uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, h.recorder)
+
+				if _, err := uc.UpdateBody(producerOwnerContext(), 8, strings.Repeat("b", example.after), article.BodyFormatHTML); err != nil {
+					t.Fatal(err)
+				}
+
+				event := onlyEvent(t, h)
+				if len(event.Changes) != 1 || event.Changes[0].Delta == nil || *event.Changes[0].Delta != example.delta || event.Changes[0].Field != "body" || event.Changes[0].Kind != audit.ChangeBody {
+					t.Errorf("changes = %+v", event.Changes)
+				}
+				assertEventsHoldNothing(t, h, "bbbb")
+			})
+		}
+	})
+
+	t.Run("A body with multi-byte characters is counted in characters", func(t *testing.T) {
+		h := newActivityHarness(t)
+		repo := newMockArticleRepo()
+		repo.articles[8] = article.Article{ID: 8, Title: "Spring release", Body: "héllo"}
+		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, h.recorder)
+
+		if _, err := uc.UpdateBody(producerOwnerContext(), 8, "héllo wörld", article.BodyFormatHTML); err != nil {
+			t.Fatal(err)
+		}
+
+		event := onlyEvent(t, h)
+		if event.Changes[0].Delta == nil || *event.Changes[0].Delta != 6 || utf8.RuneCountInString("héllo wörld")-utf8.RuneCountInString("héllo") != 6 {
+			t.Errorf("changes = %+v", event.Changes)
+		}
+	})
+
+	t.Run("A title change is recorded as a text diff when a title edit exists", func(t *testing.T) {
+		before := article.Article{ID: 8, Title: "Spring release", Body: "x", IsOnline: false}
+		after := article.Article{ID: 8, Title: "Spring release 2", Body: "x", IsOnline: false}
+
+		changes := audit.ArticleChanges(before, after)
+
+		encoded, _ := json.Marshal(changes)
+		if string(encoded) != `[{"field":"title","kind":"text","before":"Spring release","after":"Spring release 2"}]` {
+			t.Errorf("changes = %s", encoded)
+		}
+	})
+
+	t.Run("Only the fields title, online and body can ever appear in an article event's changes", func(t *testing.T) {
+		before := article.Article{ID: 8, Title: "a", Body: "x", IsOnline: false}
+		after := article.Article{ID: 9, Title: "b", Body: "y", IsOnline: true}
+
+		for _, change := range audit.ArticleChanges(before, after) {
+			if change.Field != "title" && change.Field != "online" && change.Field != "body" {
+				t.Errorf("unexpected field %q", change.Field)
+			}
+			if change.Kind != audit.ChangeText && change.Kind != audit.ChangeBody {
+				t.Errorf("unexpected kind %q", change.Kind)
+			}
+		}
+	})
+
+	t.Run("A refused article title is recorded as failed with a plain reason", func(t *testing.T) {
+		h := newActivityHarness(t)
+		uc := useCases.NewCreateArticleUseCase(newMockArticleRepo(), &fakeBodyRenderer{}, h.recorder)
+
+		_, err := uc.CreateArticle(producerOwnerContext(), useCases.CreateArticleCommand{Title: "ab", Body: "Hello"})
+
+		if !errors.Is(err, article.ErrInvalidTitle) {
+			t.Fatalf("err = %v", err)
+		}
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "article.create", audit.CategoryArticles, audit.OutcomeFailed)
+		assertProducerFailure(t, event, "The title must be between 3 and 200 characters.")
+	})
+}
+
+func TestActivityLogProducersFailureReasons(t *testing.T) {
+	sentences := []struct {
+		cause    error
+		sentence string
+	}{
+		{article.ErrInvalidTitle, "The title must be between 3 and 200 characters."},
+		{image.ErrImageTypeNotAllowed, "The file must be a PNG, JPEG, WEBP or SVG image."},
+		{image.ErrImageTooLarge, "The file is too large to upload."},
+		{image.ErrImageUnreadable, "The image could not be read."},
+		{image.ErrInvalidFilename, "That file name is not valid."},
+		{image.ErrInvalidMergeRequest, "The merge request is not valid."},
+		{image.ErrMergeCopyMissing, "One of the copies no longer exists."},
+		{image.ErrMergeHashMismatch, "The images are not identical copies."},
+		{purge.ErrPurgeConflict, "The library changed since the preview. Review it again."},
+		{user.ErrRegistrationClosed, "Registration is closed on this site."},
+		{user.ErrVerificationEmailNotSent, "The verification email could not be sent."},
+		{user.ErrInvalidVerificationCode, "The verification code is not valid."},
+		{user.ErrVerificationCodeExpired, "The verification code has expired."},
+		{user.ErrInvalidDisplayName, "That display name is too long."},
+		{user.ErrUsernameTaken, "That username is already taken."},
+		{invite.ErrEmailHasAccount, "That email already has an account."},
+		{invite.ErrPendingInvite, "An invitation is already pending for that email."},
+		{invite.ErrInviteEmailNotSent, "The invitation email could not be sent."},
+		{invite.ErrInviteAlreadyAccepted, "That invitation was already accepted."},
+		{invite.ErrInviteInvalid, "That invitation is not valid."},
+		{invite.ErrInviteExpired, "That invitation has expired."},
+		{update.ErrFeedUnavailable, "The release feed could not be reached."},
+		{update.ErrNoRelease, "No release was found."},
+		{update.ErrNotPrepared, "This server cannot apply updates."},
+		{update.ErrJobInProgress, "An update is already being downloaded."},
+		{update.ErrRestartPending, "A restart is already pending."},
+		{update.ErrNothingToUpdate, "There is nothing to update."},
+		{update.ErrPreflightRefused, "The update cannot be downloaded."},
+		{update.ErrRestartKindMismatch, "The requested restart does not match the server state."},
+	}
+
+	dueSettings := func() *mockPurgeSettingsRepo {
+		repo := newMockPurgeSettingsRepo()
+		repo.settings = purge.Settings{AutoPurgeEnabled: true, AutoPurgeIntervalDays: 1, EnabledAt: purgeTime("2026-09-01T00:00:00Z")}
+		return repo
+	}
+	failWith := func(t *testing.T, err error) audit.Event {
+		t.Helper()
+		h := newActivityHarness(t)
+		scheduler := useCases.NewPurgeSchedulerUseCase(dueSettings(), &producerPurgeRunner{err: err}, h.recorder)
+		if _, _, tickErr := scheduler.Tick(*purgeTime("2026-10-05T09:00:00Z")); !errors.Is(tickErr, err) {
+			t.Fatalf("tick err = %v", tickErr)
+		}
+		return onlyEvent(t, h)
+	}
+
+	t.Run("Failure reasons are mapped from domain sentinels", func(t *testing.T) {
+		for _, example := range sentences {
+			t.Run(example.cause.Error(), func(t *testing.T) {
+				event := failWith(t, fmt.Errorf("while working: %w", example.cause))
+				assertProducerFailure(t, event, example.sentence)
+			})
+		}
+	})
+
+	t.Run("Unmapped errors become the generic sentence", func(t *testing.T) {
+		for name, err := range map[string]error{
+			"a plain error":                                errors.New("db is locked"),
+			"an error carrying an SMTP host":               errors.New("dial smtp.internal.example:587 with password hunter2"),
+			"an error carrying a file system path":         errors.New(`open C:\data\secret\file.db`),
+			"an error wrapping a sentinel and a raw cause": errors.Join(update.ErrFeedUnavailable, errors.New("token=abc123")),
+		} {
+			t.Run(name, func(t *testing.T) {
+				event := failWith(t, err)
+				if name == "an error wrapping a sentinel and a raw cause" {
+					assertProducerFailure(t, event, "The release feed could not be reached.")
+				} else {
+					assertProducerFailure(t, event, useCases.GenericFailureReason)
+				}
+				encoded, _ := json.Marshal(event)
+				for _, leaked := range []string{"locked", "hunter2", "smtp.internal", "secret", "abc123"} {
+					if strings.Contains(string(encoded), leaked) {
+						t.Errorf("the event leaks %q: %s", leaked, encoded)
+					}
+				}
+			})
+		}
+	})
+
+	t.Run("Every failure reason fits the stored limit", func(t *testing.T) {
+		for _, example := range sentences {
+			if len(example.sentence) > 255 {
+				t.Errorf("%q is %d characters", example.sentence, len(example.sentence))
+			}
+		}
+		if len(useCases.GenericFailureReason) > 255 {
+			t.Errorf("the generic sentence is too long")
+		}
+	})
+
+	t.Run("A failed event keeps its target when the target is known", func(t *testing.T) {
+		h := newActivityHarness(t)
+		images := newMockImageRepo()
+		images.images[5] = image.Image{ID: 5, Filename: "banner.png", Path: "/static/uploadedImages/5.png"}
+		uc := useCases.NewRenameMediaUseCase(images, h.recorder)
+
+		if _, err := uc.Rename(producerOwnerContext(), 5, "not valid!"); !errors.Is(err, image.ErrInvalidFilename) {
+			t.Fatalf("err = %v", err)
+		}
+
+		assertProducerTarget(t, onlyEvent(t, h), "image", "5", "banner.png")
+	})
+}
+
+func TestActivityLogProducersScheduledPurge(t *testing.T) {
+	due := func() *mockPurgeSettingsRepo {
+		repo := newMockPurgeSettingsRepo()
+		repo.settings = purge.Settings{AutoPurgeEnabled: true, AutoPurgeIntervalDays: 10, EnabledAt: purgeTime("2026-09-20T09:00:00Z")}
+		return repo
+	}
+	now := *purgeTime("2026-10-05T09:00:00Z")
+
+	t.Run("The scheduled purge is a system event", func(t *testing.T) {
+		h := newActivityHarness(t)
+		runner := &producerPurgeRunner{result: purge.RunResult{GroupsTotal: 2, GroupsPurged: 2, Merged: 3, ArticlesUpdated: 5}}
+		scheduler := useCases.NewPurgeSchedulerUseCase(due(), runner, h.recorder)
+
+		if _, ran, err := scheduler.Tick(now); err != nil || !ran {
+			t.Fatalf("ran = %v, err = %v", ran, err)
+		}
+
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "system.media_purge", audit.CategorySystem, audit.OutcomeSuccess)
+		if event.Actor.Type != audit.ActorSystem || event.Actor.Name != "System" || event.Source != audit.SourceSystem || event.IP != nil || event.UserAgent != nil {
+			t.Errorf("event = %+v", event)
+		}
+		if got := paramsJSON(t, event); got != `{"articles_updated":5,"merged":3}` {
+			t.Errorf("params = %s", got)
+		}
+	})
+
+	t.Run("A scheduled purge with a failed group records the failed group count", func(t *testing.T) {
+		h := newActivityHarness(t)
+		runner := &producerPurgeRunner{result: purge.RunResult{GroupsTotal: 3, GroupsPurged: 2, FailedGroups: 1, Merged: 2, ArticlesUpdated: 2}}
+		scheduler := useCases.NewPurgeSchedulerUseCase(due(), runner, h.recorder)
+
+		if _, _, err := scheduler.Tick(now); err != nil {
+			t.Fatal(err)
+		}
+
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "system.media_purge", audit.CategorySystem, audit.OutcomeSuccess)
+		if !strings.Contains(paramsJSON(t, event), `"failed_groups":1`) {
+			t.Errorf("params = %s", paramsJSON(t, event))
+		}
+	})
+
+	t.Run("A scheduled purge that is not due or merges nothing records nothing", func(t *testing.T) {
+		h := newActivityHarness(t)
+		notDue := newMockPurgeSettingsRepo()
+		runner := &producerPurgeRunner{}
+		if _, ran, err := useCases.NewPurgeSchedulerUseCase(notDue, runner, h.recorder).Tick(now); err != nil || ran {
+			t.Fatalf("ran = %v, err = %v", ran, err)
+		}
+		if _, ran, err := useCases.NewPurgeSchedulerUseCase(due(), runner, h.recorder).Tick(now); err != nil || !ran {
+			t.Fatalf("ran = %v, err = %v", ran, err)
+		}
+		assertNoEvents(t, h)
+	})
+
+	t.Run("A scheduled purge that cannot record its run is a failed system event", func(t *testing.T) {
+		h := newActivityHarness(t)
+		runner := &producerPurgeRunner{err: errRepositoryFailure}
+
+		if _, _, err := useCases.NewPurgeSchedulerUseCase(due(), runner, h.recorder).Tick(now); err == nil {
+			t.Fatal("expected an error")
+		}
+
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "system.media_purge", audit.CategorySystem, audit.OutcomeFailed)
+		assertProducerFailure(t, event, useCases.GenericFailureReason)
+	})
+
+	t.Run("A refused manual purge is recorded as failed when a purge is already running", func(t *testing.T) {
+		h := newActivityHarness(t)
+		images := &producerBlockingImageRepo{mockImageRepo: newMockImageRepo(), entered: make(chan struct{}, 2), release: make(chan struct{})}
+		articles := newMockArticleRepo()
+		storage := newMockImageStorage()
+		merge := useCases.NewMergeMediaUseCase(images, articles, storage, h.recorder)
+		run := useCases.NewRunPurgeUseCase(images, articles, merge, newMockPurgeSettingsRepo(), func() time.Time { return now }, log.New(io.Discard, "", 0), h.recorder)
+
+		finished := make(chan struct{})
+		go func() {
+			defer close(finished)
+			_, _ = run.Run(producerOwnerContext(), nil)
+		}()
+		<-images.entered
+
+		_, err := run.Run(producerOwnerContext(), nil)
+		close(images.release)
+		<-finished
+
+		if !errors.Is(err, purge.ErrPurgeBusy) {
+			t.Fatalf("err = %v", err)
+		}
+		events := h.all(t)
+		if len(events) != 2 {
+			t.Fatalf("events = %+v", events)
+		}
+		busy := events[1]
+		if events[0].Outcome == audit.OutcomeFailed {
+			busy = events[0]
+		}
+		assertProducerEvent(t, busy, "media.purge", audit.CategoryMedia, audit.OutcomeFailed)
+		assertProducerFailure(t, busy, "A purge is already running.")
+	})
+}
+
+func TestActivityLogProducersAccounts(t *testing.T) {
+	const password = "s3cretpassw0rd"
+	newUsers := func() *mockUserRepo {
+		users := newMockUserRepo()
+		return users
+	}
+
+	t.Run("Registering is recorded with the new account as actor", func(t *testing.T) {
+		h := newActivityHarness(t)
+		uc := useCases.NewCreateUserUseCase(newUsers(), &stubHasher{}, newMockMailRepo(), "https://cms.example.com", h.recorder)
+
+		created, err := uc.CreateUser(producerAnonymousContext(), useCases.CreateUserCommand{Username: "marta", Password: password, Email: "marta@example.com"})
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "user.register", audit.CategoryUsers, audit.OutcomeSuccess)
+		if event.Actor.Type != audit.ActorUser || event.Actor.ID == nil || *event.Actor.ID != created.ID || event.Actor.Name != "marta" || event.Source != audit.SourceWeb {
+			t.Errorf("actor = %+v, source = %s", event.Actor, event.Source)
+		}
+		assertProducerTarget(t, event, "user", "1", "marta")
+		assertEventsHoldNothing(t, h, password, "hashed:", created.VerificationCode)
+	})
+
+	t.Run("A refused registration is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			cause  string
+			setup  func(users *mockUserRepo, mail *mockMailRepo)
+			reason string
+		}{
+			{"registration is closed", func(users *mockUserRepo, _ *mockMailRepo) {
+				users.users[9] = user.User{ID: 9, Username: "owner", IsVerified: true}
+			}, "Registration is closed on this site."},
+			{"the verification email cannot be sent", func(_ *mockUserRepo, mail *mockMailRepo) { mail.fail.failNext("Send") }, "The verification email could not be sent."},
+		} {
+			t.Run(example.cause, func(t *testing.T) {
+				h := newActivityHarness(t)
+				users := newUsers()
+				mail := newMockMailRepo()
+				example.setup(users, mail)
+				uc := useCases.NewCreateUserUseCase(users, &stubHasher{}, mail, "https://cms.example.com", h.recorder)
+
+				if _, err := uc.CreateUser(producerAnonymousContext(), useCases.CreateUserCommand{Username: "marta", Password: password, Email: "marta@example.com"}); err == nil {
+					t.Fatal("expected a refusal")
+				}
+
+				event := onlyEvent(t, h)
+				assertProducerEvent(t, event, "user.register", audit.CategoryUsers, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+				if event.Actor.Type != audit.ActorAnonymous || event.Actor.Name != "marta" || event.Target != (audit.Target{}) {
+					t.Errorf("actor = %+v, target = %+v", event.Actor, event.Target)
+				}
+				assertEventsHoldNothing(t, h, password)
+			})
+		}
+	})
+
+	t.Run("A failed cleanup after an unsent verification email keeps both causes", func(t *testing.T) {
+		h := newActivityHarness(t)
+		users := newUsers()
+		mail := newMockMailRepo()
+		mail.fail.failNext("Send")
+		cleanupFailure := errors.New("cleanup failure")
+		users.fail.failNextWith("Delete", cleanupFailure)
+		uc := useCases.NewCreateUserUseCase(users, &stubHasher{}, mail, "https://cms.example.com", h.recorder)
+
+		_, err := uc.CreateUser(producerAnonymousContext(), useCases.CreateUserCommand{Username: "marta", Password: password, Email: "marta@example.com"})
+
+		if !errors.Is(err, user.ErrVerificationEmailNotSent) || !errors.Is(err, cleanupFailure) {
+			t.Errorf("err = %v", err)
+		}
+		assertProducerFailure(t, onlyEvent(t, h), "The verification email could not be sent.")
+	})
+
+	t.Run("Verifying an account is recorded", func(t *testing.T) {
+		h := newActivityHarness(t)
+		users := newUsers()
+		users.users[4] = user.User{ID: 4, Username: "lea", VerificationCode: "hashed:the-code", VerificationExpiration: time.Now().Add(time.Hour)}
+		uc := useCases.NewVerifyUserUseCase(users, &stubHasher{}, h.recorder)
+
+		if _, err := uc.Verify(producerAnonymousContext(), 4, "the-code"); err != nil {
+			t.Fatal(err)
+		}
+
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "user.verify", audit.CategoryUsers, audit.OutcomeSuccess)
+		if event.Actor.Type != audit.ActorUser || event.Actor.ID == nil || *event.Actor.ID != 4 {
+			t.Errorf("actor = %+v", event.Actor)
+		}
+		assertProducerTarget(t, event, "user", "4", "lea")
+		assertEventsHoldNothing(t, h, "the-code", "hashed:")
+	})
+
+	t.Run("A refused verification is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name       string
+			code       string
+			expiration time.Time
+			reason     string
+		}{
+			{"ErrInvalidVerificationCode", "wrong", time.Now().Add(time.Hour), "The verification code is not valid."},
+			{"ErrVerificationCodeExpired", "the-code", time.Now().Add(-time.Hour), "The verification code has expired."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				h := newActivityHarness(t)
+				users := newUsers()
+				users.users[4] = user.User{ID: 4, Username: "lea", VerificationCode: "hashed:the-code", VerificationExpiration: example.expiration}
+				uc := useCases.NewVerifyUserUseCase(users, &stubHasher{}, h.recorder)
+
+				if _, err := uc.Verify(producerAnonymousContext(), 4, example.code); err == nil {
+					t.Fatal("expected a refusal")
+				}
+
+				event := onlyEvent(t, h)
+				assertProducerEvent(t, event, "user.verify", audit.CategoryUsers, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+			})
+		}
+	})
+
+	t.Run("Accepting an invite is recorded with the new account as actor", func(t *testing.T) {
+		h := newActivityHarness(t)
+		users := newUsers()
+		invites := newInviteFakeRepo()
+		invites.users = users
+		seeded := invites.seed(invite.Invite{Email: "new@example.com", HashedCode: "hashed:the-code", ExpiresAt: time.Now().Add(time.Hour)})
+		uc := useCases.NewAcceptInviteUseCase(users, invites, &stubHasher{}, h.recorder)
+
+		created, err := uc.AcceptInvite(producerAnonymousContext(), useCases.AcceptInviteCommand{Code: "the-code", Username: "sam", Password: password})
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "invite.accept", audit.CategoryUsers, audit.OutcomeSuccess)
+		if event.Actor.Type != audit.ActorUser || event.Actor.ID == nil || *event.Actor.ID != created.ID || event.Actor.Name != "sam" || event.Source != audit.SourceWeb {
+			t.Errorf("actor = %+v", event.Actor)
+		}
+		assertProducerTarget(t, event, "invite", fmt.Sprint(seeded.ID), "new@example.com")
+		assertEventsHoldNothing(t, h, "the-code", "hashed:", password)
+	})
+
+	t.Run("A refused acceptance is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name      string
+			code      string
+			expiresIn time.Duration
+			existing  []user.User
+			reason    string
+			target    bool
+		}{
+			{"ErrInviteInvalid", "wrong", time.Hour, nil, "That invitation is not valid.", false},
+			{"ErrInviteExpired", "the-code", -time.Hour, nil, "That invitation has expired.", false},
+			{"ErrUsernameTaken", "the-code", time.Hour, []user.User{{ID: 9, Username: "sam", Email: "sam@example.com"}}, "That username is already taken.", true},
+			{"ErrEmailHasAccount", "the-code", time.Hour, []user.User{{ID: 9, Username: "other", Email: "new@example.com"}}, "That email already has an account.", true},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				h := newActivityHarness(t)
+				users := newUsers()
+				for _, existing := range example.existing {
+					users.users[existing.ID] = existing
+				}
+				invites := newInviteFakeRepo()
+				invites.users = users
+				invites.seed(invite.Invite{Email: "new@example.com", HashedCode: "hashed:the-code", ExpiresAt: time.Now().Add(example.expiresIn)})
+				uc := useCases.NewAcceptInviteUseCase(users, invites, &stubHasher{}, h.recorder)
+
+				if _, err := uc.AcceptInvite(producerAnonymousContext(), useCases.AcceptInviteCommand{Code: example.code, Username: "sam", Password: password}); err == nil {
+					t.Fatal("expected a refusal")
+				}
+
+				event := onlyEvent(t, h)
+				assertProducerEvent(t, event, "invite.accept", audit.CategoryUsers, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+				if event.Actor.Type != audit.ActorAnonymous || event.Actor.Name != "sam" {
+					t.Errorf("actor = %+v", event.Actor)
+				}
+				if (event.Target != audit.Target{}) != example.target {
+					t.Errorf("target = %+v", event.Target)
+				}
+				assertEventsHoldNothing(t, h, "the-code", password)
+			})
+		}
+	})
+}
+
+func TestActivityLogProducersUpdateDownload(t *testing.T) {
+	cancelledOwnerContext := func() (context.Context, context.CancelFunc) {
+		return context.WithCancel(producerOwnerContext())
+	}
+	newRig := func(t *testing.T) (*downloadRig, *activityHarness, *producerSignalRecorder) {
+		t.Helper()
+		h := newActivityHarness(t)
+		signal := newProducerSignalRecorder(h.recorder)
+		rig := newDownloadRig(t)
+		rig.recorder = signal
+		rig.rebuild()
+		return rig, h, signal
+	}
+
+	t.Run("A download that completes is recorded when the job is ready", func(t *testing.T) {
+		rig, h, signal := newRig(t)
+		ctx, cancel := cancelledOwnerContext()
+
+		if _, err := rig.start.Start(ctx); err != nil {
+			t.Fatal(err)
+		}
+		cancel()
+		signal.await(t)
+
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "system.update_downloaded", audit.CategorySystem, audit.OutcomeSuccess)
+		assertProducerTarget(t, event, "release", downloadTag, downloadTag)
+		if event.Actor.Type != audit.ActorUser || event.Actor.Name != "Marta Alves" || event.Source != audit.SourceWeb || event.IP == nil || *event.IP != "192.0.2.1" {
+			t.Errorf("event = %+v", event)
+		}
+		assertEventsHoldNothing(t, h, "https://", rig.updatesDir)
+	})
+
+	t.Run("A download that fails is recorded with a reason that hides the cause", func(t *testing.T) {
+		for _, example := range []struct {
+			kind   string
+			setup  func(rig *downloadRig)
+			reason string
+		}{
+			{"download", func(rig *downloadRig) { rig.fetcher.errors[rig.assetName] = errDownloadNetwork }, "The update could not be downloaded."},
+			{"verification", func(rig *downloadRig) {
+				_, otherKey, err := ed25519.GenerateKey(rand.Reader)
+				if err != nil {
+					t.Fatal(err)
+				}
+				rig.signChecksums(rig.checksumsFor(rig.assetName, rig.fetcher.files[rig.assetName]), otherKey)
+				rig.publishAssets()
+			}, "The downloaded update failed its integrity check."},
+		} {
+			t.Run(example.kind, func(t *testing.T) {
+				rig, h, signal := newRig(t)
+				example.setup(rig)
+
+				if _, err := rig.start.Start(producerOwnerContext()); err != nil {
+					t.Fatal(err)
+				}
+				signal.await(t)
+
+				event := onlyEvent(t, h)
+				assertProducerEvent(t, event, "system.update_downloaded", audit.CategorySystem, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+				assertEventsHoldNothing(t, h, "https://", rig.updatesDir, errDownloadNetwork.Error())
+			})
+		}
+	})
+
+	t.Run("A download refused at the start is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name   string
+			setup  func(rig *downloadRig)
+			reason string
+		}{
+			{"ErrNotPrepared", func(rig *downloadRig) { rig.helper.installed = false }, "This server cannot apply updates."},
+			{"ErrJobInProgress", func(rig *downloadRig) {
+				rig.jobs.put(update.Job{Tag: downloadTag, State: update.StateDownloading, StartedAt: time.Now()})
+			}, "An update is already being downloaded."},
+			{"ErrRestartPending", func(rig *downloadRig) {
+				_ = rig.requests.Write(update.RestartRequest{Kind: update.RestartKindRestart, RequestedAt: updateTestCheckedAt})
+			}, "A restart is already pending."},
+			{"ErrNothingToUpdate", func(rig *downloadRig) { rig.store.found = false }, "There is nothing to update."},
+			{"ErrPreflightRefused", func(rig *downloadRig) { rig.dropAsset(update.ChecksumsAssetName) }, "The update cannot be downloaded."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				rig, h, _ := newRig(t)
+				example.setup(rig)
+
+				if _, err := rig.start.Start(producerOwnerContext()); err == nil {
+					t.Fatal("expected a refusal")
+				}
+
+				event := onlyEvent(t, h)
+				assertProducerEvent(t, event, "system.update_downloaded", audit.CategorySystem, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+			})
+		}
+	})
+}
+
+func TestActivityLogProducersRestart(t *testing.T) {
+	newRequest := func(t *testing.T) (*restartRig, *activityHarness, *useCases.RequestRestartUseCase) {
+		t.Helper()
+		h := newActivityHarness(t)
+		rig := newRestartRig(updateRunning)
+		request := useCases.NewRequestRestartUseCase(rig.store, rig.jobs, rig.helper, rig.results, rig.requests, updateRunning, rig.clock.Now, h.recorder)
+		return rig, h, request
+	}
+
+	t.Run("A restart request is recorded", func(t *testing.T) {
+		_, h, request := newRequest(t)
+
+		if _, err := request.Request(producerOwnerContext(), updateOwnerId, ""); err != nil {
+			t.Fatal(err)
+		}
+
+		event := onlyEvent(t, h)
+		assertProducerEvent(t, event, "system.restart_requested", audit.CategorySystem, audit.OutcomeSuccess)
+		if got := paramsJSON(t, event); got != `{"kind":"restart"}` {
+			t.Errorf("params = %s", got)
+		}
+		if event.Target != (audit.Target{}) {
+			t.Errorf("target = %+v", event.Target)
+		}
+	})
+
+	t.Run("A restart that applies a downloaded update records the kind and version", func(t *testing.T) {
+		rig, h, request := newRequest(t)
+		rig.readyJob()
+
+		if _, err := request.Request(producerOwnerContext(), updateOwnerId, ""); err != nil {
+			t.Fatal(err)
+		}
+
+		if got := paramsJSON(t, onlyEvent(t, h)); got != `{"kind":"update","tag":"`+downloadTag+`"}` {
+			t.Errorf("params = %s", got)
+		}
+	})
+
+	t.Run("A refused restart is recorded as failed", func(t *testing.T) {
+		for _, example := range []struct {
+			name   string
+			setup  func(rig *restartRig)
+			kind   string
+			reason string
+		}{
+			{"ErrNotPrepared", func(rig *restartRig) { rig.helper.installed = false }, "", "This server cannot apply updates."},
+			{"ErrJobInProgress", func(rig *restartRig) {
+				rig.jobs.put(update.Job{Tag: downloadTag, State: update.StateDownloading, StartedAt: restartBaseTime})
+			}, "", "An update is still being downloaded."},
+			{"ErrRestartPending", func(rig *restartRig) {
+				_ = rig.requests.Write(update.RestartRequest{Kind: update.RestartKindRestart, RequestedAt: restartBaseTime})
+			}, "", "A restart is already pending."},
+			{"ErrRestartKindMismatch", func(*restartRig) {}, update.RestartKindUpdate, "The requested restart does not match the server state."},
+		} {
+			t.Run(example.name, func(t *testing.T) {
+				rig, h, request := newRequest(t)
+				example.setup(rig)
+
+				if _, err := request.Request(producerOwnerContext(), updateOwnerId, example.kind); err == nil {
+					t.Fatal("expected a refusal")
+				}
+
+				event := onlyEvent(t, h)
+				assertProducerEvent(t, event, "system.restart_requested", audit.CategorySystem, audit.OutcomeFailed)
+				assertProducerFailure(t, event, example.reason)
+			})
+		}
+	})
+}

test/api_keys_http_test.go

@@ -6,6 +6,7 @@ import (
 	validator "RenewCMS/api/pkg/validator"
 	"RenewCMS/internal/domain/apikey"
 	"RenewCMS/internal/domain/article"
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/image"
 	"RenewCMS/internal/domain/update"
 	"RenewCMS/internal/domain/user"
@@ -15,6 +16,8 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"io"
+	"log"
 	"net/http"
 	"net/http/httptest"
 	"regexp"
@@ -45,6 +48,7 @@ type apiKeyEnv struct {
 	articles  *mockArticleRepo
 	images    *mockImageRepo
 	invites   *inviteFakeRepo
+	mail      *mockMailRepo
 	feed      *fakeReleaseFeed
 	updates   *fakeUpdateStore
 	token     *jwtauth.JWTAuth
@@ -57,6 +61,11 @@ type apiKeyEnv struct {
 }
 
 func newAPIKeyEnv(t *testing.T) *apiKeyEnv {
+	t.Helper()
+	return newAPIKeyEnvRecording(t, discardRecorder)
+}
+
+func newAPIKeyEnvRecording(t *testing.T, recorder audit.Recorder) *apiKeyEnv {
 	t.Helper()
 	validator.InitValidator()
 
@@ -89,41 +98,47 @@ func newAPIKeyEnv(t *testing.T) *apiKeyEnv {
 	clock := func() time.Time { return env.now }
 	hasher := &stubHasher{}
 	mail := newMockMailRepo()
+	env.mail = mail
 	renderer := &fakeBodyRenderer{}
+	mergeMedia := useCases.NewMergeMediaUseCase(env.images, env.articles, newMockImageStorage(), recorder)
+	purgeSettings := newMockPurgeSettingsRepo()
+	restartJobs := &fakeJobStore{}
 	env.container = &api.UseCases{
 		Token:                       env.token,
-		CreateArticleUseCase:        useCases.NewCreateArticleUseCase(env.articles, renderer),
+		CreateArticleUseCase:        useCases.NewCreateArticleUseCase(env.articles, renderer, recorder),
 		GetArticleUseCase:           useCases.NewGetArticleUseCase(env.articles, renderer),
 		ListArticlesUseCase:         useCases.NewListArticlesUseCase(env.articles, renderer),
-		UpdateArticleUseCase:        useCases.NewUpdateArticleUseCase(env.articles, renderer),
-		DeleteArticleUseCase:        useCases.NewDeleteArticleUseCase(env.articles),
+		UpdateArticleUseCase:        useCases.NewUpdateArticleUseCase(env.articles, renderer, recorder),
+		DeleteArticleUseCase:        useCases.NewDeleteArticleUseCase(env.articles, recorder),
 		GetUserUseCase:              useCases.NewGetUserUseCase(env.users),
-		CreateUserUseCase:           useCases.NewCreateUserUseCase(env.users, hasher, mail, "https://cms.example.com"),
-		AuthenticateUserUseCase:     useCases.NewAuthenticateUserUseCase(env.users, hasher, discardRecorder),
-		VerifyUserUseCase:           useCases.NewVerifyUserUseCase(env.users, hasher),
+		CreateUserUseCase:           useCases.NewCreateUserUseCase(env.users, hasher, mail, "https://cms.example.com", recorder),
+		AuthenticateUserUseCase:     useCases.NewAuthenticateUserUseCase(env.users, hasher, recorder),
+		VerifyUserUseCase:           useCases.NewVerifyUserUseCase(env.users, hasher, recorder),
 		CancelRegistrationUseCase:   useCases.NewCancelRegistrationUseCase(env.users),
-		RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(env.users, hasher, mail, "https://cms.example.com", discardRecorder),
-		ResetPasswordUseCase:        useCases.NewResetPasswordUseCase(env.users, hasher, env.keys, clock, discardRecorder),
-		UpdateUserProfileUseCase:    useCases.NewUpdateUserProfileUseCase(env.users),
-		CreateInviteUseCase:         useCases.NewCreateInviteUseCase(env.users, env.invites, hasher, mail, "https://cms.example.com"),
-		CancelInviteUseCase:         useCases.NewCancelInviteUseCase(env.invites),
-		RenewInviteUseCase:          useCases.NewRenewInviteUseCase(env.users, env.invites, hasher, mail, "https://cms.example.com"),
+		RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(env.users, hasher, mail, "https://cms.example.com", recorder),
+		ResetPasswordUseCase:        useCases.NewResetPasswordUseCase(env.users, hasher, env.keys, clock, recorder),
+		UpdateUserProfileUseCase:    useCases.NewUpdateUserProfileUseCase(env.users, recorder),
+		CreateInviteUseCase:         useCases.NewCreateInviteUseCase(env.users, env.invites, hasher, mail, "https://cms.example.com", recorder),
+		CancelInviteUseCase:         useCases.NewCancelInviteUseCase(env.invites, recorder),
+		RenewInviteUseCase:          useCases.NewRenewInviteUseCase(env.users, env.invites, hasher, mail, "https://cms.example.com", recorder),
 		ListUsersAndInvitesUseCase:  useCases.NewListUsersAndInvitesUseCase(env.users, env.invites),
 		GetInviteUseCase:            useCases.NewGetInviteUseCase(env.invites, hasher),
-		AcceptInviteUseCase:         useCases.NewAcceptInviteUseCase(env.users, env.invites, hasher),
-		CreateImageUseCase:          useCases.NewCreateImageUseCase(env.images, newMockImageStorage()),
+		AcceptInviteUseCase:         useCases.NewAcceptInviteUseCase(env.users, env.invites, hasher, recorder),
+		CreateImageUseCase:          useCases.NewCreateImageUseCase(env.images, newMockImageStorage(), recorder),
 		ListMediaUseCase:            useCases.NewListMediaUseCase(env.images, env.articles, env.users),
-		RenameMediaUseCase:          useCases.NewRenameMediaUseCase(env.images),
-		DeleteMediaUseCase:          useCases.NewDeleteMediaUseCase(env.images, newMockImageStorage()),
-		MergeMediaUseCase:           useCases.NewMergeMediaUseCase(env.images, env.articles, newMockImageStorage()),
+		RenameMediaUseCase:          useCases.NewRenameMediaUseCase(env.images, recorder),
+		DeleteMediaUseCase:          useCases.NewDeleteMediaUseCase(env.images, newMockImageStorage(), recorder),
+		MergeMediaUseCase:           mergeMedia,
+		RunPurgeUseCase:             useCases.NewRunPurgeUseCase(env.images, env.articles, mergeMedia, purgeSettings, clock, log.New(io.Discard, "", 0), recorder),
+		RequestRestartUseCase:       useCases.NewRequestRestartUseCase(env.updates, restartJobs, &fakeHelperDetector{installed: true}, &fakeResultStore{}, &fakeRestartRequestStore{}, apiKeyRunningVersion, clock, recorder),
 		GetMediaUsageUseCase:        useCases.NewGetMediaUsageUseCase(env.images, env.articles),
 		GetSettingsUseCase:          useCases.NewGetSettingsUseCase(apiKeyRunningVersion),
 		GetActivityRetentionUseCase: useCases.NewGetActivityRetentionUseCase(newActivitySettingsFake()),
 		GetUpdateStatusUseCase:      newUpdateStatusUseCase(env.updates, &fakeJobStore{}, &fakeHelperDetector{}, apiKeyRunningVersion),
-		CheckForUpdateUseCase:       useCases.NewCheckForUpdateUseCase(env.feed, env.updates, apiKeyRunningVersion, clock),
-		CreateAPIKeyUseCase:         useCases.NewCreateAPIKeyUseCase(env.keys, env.generator, clock, discardRecorder),
+		CheckForUpdateUseCase:       useCases.NewCheckForUpdateUseCase(env.feed, env.updates, apiKeyRunningVersion, clock, recorder),
+		CreateAPIKeyUseCase:         useCases.NewCreateAPIKeyUseCase(env.keys, env.generator, clock, recorder),
 		ListAPIKeysUseCase:          useCases.NewListAPIKeysUseCase(env.keys, env.users, clock),
-		RevokeAPIKeyUseCase:         useCases.NewRevokeAPIKeyUseCase(env.keys, env.users, clock, discardRecorder),
+		RevokeAPIKeyUseCase:         useCases.NewRevokeAPIKeyUseCase(env.keys, env.users, clock, recorder),
 		AuthenticateAPIKeyUseCase:   useCases.NewAuthenticateAPIKeyUseCase(env.keys, env.generator, env.users, clock),
 	}
 	router := chi.NewRouter()

test/article_body_format_test.go

@@ -43,11 +43,11 @@ const (
 func newBodyFormatRouter(articleRepo *mockArticleRepo, userRepo *mockUserRepo, renderer domainArticle.BodyRenderer, token *jwtauth.JWTAuth) *chi.Mux {
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, renderer),
+		useCases.NewCreateArticleUseCase(articleRepo, renderer, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, renderer),
 		useCases.NewListArticlesUseCase(articleRepo, renderer),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, renderer),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, renderer, discardRecorder),
 		getUserUseCase,
 	)
 

test/article_publishing_http_test.go

@@ -23,11 +23,11 @@ func newArticlePublishingRouter(articleRepo *mockArticleRepo, token *jwtauth.JWT
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 

test/article_test.go

@@ -148,11 +148,11 @@ var _ article.Repository = &mockArticleRepo{}
 
 func TestCreateArticle(t *testing.T) {
 	repo := newMockArticleRepo()
-	uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{})
+	uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
 
 	t.Run("Valid Title", func(t *testing.T) {
 		cmd := useCases.CreateArticleCommand{Title: "Valid Title", Body: "Content"}
-		res, err := uc.CreateArticle(cmd)
+		res, err := uc.CreateArticle(testCtx, cmd)
 		if err != nil {
 			t.Fatalf("Expected no error, got %v", err)
 		}
@@ -163,7 +163,7 @@ func TestCreateArticle(t *testing.T) {
 
 	t.Run("Short Title", func(t *testing.T) {
 		cmd := useCases.CreateArticleCommand{Title: "Ab", Body: "Content"}
-		_, err := uc.CreateArticle(cmd)
+		_, err := uc.CreateArticle(testCtx, cmd)
 		if !errors.Is(err, article.ErrInvalidTitle) {
 			t.Errorf("Expected ErrInvalidTitle")
 		}

test/article_title_rules_test.go

@@ -26,11 +26,11 @@ func newArticleTitleRulesRouter(repo *mockArticleRepo, token *jwtauth.JWTAuth) *
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(repo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(repo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(repo),
-		useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(repo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 
@@ -87,10 +87,10 @@ func TestArticleTitleRunesInUseCase(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(fmt.Sprintf("rune_count_%d", tc.runeCount), func(t *testing.T) {
 			repo := newMockArticleRepo()
-			uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{})
+			uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
 
 			title := strings.Repeat("\U0001F600", tc.runeCount)
-			result, err := uc.CreateArticle(useCases.CreateArticleCommand{Title: title, Body: "Some body text"})
+			result, err := uc.CreateArticle(testCtx, useCases.CreateArticleCommand{Title: title, Body: "Some body text"})
 
 			if tc.created {
 				if err != nil {

test/articles_list_http_test.go

@@ -20,11 +20,11 @@ func newArticlesListRouter(articleRepo *mockArticleRepo, token *jwtauth.JWTAuth)
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 

test/cancel_pending_registration_http_test.go

@@ -19,12 +19,12 @@ func newCancelRegistrationRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo,
 	hasher := &stubHasher{}
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)
 	verificationHandler := auth.NewVerificationHandler(
-		useCases.NewVerifyUserUseCase(userRepo, hasher),
+		useCases.NewVerifyUserUseCase(userRepo, hasher, discardRecorder),
 		useCases.NewCancelRegistrationUseCase(userRepo),
 		true,
 	)

test/container_update_guidance_http_test.go

@@ -52,17 +52,18 @@ func newContainerHarness(t *testing.T, container bool, helperInstalled bool) *co
 		Platform:       rig.platform,
 		FeedURL:        downloadFeedURL,
 		Now:            now,
+		Recorder:       discardRecorder,
 	})
 	routes := &api.UseCases{
 		Token:                      token,
 		GetUserUseCase:             useCases.NewGetUserUseCase(newUpdateUserRepo()),
 		GetUpdateStatusUseCase:     useCases.NewGetUpdateStatusUseCase(rig.store, rig.jobs, helper, rig.results, rig.requests, updateRunning, container, now),
-		CheckForUpdateUseCase:      useCases.NewCheckForUpdateUseCase(feed, rig.store, updateRunning, now),
+		CheckForUpdateUseCase:      useCases.NewCheckForUpdateUseCase(feed, rig.store, updateRunning, now, discardRecorder),
 		StartUpdateDownloadUseCase: start,
-		RequestRestartUseCase:      useCases.NewRequestRestartUseCase(rig.store, rig.jobs, helper, rig.results, rig.requests, updateRunning, now),
+		RequestRestartUseCase:      useCases.NewRequestRestartUseCase(rig.store, rig.jobs, helper, rig.results, rig.requests, updateRunning, now, discardRecorder),
 	}
 	return &containerHarness{
-		updateHarness: &updateHarness{router: api.NewSystemRouter(routes), token: token, feed: feed, store: rig.store},
+		updateHarness: &updateHarness{router: api.NewSystemRouter(routes, nil), token: token, feed: feed, store: rig.store},
 		fetcher:       rig.fetcher,
 		requests:      rig.requests,
 		jobs:          rig.jobs,

test/edit_article_body_http_test.go

@@ -24,11 +24,11 @@ func newEditArticleBodyRouter(articleRepo *mockArticleRepo, token *jwtauth.JWTAu
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 

test/get_current_user_http_test.go

@@ -21,7 +21,7 @@ func newGetCurrentUserRouter(userRepo *mockUserRepo, hasher *stubHasher, token *
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 	meHandler := auth.NewMeHandler(getUserUseCase)
 	verificationHandler := auth.NewVerificationHandler(
-		useCases.NewVerifyUserUseCase(userRepo, hasher),
+		useCases.NewVerifyUserUseCase(userRepo, hasher, discardRecorder),
 		useCases.NewCancelRegistrationUseCase(userRepo),
 		true,
 	)

test/hasher_test.go

@@ -34,9 +34,9 @@ func (s *spyHasher) Compare(hashed string, value string) error {
 func TestCreateUserUseCaseHashesPasswordAndVerificationCode(t *testing.T) {
 	t.Run("stores hashed password and hashed verification code, returns raw code", func(t *testing.T) {
 		repo := newMockUserRepo()
-		uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com", discardRecorder)
 
-		result, err := uc.CreateUser(useCases.CreateUserCommand{
+		result, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "alice",
 			Password: "s3cretPassw0rd",
 			Email:    "alice@example.com",
@@ -59,9 +59,9 @@ func TestCreateUserUseCaseHashesPasswordAndVerificationCode(t *testing.T) {
 
 	t.Run("a hashing failure persists nothing", func(t *testing.T) {
 		repo := newMockUserRepo()
-		uc := useCases.NewCreateUserUseCase(repo, &stubHasher{hashErr: errStubHashFailure}, newMockMailRepo(), "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(repo, &stubHasher{hashErr: errStubHashFailure}, newMockMailRepo(), "https://cms.example.com", discardRecorder)
 
-		_, err := uc.CreateUser(useCases.CreateUserCommand{
+		_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "alice",
 			Password: "s3cretPassw0rd",
 			Email:    "alice@example.com",
@@ -156,7 +156,7 @@ func newHasherRouter(userRepo *mockUserRepo, hasher *stubHasher) *chi.Mux {
 	token := jwtauth.New("HS256", []byte("test-secret"), nil)
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)
@@ -174,7 +174,7 @@ func newRealHasherRouter(userRepo *mockUserRepo) *chi.Mux {
 	hasher := hashing.NewBcryptHasher()
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)

test/image_test.go

@@ -249,8 +249,8 @@ var _ imageDomain.Repository = &mockImageRepo{}
 
 func TestImageUseCases(t *testing.T) {
 	repo := newMockImageRepo()
-	createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
-	deleteUc := useCases.NewDeleteMediaUseCase(repo, newMockImageStorage())
+	createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
+	deleteUc := useCases.NewDeleteMediaUseCase(repo, newMockImageStorage(), discardRecorder)
 
 	t.Run("Create Image", func(t *testing.T) {
 		input := imageDomain.ImageInput{
@@ -259,7 +259,7 @@ func TestImageUseCases(t *testing.T) {
 			ContentType: "image/png",
 		}
 
-		res, err := createUc.CreateImage(input)
+		res, err := createUc.CreateImage(testCtx, input)
 		if err != nil {
 			t.Fatalf("CreateImage failed: %v", err)
 		}
@@ -274,7 +274,7 @@ func TestImageUseCases(t *testing.T) {
 	t.Run("Delete Image", func(t *testing.T) {
 		repo.images[99] = imageDomain.Image{ID: 99, Path: "/static/delete-me.png"}
 
-		err := deleteUc.Delete(99)
+		err := deleteUc.Delete(testCtx, 99)
 		if err != nil {
 			t.Fatalf("Delete failed: %v", err)
 		}
@@ -285,7 +285,7 @@ func TestImageUseCases(t *testing.T) {
 	})
 
 	t.Run("Delete unknown image", func(t *testing.T) {
-		if err := deleteUc.Delete(12345); !errors.Is(err, imageDomain.ErrImageNotFound) {
+		if err := deleteUc.Delete(testCtx, 12345); !errors.Is(err, imageDomain.ErrImageNotFound) {
 			t.Errorf("expected ErrImageNotFound, got %v", err)
 		}
 	})

test/image_upload_rules_test.go

@@ -39,9 +39,9 @@ func TestImageUploadRules(t *testing.T) {
 		for _, contentType := range []string{"image/png", "image/jpeg", "image/webp", "image/svg+xml"} {
 			t.Run(contentType, func(t *testing.T) {
 				repo := newMockImageRepo()
-				createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+				createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
-				result, err := createUc.CreateImage(inputOf(paddedTo(validBytesFor(t, contentType), int(imageDomain.MaxImageSize)), contentType))
+				result, err := createUc.CreateImage(testCtx, inputOf(paddedTo(validBytesFor(t, contentType), int(imageDomain.MaxImageSize)), contentType))
 
 				if err != nil {
 					t.Fatalf("expected no error, got %v", err)
@@ -58,9 +58,9 @@ func TestImageUploadRules(t *testing.T) {
 
 	t.Run("CreateImage rejects a disallowed content type before reaching the repository", func(t *testing.T) {
 		repo := newMockImageRepo()
-		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
-		_, err := createUc.CreateImage(inputOf([]byte("%PDF"), "application/pdf"))
+		_, err := createUc.CreateImage(testCtx, inputOf([]byte("%PDF"), "application/pdf"))
 
 		if !errors.Is(err, imageDomain.ErrImageTypeNotAllowed) {
 			t.Fatalf("expected ErrImageTypeNotAllowed, got %v", err)
@@ -72,9 +72,9 @@ func TestImageUploadRules(t *testing.T) {
 
 	t.Run("CreateImage rejects a file that exceeds the size limit", func(t *testing.T) {
 		repo := newMockImageRepo()
-		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
-		_, err := createUc.CreateImage(inputOf(paddedTo(pngBytes(t, 3, 2), int(imageDomain.MaxImageSize)+1), "image/png"))
+		_, err := createUc.CreateImage(testCtx, inputOf(paddedTo(pngBytes(t, 3, 2), int(imageDomain.MaxImageSize)+1), "image/png"))
 
 		if !errors.Is(err, imageDomain.ErrImageTooLarge) {
 			t.Fatalf("expected ErrImageTooLarge, got %v", err)
@@ -86,9 +86,9 @@ func TestImageUploadRules(t *testing.T) {
 
 	t.Run("A file exactly at the size limit is accepted, one byte over is not", func(t *testing.T) {
 		repo := newMockImageRepo()
-		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
-		_, err := createUc.CreateImage(inputOf(paddedTo(pngBytes(t, 3, 2), int(imageDomain.MaxImageSize)), "image/png"))
+		_, err := createUc.CreateImage(testCtx, inputOf(paddedTo(pngBytes(t, 3, 2), int(imageDomain.MaxImageSize)), "image/png"))
 		if err != nil {
 			t.Fatalf("expected no error at the exact limit, got %v", err)
 		}
@@ -96,7 +96,7 @@ func TestImageUploadRules(t *testing.T) {
 			t.Fatalf("expected Create to be called once, got %d calls", len(repo.images))
 		}
 
-		_, err = createUc.CreateImage(inputOf(paddedTo(pngBytes(t, 3, 2), int(imageDomain.MaxImageSize)+1), "image/png"))
+		_, err = createUc.CreateImage(testCtx, inputOf(paddedTo(pngBytes(t, 3, 2), int(imageDomain.MaxImageSize)+1), "image/png"))
 		if !errors.Is(err, imageDomain.ErrImageTooLarge) {
 			t.Fatalf("expected ErrImageTooLarge, got %v", err)
 		}
@@ -108,9 +108,9 @@ func TestImageUploadRules(t *testing.T) {
 	t.Run("A repository failure unrelated to type or size still propagates unchanged", func(t *testing.T) {
 		repo := newMockImageRepo()
 		repo.fail.failNextWith("Create", errRepositoryFailure)
-		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+		createUc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
-		_, err := createUc.CreateImage(inputOf(pngBytes(t, 3, 2), "image/png"))
+		_, err := createUc.CreateImage(testCtx, inputOf(pngBytes(t, 3, 2), "image/png"))
 
 		if !errors.Is(err, errRepositoryFailure) {
 			t.Fatalf("expected the generic repository error, got %v", err)

test/invitations_test.go

@@ -152,7 +152,7 @@ func newInviteFixture(t *testing.T, maxAttempts int) *inviteFixture {
 	}
 	getUser := useCases.NewGetUserUseCase(f.users)
 	handler := userhandler.NewInviteHandler(
-		useCases.NewCreateInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL),
+		useCases.NewCreateInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL, discardRecorder),
 		nil,
 		nil,
 		useCases.NewListUsersAndInvitesUseCase(f.users, f.invites),
@@ -536,7 +536,7 @@ func TestInvitationsDoNotChangeRegistration(t *testing.T) {
 		hasher := &stubHasher{}
 		handler := auth.NewLoginHandler(
 			jwtauth.New("HS256", []byte("test-secret"), nil),
-			useCases.NewCreateUserUseCase(users, hasher, mail, invitePublicURL),
+			useCases.NewCreateUserUseCase(users, hasher, mail, invitePublicURL, discardRecorder),
 			useCases.NewAuthenticateUserUseCase(users, hasher, discardRecorder),
 			true,
 		)
@@ -601,12 +601,12 @@ func TestInvitationsDoNotChangeRegistration(t *testing.T) {
 func TestCreateInviteUseCase(t *testing.T) {
 	newUseCase := func() (*useCases.CreateInviteUseCase, *mockUserRepo, *inviteFakeRepo, *mockMailRepo, *stubHasher) {
 		users, invites, mail, hasher := inviteInviterRepo("Marta A"), newInviteFakeRepo(), newMockMailRepo(), &stubHasher{}
-		return useCases.NewCreateInviteUseCase(users, invites, hasher, mail, invitePublicURL), users, invites, mail, hasher
+		return useCases.NewCreateInviteUseCase(users, invites, hasher, mail, invitePublicURL, discardRecorder), users, invites, mail, hasher
 	}
 
 	t.Run("lower-cases the email and returns the stored invite", func(t *testing.T) {
 		uc, _, _, _, _ := newUseCase()
-		got, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "A@B.Example", InvitedBy: 7})
+		got, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "A@B.Example", InvitedBy: 7})
 		if err != nil || got.Email != "a@b.example" || got.ID == 0 {
 			t.Fatalf("unexpected result %+v, %v", got, err)
 		}
@@ -614,7 +614,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 
 	t.Run("unknown inviter", func(t *testing.T) {
 		uc, _, invites, _, _ := newUseCase()
-		_, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 99})
+		_, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 99})
 		if !errors.Is(err, user.ErrUserNotFound) || len(invites.invites) != 0 {
 			t.Errorf("expected ErrUserNotFound, got %v", err)
 		}
@@ -623,7 +623,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 	t.Run("existing account is refused case-insensitively", func(t *testing.T) {
 		uc, users, _, _, _ := newUseCase()
 		users.users[8] = user.User{ID: 8, Email: "Jonas@Renew.example"}
-		_, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "jonas@renew.example", InvitedBy: 7})
+		_, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "jonas@renew.example", InvitedBy: 7})
 		if !errors.Is(err, invite.ErrEmailHasAccount) {
 			t.Errorf("expected ErrEmailHasAccount, got %v", err)
 		}
@@ -632,7 +632,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 	t.Run("pending invite is refused", func(t *testing.T) {
 		uc, _, invites, _, _ := newUseCase()
 		invites.seed(pendingInvite("a@b.example"))
-		_, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
+		_, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
 		if !errors.Is(err, invite.ErrPendingInvite) {
 			t.Errorf("expected ErrPendingInvite, got %v", err)
 		}
@@ -645,7 +645,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 		accepted.AcceptedAt = &acceptedAt
 		invites.seed(accepted)
 		invites.seed(pendingInvite("other@b.example"))
-		if _, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7}); err != nil {
+		if _, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7}); err != nil {
 			t.Errorf("unexpected error %v", err)
 		}
 		if len(invites.invites) != 3 {
@@ -656,7 +656,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 	t.Run("hash failure stores and sends nothing", func(t *testing.T) {
 		uc, _, invites, mail, hasher := newUseCase()
 		hasher.hashErr = errors.New("hash boom")
-		_, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
+		_, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
 		if err == nil || len(invites.invites) != 0 || len(mail.SentEmails) != 0 {
 			t.Errorf("expected failure without side effects, got %v", err)
 		}
@@ -666,7 +666,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 		uc, _, invites, mail, _ := newUseCase()
 		invites.seed(expiredInvite("a@b.example"))
 		invites.fail.failNext("Delete")
-		_, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
+		_, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
 		if !errors.Is(err, errRepositoryFailure) || len(mail.SentEmails) != 0 {
 			t.Errorf("expected repository failure, got %v", err)
 		}
@@ -676,7 +676,7 @@ func TestCreateInviteUseCase(t *testing.T) {
 		uc, _, invites, mail, _ := newUseCase()
 		mail.fail.failNextWith("Send", errors.New("smtp down"))
 		invites.fail.failNextWith("Delete", errors.New("cleanup down"))
-		_, err := uc.CreateInvite(useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
+		_, err := uc.CreateInvite(testCtx, useCases.CreateInviteCommand{Email: "a@b.example", InvitedBy: 7})
 		if !errors.Is(err, invite.ErrInviteEmailNotSent) || !strings.Contains(err.Error(), "smtp down") || !strings.Contains(err.Error(), "cleanup down") {
 			t.Errorf("unexpected error %v", err)
 		}

test/invite_management_test.go

@@ -55,14 +55,14 @@ func newInviteManagementFixture(t *testing.T, maxAttempts int) *inviteManagement
 
 	getUser := useCases.NewGetUserUseCase(f.users)
 	handler := userhandler.NewInviteHandler(
-		useCases.NewCreateInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL),
-		useCases.NewCancelInviteUseCase(f.invites),
-		useCases.NewRenewInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL),
+		useCases.NewCreateInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL, discardRecorder),
+		useCases.NewCancelInviteUseCase(f.invites, discardRecorder),
+		useCases.NewRenewInviteUseCase(f.users, f.invites, f.hasher, f.mail, invitePublicURL, discardRecorder),
 		useCases.NewListUsersAndInvitesUseCase(f.users, f.invites),
 	)
 	acceptHandler := auth.NewAcceptInviteHandler(
 		useCases.NewGetInviteUseCase(f.invites, f.hasher),
-		useCases.NewAcceptInviteUseCase(f.users, f.invites, f.hasher),
+		useCases.NewAcceptInviteUseCase(f.users, f.invites, f.hasher, discardRecorder),
 		f.token,
 		true,
 	)
@@ -480,9 +480,9 @@ func TestManageInviteUseCases(t *testing.T) {
 		mail := newMockMailRepo()
 		seeded := invites.seed(pendingInvite("a@renew.example"))
 		mail.fail.failNextWith("Send", errors.New("smtp down"))
-		renew := useCases.NewRenewInviteUseCase(users, invites, &stubHasher{}, mail, invitePublicURL)
+		renew := useCases.NewRenewInviteUseCase(users, invites, &stubHasher{}, mail, invitePublicURL, discardRecorder)
 
-		_, err := renew.RenewInvite(useCases.RenewInviteCommand{ID: 1, RenewedBy: 7})
+		_, err := renew.RenewInvite(testCtx, useCases.RenewInviteCommand{ID: 1, RenewedBy: 7})
 
 		if !errors.Is(err, invite.ErrInviteEmailNotSent) || errors.Is(err, errRepositoryFailure) || invites.invites[1] != seeded {
 			t.Errorf("unexpected result %v", err)
@@ -495,9 +495,9 @@ func TestManageInviteUseCases(t *testing.T) {
 		mail := newMockMailRepo()
 		invites.seed(pendingInvite("a@renew.example"))
 		mail.fail.failNextWith("Send", errors.New("smtp down"))
-		renew := useCases.NewRenewInviteUseCase(users, &renewRestoreFailRepo{inviteFakeRepo: invites}, &stubHasher{}, mail, invitePublicURL)
+		renew := useCases.NewRenewInviteUseCase(users, &renewRestoreFailRepo{inviteFakeRepo: invites}, &stubHasher{}, mail, invitePublicURL, discardRecorder)
 
-		_, err := renew.RenewInvite(useCases.RenewInviteCommand{ID: 1, RenewedBy: 7})
+		_, err := renew.RenewInvite(testCtx, useCases.RenewInviteCommand{ID: 1, RenewedBy: 7})
 
 		if !errors.Is(err, invite.ErrInviteEmailNotSent) || !errors.Is(err, errRepositoryFailure) {
 			t.Errorf("unexpected result %v", err)
@@ -511,15 +511,15 @@ func TestManageInviteUseCases(t *testing.T) {
 		at := time.Now()
 		accepted.AcceptedAt = &at
 		invites.seed(accepted)
-		cancel := useCases.NewCancelInviteUseCase(invites)
+		cancel := useCases.NewCancelInviteUseCase(invites, discardRecorder)
 
-		if err := cancel.CancelInvite(9); !errors.Is(err, invite.ErrInviteNotFound) {
+		if err := cancel.CancelInvite(testCtx, 9); !errors.Is(err, invite.ErrInviteNotFound) {
 			t.Errorf("expected not found, got %v", err)
 		}
-		if err := cancel.CancelInvite(2); !errors.Is(err, invite.ErrInviteAlreadyAccepted) {
+		if err := cancel.CancelInvite(testCtx, 2); !errors.Is(err, invite.ErrInviteAlreadyAccepted) {
 			t.Errorf("expected already accepted, got %v", err)
 		}
-		if err := cancel.CancelInvite(1); err != nil {
+		if err := cancel.CancelInvite(testCtx, 1); err != nil {
 			t.Errorf("unexpected %v", err)
 		}
 	})
@@ -530,9 +530,9 @@ func TestManageInviteUseCases(t *testing.T) {
 		mail := newMockMailRepo()
 		seeded := invites.seed(pendingInvite("a@renew.example"))
 		invites.fail.failNextWith("Renew", errRepositoryFailure)
-		renew := useCases.NewRenewInviteUseCase(users, invites, &stubHasher{}, mail, invitePublicURL)
+		renew := useCases.NewRenewInviteUseCase(users, invites, &stubHasher{}, mail, invitePublicURL, discardRecorder)
 
-		_, err := renew.RenewInvite(useCases.RenewInviteCommand{ID: 1, RenewedBy: 7})
+		_, err := renew.RenewInvite(testCtx, useCases.RenewInviteCommand{ID: 1, RenewedBy: 7})
 
 		if !errors.Is(err, errRepositoryFailure) || len(mail.SentEmails) != 0 || invites.invites[1] != seeded {
 			t.Errorf("unexpected result %v", err)
@@ -544,9 +544,9 @@ func TestManageInviteUseCases(t *testing.T) {
 		invites := newInviteFakeRepo()
 		mail := newMockMailRepo()
 		invites.seed(pendingInvite("a@renew.example"))
-		renew := useCases.NewRenewInviteUseCase(users, invites, &stubHasher{}, mail, invitePublicURL)
+		renew := useCases.NewRenewInviteUseCase(users, invites, &stubHasher{}, mail, invitePublicURL, discardRecorder)
 
-		if _, err := renew.RenewInvite(useCases.RenewInviteCommand{ID: 1, RenewedBy: 7}); err != nil {
+		if _, err := renew.RenewInvite(testCtx, useCases.RenewInviteCommand{ID: 1, RenewedBy: 7}); err != nil {
 			t.Fatalf("unexpected %v", err)
 		}
 		if inviteMailData(t, mail).InvitedBy != "Marta L." {

test/login_and_password_reset_rate_limiting_http_test.go

@@ -36,7 +36,7 @@ func newRateLimitedAuthRouter(t *testing.T, userRepo user.Repository, mailRepo *
 	token := jwtauth.New("HS256", []byte("test-secret"), nil)
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)

test/login_logout_cookie_test.go

@@ -19,7 +19,7 @@ func newLoginLogoutCookieRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo,
 	hasher := &stubHasher{}
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)

test/media_cleanup_test.go

@@ -60,9 +60,9 @@ func TestMediaMergeRewritesArticlesInIdOrder(t *testing.T) {
 		env.seedArticle(id, "Article", true, env.urlOf(3))
 	}
 	recorder := &mediaOrderRecordingArticleRepo{mockArticleRepo: env.articles}
-	uc := useCases.NewMergeMediaUseCase(env.images, recorder, env.storage)
+	uc := useCases.NewMergeMediaUseCase(env.images, recorder, env.storage, discardRecorder)
 
-	if _, err := uc.Merge(2, []uint32{3}); err != nil {
+	if _, err := uc.Merge(testCtx, 2, []uint32{3}); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 

test/media_env_test.go

@@ -60,26 +60,26 @@ func newMediaEnv(t *testing.T) *mediaEnv {
 	env.users.users[mediaUnverifiedUserId] = user.User{ID: 3, Username: "pending", IsVerified: false}
 	env.users.users[mediaStaleUserId] = user.User{ID: 4, Username: "stale", IsVerified: true, TokenVersion: 1}
 
-	merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
+	merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
 	now := func() time.Time { return env.clock }
 	container := &api.UseCases{
 		Token:                      env.token,
-		CreateArticleUseCase:       useCases.NewCreateArticleUseCase(env.articles, &fakeBodyRenderer{}),
+		CreateArticleUseCase:       useCases.NewCreateArticleUseCase(env.articles, &fakeBodyRenderer{}, discardRecorder),
 		GetArticleUseCase:          useCases.NewGetArticleUseCase(env.articles, &fakeBodyRenderer{}),
 		ListArticlesUseCase:        useCases.NewListArticlesUseCase(env.articles, &fakeBodyRenderer{}),
-		UpdateArticleUseCase:       useCases.NewUpdateArticleUseCase(env.articles, &fakeBodyRenderer{}),
-		DeleteArticleUseCase:       useCases.NewDeleteArticleUseCase(env.articles),
+		UpdateArticleUseCase:       useCases.NewUpdateArticleUseCase(env.articles, &fakeBodyRenderer{}, discardRecorder),
+		DeleteArticleUseCase:       useCases.NewDeleteArticleUseCase(env.articles, discardRecorder),
 		GetUserUseCase:             useCases.NewGetUserUseCase(env.users),
-		CreateImageUseCase:         useCases.NewCreateImageUseCase(env.images, env.storage),
+		CreateImageUseCase:         useCases.NewCreateImageUseCase(env.images, env.storage, discardRecorder),
 		ListMediaUseCase:           useCases.NewListMediaUseCase(env.images, env.articles, env.users),
-		RenameMediaUseCase:         useCases.NewRenameMediaUseCase(env.images),
-		DeleteMediaUseCase:         useCases.NewDeleteMediaUseCase(env.images, env.storage),
+		RenameMediaUseCase:         useCases.NewRenameMediaUseCase(env.images, discardRecorder),
+		DeleteMediaUseCase:         useCases.NewDeleteMediaUseCase(env.images, env.storage, discardRecorder),
 		MergeMediaUseCase:          merge,
 		GetMediaUsageUseCase:       useCases.NewGetMediaUsageUseCase(env.images, env.articles),
 		GetPurgeSettingsUseCase:    useCases.NewGetPurgeSettingsUseCase(env.purgeSettings),
 		UpdatePurgeSettingsUseCase: useCases.NewUpdatePurgeSettingsUseCase(env.purgeSettings, now),
 		PreviewPurgeUseCase:        useCases.NewPreviewPurgeUseCase(env.images, env.articles),
-		RunPurgeUseCase:            useCases.NewRunPurgeUseCase(env.images, env.articles, merge, env.purgeSettings, now, log.New(env.logs, "", 0)),
+		RunPurgeUseCase:            useCases.NewRunPurgeUseCase(env.images, env.articles, merge, env.purgeSettings, now, log.New(env.logs, "", 0), discardRecorder),
 	}
 	router := chi.NewRouter()
 	router.Mount("/v1", api.InitBackendRoutes(container, config.Settings{}))

test/media_library_http_test.go

@@ -947,9 +947,9 @@ func TestMediaMerging(t *testing.T) {
 
 	t.Run("A duplicated id reaching the use case is refused before anything is read", func(t *testing.T) {
 		env := newEnv(t)
-		uc := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
+		uc := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
 
-		_, err := uc.Merge(2, []uint32{3, 3})
+		_, err := uc.Merge(testCtx, 2, []uint32{3, 3})
 
 		if !errors.Is(err, domainImage.ErrInvalidMergeRequest) {
 			t.Errorf("expected ErrInvalidMergeRequest, got %v", err)
@@ -996,10 +996,10 @@ func TestMediaMerging(t *testing.T) {
 
 func TestMediaSentinels(t *testing.T) {
 	t.Run("Create reports unreadable bytes as ErrImageUnreadable", func(t *testing.T) {
-		uc := useCases.NewCreateImageUseCase(newMockImageRepo(), newMockImageStorage())
+		uc := useCases.NewCreateImageUseCase(newMockImageRepo(), newMockImageStorage(), discardRecorder)
 
 		for _, contentType := range domainImage.AllowedContentTypes() {
-			_, err := uc.CreateImage(inputOf([]byte("not an image"), contentType))
+			_, err := uc.CreateImage(testCtx, inputOf([]byte("not an image"), contentType))
 			if !errors.Is(err, domainImage.ErrImageUnreadable) {
 				t.Errorf("%s: expected ErrImageUnreadable, got %v", contentType, err)
 			}
@@ -1007,9 +1007,9 @@ func TestMediaSentinels(t *testing.T) {
 	})
 
 	t.Run("An svg without an svg root is unreadable", func(t *testing.T) {
-		uc := useCases.NewCreateImageUseCase(newMockImageRepo(), newMockImageStorage())
+		uc := useCases.NewCreateImageUseCase(newMockImageRepo(), newMockImageStorage(), discardRecorder)
 
-		_, err := uc.CreateImage(inputOf([]byte("<html/>"), "image/svg+xml"))
+		_, err := uc.CreateImage(testCtx, inputOf([]byte("<html/>"), "image/svg+xml"))
 
 		if !errors.Is(err, domainImage.ErrImageUnreadable) {
 			t.Errorf("expected ErrImageUnreadable, got %v", err)
@@ -1017,9 +1017,9 @@ func TestMediaSentinels(t *testing.T) {
 	})
 
 	t.Run("Bytes of another raster format than the declared type are unreadable", func(t *testing.T) {
-		uc := useCases.NewCreateImageUseCase(newMockImageRepo(), newMockImageStorage())
+		uc := useCases.NewCreateImageUseCase(newMockImageRepo(), newMockImageStorage(), discardRecorder)
 
-		_, err := uc.CreateImage(inputOf(jpegBytes(t, 3, 2), "image/png"))
+		_, err := uc.CreateImage(testCtx, inputOf(jpegBytes(t, 3, 2), "image/png"))
 
 		if !errors.Is(err, domainImage.ErrImageUnreadable) {
 			t.Errorf("expected ErrImageUnreadable, got %v", err)
@@ -1029,9 +1029,9 @@ func TestMediaSentinels(t *testing.T) {
 	t.Run("Rename reports an invalid stem as ErrInvalidFilename", func(t *testing.T) {
 		repo := newMockImageRepo()
 		repo.images[1] = domainImage.Image{ID: 1, Filename: "a.png"}
-		uc := useCases.NewRenameMediaUseCase(repo)
+		uc := useCases.NewRenameMediaUseCase(repo, discardRecorder)
 
-		if _, err := uc.Rename(1, "a b"); !errors.Is(err, domainImage.ErrInvalidFilename) {
+		if _, err := uc.Rename(testCtx, 1, "a b"); !errors.Is(err, domainImage.ErrInvalidFilename) {
 			t.Errorf("expected ErrInvalidFilename, got %v", err)
 		}
 	})
@@ -1042,15 +1042,15 @@ func TestMediaSentinels(t *testing.T) {
 		env.seedImage(2, "b.png", 1, "image/png", 1, 1, hashB, 1)
 		env.seedImage(3, "c.png", 1, "image/png", 1, 1, "", 1)
 		env.seedImage(4, "d.png", 1, "image/png", 1, 1, "", 1)
-		uc := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
+		uc := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
 
-		if _, err := uc.Merge(1, []uint32{9999}); !errors.Is(err, domainImage.ErrMergeCopyMissing) {
+		if _, err := uc.Merge(testCtx, 1, []uint32{9999}); !errors.Is(err, domainImage.ErrMergeCopyMissing) {
 			t.Errorf("expected ErrMergeCopyMissing, got %v", err)
 		}
-		if _, err := uc.Merge(1, []uint32{2}); !errors.Is(err, domainImage.ErrMergeHashMismatch) {
+		if _, err := uc.Merge(testCtx, 1, []uint32{2}); !errors.Is(err, domainImage.ErrMergeHashMismatch) {
 			t.Errorf("expected ErrMergeHashMismatch, got %v", err)
 		}
-		if _, err := uc.Merge(3, []uint32{4}); !errors.Is(err, domainImage.ErrMergeHashMismatch) {
+		if _, err := uc.Merge(testCtx, 3, []uint32{4}); !errors.Is(err, domainImage.ErrMergeHashMismatch) {
 			t.Errorf("expected images without a hash never to merge, got %v", err)
 		}
 	})

test/media_purge_scheduler_test.go

@@ -31,13 +31,13 @@ type schedulerEnv struct {
 func newSchedulerEnv(t *testing.T) *schedulerEnv {
 	t.Helper()
 	env := newPurgeEnv(t)
-	merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
+	merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
 	now := func() time.Time { return env.clock }
-	runPurge := useCases.NewRunPurgeUseCase(env.images, env.articles, merge, env.purgeSettings, now, log.New(env.logs, "", 0))
+	runPurge := useCases.NewRunPurgeUseCase(env.images, env.articles, merge, env.purgeSettings, now, log.New(env.logs, "", 0), discardRecorder)
 	return &schedulerEnv{
 		mediaEnv:  env,
 		runPurge:  runPurge,
-		scheduler: useCases.NewPurgeSchedulerUseCase(env.purgeSettings, runPurge),
+		scheduler: useCases.NewPurgeSchedulerUseCase(env.purgeSettings, runPurge, discardRecorder),
 		update:    useCases.NewUpdatePurgeSettingsUseCase(env.purgeSettings, now),
 	}
 }
@@ -326,7 +326,7 @@ func TestPurgeRunKeepsSettingsChangedWhileItRuns(t *testing.T) {
 		}
 		runDone := make(chan error, 1)
 		go func() {
-			_, err := env.runPurge.Run(nil)
+			_, err := env.runPurge.Run(testCtx, nil)
 			runDone <- err
 		}()
 		waitFor(t, writing)
@@ -430,7 +430,7 @@ func TestPurgeSchedulerFailures(t *testing.T) {
 		}
 		manualDone := make(chan error, 1)
 		go func() {
-			_, err := env.runPurge.Run(nil)
+			_, err := env.runPurge.Run(testCtx, nil)
 			manualDone <- err
 		}()
 		waitFor(t, entered)

test/media_purge_test.go

@@ -32,8 +32,8 @@ func TestUpdatePurgeSettingsRejectsOutOfRangeIntervals(t *testing.T) {
 
 func TestRunPurgeDistinguishesBusyFromConflict(t *testing.T) {
 	newRun := func(env *mediaEnv) *useCases.RunPurgeUseCase {
-		merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
-		return useCases.NewRunPurgeUseCase(env.images, env.articles, merge, env.purgeSettings, func() time.Time { return env.clock }, log.New(&bytes.Buffer{}, "", 0))
+		merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
+		return useCases.NewRunPurgeUseCase(env.images, env.articles, merge, env.purgeSettings, func() time.Time { return env.clock }, log.New(&bytes.Buffer{}, "", 0), discardRecorder)
 	}
 
 	t.Run("a non-matching fingerprint is a conflict and writes nothing", func(t *testing.T) {
@@ -42,7 +42,7 @@ func TestRunPurgeDistinguishesBusyFromConflict(t *testing.T) {
 		env.useImages(10, 1)
 		wrong := "wrong"
 
-		_, err := newRun(env).Run(&wrong)
+		_, err := newRun(env).Run(testCtx, &wrong)
 
 		if !errors.Is(err, purge.ErrPurgeConflict) || errors.Is(err, purge.ErrPurgeBusy) {
 			t.Errorf("expected only ErrPurgeConflict, got %v", err)
@@ -68,13 +68,13 @@ func TestRunPurgeDistinguishesBusyFromConflict(t *testing.T) {
 		run := newRun(env)
 		done := make(chan error, 1)
 		go func() {
-			_, err := run.Run(nil)
+			_, err := run.Run(testCtx, nil)
 			done <- err
 		}()
 		<-entered
 		savesBefore := env.purgeSettings.saveCalls
 
-		_, err := run.Run(nil)
+		_, err := run.Run(testCtx, nil)
 
 		if !errors.Is(err, purge.ErrPurgeBusy) || errors.Is(err, purge.ErrPurgeConflict) {
 			t.Errorf("expected only ErrPurgeBusy, got %v", err)
@@ -93,7 +93,7 @@ func TestRunPurgeDistinguishesBusyFromConflict(t *testing.T) {
 		env.seedGroup(hashA, 1, 2)
 		env.useImages(10, 1)
 
-		result, err := newRun(env).Run(nil)
+		result, err := newRun(env).Run(testCtx, nil)
 
 		if err != nil || result != (purge.RunResult{GroupsTotal: 1, GroupsPurged: 1, Merged: 1}) {
 			t.Errorf("unexpected result %+v, %v", result, err)
@@ -148,9 +148,9 @@ func TestMergeMediaExposesTheRewrittenArticleIds(t *testing.T) {
 		env.useImages(1, 2)
 		env.useImages(2, 1, 2)
 		env.useImages(3, 1)
-		merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
+		merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
 
-		result, err := merge.Merge(1, []uint32{2})
+		result, err := merge.Merge(testCtx, 1, []uint32{2})
 
 		if err != nil || result.Merged != 1 || result.ArticlesUpdated != 2 || !reflect.DeepEqual(result.UpdatedArticleIDs, []uint32{1, 2}) {
 			t.Errorf("unexpected result %+v, %v", result, err)
@@ -163,9 +163,9 @@ func TestMergeMediaExposesTheRewrittenArticleIds(t *testing.T) {
 		env.useImages(1, 2)
 		env.useImages(2, 2)
 		env.articles.failUpdateBodyFor = map[uint32]error{2: errRepositoryFailure}
-		merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage)
+		merge := useCases.NewMergeMediaUseCase(env.images, env.articles, env.storage, discardRecorder)
 
-		result, err := merge.Merge(1, []uint32{2})
+		result, err := merge.Merge(testCtx, 1, []uint32{2})
 
 		if err == nil || result.Merged != 0 || result.ArticlesUpdated != 0 || len(result.UpdatedArticleIDs) != 0 {
 			t.Errorf("unexpected result %+v, %v", result, err)

test/media_storage_orchestration_test.go

@@ -24,7 +24,7 @@ func pngUpload(t *testing.T) domainImage.ImageInput {
 
 func uploadPng(t *testing.T, uc *useCases.CreateImageUseCase) domainImage.Image {
 	t.Helper()
-	created, err := uc.CreateImage(pngUpload(t))
+	created, err := uc.CreateImage(testCtx, pngUpload(t))
 	if err != nil {
 		t.Fatalf("CreateImage failed: %v", err)
 	}
@@ -35,7 +35,7 @@ func TestCreateImageStoresTheBlobThenTheRow(t *testing.T) {
 	t.Run("The row points at the stored name and the blob holds the bytes", func(t *testing.T) {
 		repo, store := newMockImageRepo(), newMockImageStorage()
 
-		created := uploadPng(t, useCases.NewCreateImageUseCase(repo, store))
+		created := uploadPng(t, useCases.NewCreateImageUseCase(repo, store, discardRecorder))
 
 		if !strings.HasPrefix(created.Path, domainImage.PublicPathPrefix) {
 			t.Errorf("unexpected path %q", created.Path)
@@ -49,7 +49,7 @@ func TestCreateImageStoresTheBlobThenTheRow(t *testing.T) {
 		repo, store := newMockImageRepo(), newMockImageStorage()
 		store.failPut = errRepositoryFailure
 
-		_, err := useCases.NewCreateImageUseCase(repo, store).CreateImage(pngUpload(t))
+		_, err := useCases.NewCreateImageUseCase(repo, store, discardRecorder).CreateImage(testCtx, pngUpload(t))
 
 		if !errors.Is(err, errRepositoryFailure) || repo.createCalls != 0 {
 			t.Errorf("got %v with %d Create calls", err, repo.createCalls)
@@ -60,7 +60,7 @@ func TestCreateImageStoresTheBlobThenTheRow(t *testing.T) {
 		repo, store := newMockImageRepo(), newMockImageStorage()
 		repo.fail.failNextWith("Create", errRepositoryFailure)
 
-		_, err := useCases.NewCreateImageUseCase(repo, store).CreateImage(pngUpload(t))
+		_, err := useCases.NewCreateImageUseCase(repo, store, discardRecorder).CreateImage(testCtx, pngUpload(t))
 
 		if !errors.Is(err, errRepositoryFailure) {
 			t.Fatalf("expected the repository failure, got %v", err)
@@ -74,9 +74,9 @@ func TestCreateImageStoresTheBlobThenTheRow(t *testing.T) {
 func TestDeleteMediaRemovesTheBlobAndTheRow(t *testing.T) {
 	t.Run("Both disappear", func(t *testing.T) {
 		repo, store := newMockImageRepo(), newMockImageStorage()
-		created := uploadPng(t, useCases.NewCreateImageUseCase(repo, store))
+		created := uploadPng(t, useCases.NewCreateImageUseCase(repo, store, discardRecorder))
 
-		if err := useCases.NewDeleteMediaUseCase(repo, store).Delete(created.ID); err != nil {
+		if err := useCases.NewDeleteMediaUseCase(repo, store, discardRecorder).Delete(testCtx, created.ID); err != nil {
 			t.Fatalf("Delete failed: %v", err)
 		}
 		if len(store.blobs) != 0 || len(repo.images) != 0 {
@@ -87,7 +87,7 @@ func TestDeleteMediaRemovesTheBlobAndTheRow(t *testing.T) {
 	t.Run("An unknown id is ErrImageNotFound and touches no blob", func(t *testing.T) {
 		repo, store := newMockImageRepo(), newMockImageStorage()
 
-		err := useCases.NewDeleteMediaUseCase(repo, store).Delete(7)
+		err := useCases.NewDeleteMediaUseCase(repo, store, discardRecorder).Delete(testCtx, 7)
 
 		if !errors.Is(err, domainImage.ErrImageNotFound) || len(store.deleted) != 0 {
 			t.Errorf("got %v, deleted %v", err, store.deleted)
@@ -96,10 +96,10 @@ func TestDeleteMediaRemovesTheBlobAndTheRow(t *testing.T) {
 
 	t.Run("A blob failure keeps the row so the delete can be retried", func(t *testing.T) {
 		repo, store := newMockImageRepo(), newMockImageStorage()
-		created := uploadPng(t, useCases.NewCreateImageUseCase(repo, store))
+		created := uploadPng(t, useCases.NewCreateImageUseCase(repo, store, discardRecorder))
 		store.failDelete = errRepositoryFailure
 
-		err := useCases.NewDeleteMediaUseCase(repo, store).Delete(created.ID)
+		err := useCases.NewDeleteMediaUseCase(repo, store, discardRecorder).Delete(testCtx, created.ID)
 
 		if !errors.Is(err, errRepositoryFailure) || len(repo.images) != 1 || len(repo.deleteCalls) != 0 {
 			t.Errorf("got %v, rows=%d deleteCalls=%v", err, len(repo.images), repo.deleteCalls)
@@ -109,10 +109,10 @@ func TestDeleteMediaRemovesTheBlobAndTheRow(t *testing.T) {
 
 func TestMergeMediaRemovesTheMergedBlobs(t *testing.T) {
 	repo, articles, store := newMockImageRepo(), newMockArticleRepo(), newMockImageStorage()
-	create := useCases.NewCreateImageUseCase(repo, store)
+	create := useCases.NewCreateImageUseCase(repo, store, discardRecorder)
 	kept, copyOne, copyTwo := uploadPng(t, create), uploadPng(t, create), uploadPng(t, create)
 
-	result, err := useCases.NewMergeMediaUseCase(repo, articles, store).Merge(kept.ID, []uint32{copyOne.ID, copyTwo.ID})
+	result, err := useCases.NewMergeMediaUseCase(repo, articles, store, discardRecorder).Merge(testCtx, kept.ID, []uint32{copyOne.ID, copyTwo.ID})
 
 	if err != nil || result.Merged != 2 {
 		t.Fatalf("merge returned %+v, %v", result, err)

test/not_found_errors_test.go

@@ -126,17 +126,17 @@ func TestUserRepositoryReportsMissingUserAsDomainError(t *testing.T) {
 func newNotFoundErrorsRouter(articleRepo *mockArticleRepo, userRepo *mockUserRepo, token *jwtauth.JWTAuth) *chi.Mux {
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 	hasher := hashing.NewBcryptHasher()
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)

test/public_article_listing_test.go

@@ -42,11 +42,11 @@ func newPublicArticleListingRouter(articleRepo *mockArticleRepo, token *jwtauth.
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 

test/public_article_read_test.go

@@ -24,11 +24,11 @@ import (
 func newPublicArticleReadRouter(articleRepo *mockArticleRepo, userRepo *mockUserRepo, token *jwtauth.JWTAuth) *chi.Mux {
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 

test/registration_gate_and_verification_email_test.go

@@ -42,7 +42,7 @@ func newRegistrationGateRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, p
 	hasher := &stubHasher{}
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, publicURL),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, publicURL, discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)
@@ -218,9 +218,9 @@ func TestRegistrationGateAndVerificationEmailUseCase(t *testing.T) {
 		userRepo.nextID = 1
 		userRepo.fail.failNext("Create")
 		mailRepo := newMockMailRepo()
-		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder)
 
-		_, err := uc.CreateUser(useCases.CreateUserCommand{
+		_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "bob",
 			Password: "hunter2example12",
 			Email:    "bob@example.com",
@@ -240,9 +240,9 @@ func TestRegistrationGateAndVerificationEmailUseCase(t *testing.T) {
 		userRepo.users[2] = user.User{ID: 2, Username: "bob", Email: "bob@example.com", IsVerified: false}
 		userRepo.nextID = 2
 		mailRepo := newMockMailRepo()
-		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder)
 
-		result, err := uc.CreateUser(useCases.CreateUserCommand{
+		result, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "carol",
 			Password: "hunter2example12",
 			Email:    "carol@example.com",
@@ -268,9 +268,9 @@ func TestRegistrationGateAndVerificationEmailUseCase(t *testing.T) {
 	t.Run("A failure hashing the verification code persists nothing", func(t *testing.T) {
 		userRepo := newMockUserRepo()
 		mailRepo := newMockMailRepo()
-		uc := useCases.NewCreateUserUseCase(userRepo, &sequentialHasher{}, mailRepo, "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(userRepo, &sequentialHasher{}, mailRepo, "https://cms.example.com", discardRecorder)
 
-		_, err := uc.CreateUser(useCases.CreateUserCommand{
+		_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "alice",
 			Password: "hunter2example12",
 			Email:    "alice@example.com",
@@ -291,9 +291,9 @@ func TestRegistrationGateAndVerificationEmailUseCase(t *testing.T) {
 		userRepo := newMockUserRepo()
 		mailRepo := newMockMailRepo()
 		mailRepo.fail.failNext("Send")
-		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder)
 
-		_, err := uc.CreateUser(useCases.CreateUserCommand{
+		_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "alice",
 			Password: "hunter2example12",
 			Email:    "alice@example.com",
@@ -312,9 +312,9 @@ func TestRegistrationGateAndVerificationEmailUseCase(t *testing.T) {
 		mailRepo := newMockMailRepo()
 		mailRepo.fail.failNext("Send")
 		userRepo.fail.failNext("Delete")
-		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder)
 
-		_, err := uc.CreateUser(useCases.CreateUserCommand{
+		_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "alice",
 			Password: "hunter2example12",
 			Email:    "alice@example.com",

test/registration_status_endpoint_http_test.go

@@ -18,7 +18,7 @@ import (
 func newRegistrationStatusRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo) (*chi.Mux, *useCases.CreateUserUseCase) {
 	token := jwtauth.New("HS256", []byte("test-secret"), nil)
 	hasher := &stubHasher{}
-	createUseCase := useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com")
+	createUseCase := useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder)
 	loginHandler := auth.NewLoginHandler(token, createUseCase, useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true)
 
 	r := chi.NewRouter()
@@ -162,13 +162,13 @@ func TestRegistrationStatusEndpointHttp(t *testing.T) {
 		userRepo.users[1] = user.User{ID: 1, Username: "alice", Email: "alice@example.com", IsVerified: true}
 		userRepo.nextID = 1
 		mailRepo := newMockMailRepo()
-		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		uc := useCases.NewCreateUserUseCase(userRepo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder)
 
 		if uc.IsRegistrationOpen() {
 			t.Fatalf("expected IsRegistrationOpen to return false")
 		}
 
-		_, err := uc.CreateUser(useCases.CreateUserCommand{
+		_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 			Username: "bob",
 			Password: "hunter2example12",
 			Email:    "bob@example.com",

test/runtime_settings_injection_http_test.go

@@ -35,7 +35,7 @@ func newSecureCookieAuthRouter(t *testing.T, isProduction bool) (*chi.Mux, *mock
 
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		isProduction,
 	)
@@ -129,22 +129,22 @@ func newRuntimeSettingsContainer(t *testing.T) *api.UseCases {
 
 	return &api.UseCases{
 		Token:                     token,
-		CreateArticleUseCase:      useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		CreateArticleUseCase:      useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		GetArticleUseCase:         useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		ListArticlesUseCase:       useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		UpdateArticleUseCase:      useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
-		DeleteArticleUseCase:      useCases.NewDeleteArticleUseCase(articleRepo),
+		UpdateArticleUseCase:      useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
+		DeleteArticleUseCase:      useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
 		GetUserUseCase:            useCases.NewGetUserUseCase(userRepo),
-		CreateUserUseCase:         useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		CreateUserUseCase:         useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		AuthenticateUserUseCase:   useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		CancelRegistrationUseCase: useCases.NewCancelRegistrationUseCase(userRepo),
 		ListUsersUseCase:          useCases.NewListUsersUseCase(userRepo),
 		SendMailUseCase:           useCases.NewSendMailUseCase(mailRepo),
-		CreateImageUseCase:        useCases.NewCreateImageUseCase(imageRepo, newMockImageStorage()),
+		CreateImageUseCase:        useCases.NewCreateImageUseCase(imageRepo, newMockImageStorage(), discardRecorder),
 		ListMediaUseCase:          useCases.NewListMediaUseCase(imageRepo, articleRepo, userRepo),
-		RenameMediaUseCase:        useCases.NewRenameMediaUseCase(imageRepo),
-		DeleteMediaUseCase:        useCases.NewDeleteMediaUseCase(imageRepo, newMockImageStorage()),
-		MergeMediaUseCase:         useCases.NewMergeMediaUseCase(imageRepo, articleRepo, newMockImageStorage()),
+		RenameMediaUseCase:        useCases.NewRenameMediaUseCase(imageRepo, discardRecorder),
+		DeleteMediaUseCase:        useCases.NewDeleteMediaUseCase(imageRepo, newMockImageStorage(), discardRecorder),
+		MergeMediaUseCase:         useCases.NewMergeMediaUseCase(imageRepo, articleRepo, newMockImageStorage(), discardRecorder),
 		GetMediaUsageUseCase:      useCases.NewGetMediaUsageUseCase(imageRepo, articleRepo),
 	}
 }

test/stale_token_invalidation_http_test.go

@@ -23,21 +23,21 @@ import (
 func newStaleTokenInvalidationRouter(userRepo *mockUserRepo, articleRepo *mockArticleRepo, imageRepo *mockImageRepo, mailRepo *mockMailRepo, hasher *stubHasher, token *jwtauth.JWTAuth) *chi.Mux {
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)
 	verificationHandler := auth.NewVerificationHandler(
-		useCases.NewVerifyUserUseCase(userRepo, hasher),
+		useCases.NewVerifyUserUseCase(userRepo, hasher, discardRecorder),
 		useCases.NewCancelRegistrationUseCase(userRepo),
 		true,
 	)

test/trusted_proxy_client_ip_for_rate_limiting_http_test.go

@@ -23,7 +23,7 @@ func newTrustedProxyAuthRouter(t *testing.T, userRepo user.Repository, mailRepo
 	token := jwtauth.New("HS256", []byte("test-secret"), nil)
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)

test/unverified_users_and_reregistration_test.go

@@ -155,7 +155,7 @@ func newUnverifiedRegistrationRouter(userRepo *mockUserRepo, token *jwtauth.JWTA
 	hasher := hashing.NewBcryptHasher()
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)

test/update_download_http_test.go

@@ -39,10 +39,10 @@ func newDownloadHTTP(t *testing.T, rig *downloadRig) *updateHarness {
 		Token:                      token,
 		GetUserUseCase:             useCases.NewGetUserUseCase(users),
 		GetUpdateStatusUseCase:     rig.status,
-		CheckForUpdateUseCase:      useCases.NewCheckForUpdateUseCase(feed, rig.store, updateRunning, now),
+		CheckForUpdateUseCase:      useCases.NewCheckForUpdateUseCase(feed, rig.store, updateRunning, now, discardRecorder),
 		StartUpdateDownloadUseCase: rig.start,
 	}
-	return &updateHarness{router: api.NewSystemRouter(container), token: token, feed: feed, store: rig.store}
+	return &updateHarness{router: api.NewSystemRouter(container, nil), token: token, feed: feed, store: rig.store}
 }
 
 func waitForHTTPState(t *testing.T, h *updateHarness, states ...string) map[string]any {
@@ -597,7 +597,7 @@ func TestFailedUpdateJobRemovesItsStagedDirectoryEvenWhenRemovalFails(t *testing
 	rig.fetcher.errors[rig.assetName] = errDownloadNetwork
 	rig.staging.removeErr = errDownloadDisk
 
-	if _, err := rig.start.Start(); err != nil {
+	if _, err := rig.start.Start(testCtx); err != nil {
 		t.Fatal(err)
 	}
 	job := rig.waitForJob(update.StateFailed)

test/update_download_test.go

@@ -1,6 +1,7 @@
 package test
 
 import (
+	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/update"
 	"RenewCMS/internal/infrastructure/persistence/database"
 	"RenewCMS/internal/infrastructure/persistence/models"
@@ -313,6 +314,7 @@ type downloadRig struct {
 	staging    *faultyStagingArea
 	realBackup update.DatabaseBackup
 	logger     *fakeUpdateLogger
+	recorder   audit.Recorder
 	start      *useCases.StartUpdateDownloadUseCase
 	status     *useCases.GetUpdateStatusUseCase
 }
@@ -385,10 +387,18 @@ func (r *downloadRig) rebuild() {
 		Platform:       r.platform,
 		FeedURL:        downloadFeedURL,
 		Now:            func() time.Time { return updateTestCheckedAt },
+		Recorder:       r.auditRecorder(),
 	})
 	r.status = useCases.NewGetUpdateStatusUseCase(r.store, r.jobs, r.helper, r.results, r.requests, updateRunning, false, time.Now)
 }
 
+func (r *downloadRig) auditRecorder() audit.Recorder {
+	if r.recorder == nil {
+		return discardRecorder
+	}
+	return r.recorder
+}
+
 func (r *downloadRig) checksumsFor(name string, content []byte) string {
 	sum := sha256.Sum256(content)
 	return hex.EncodeToString(sum[:]) + "  " + name + "\n"
@@ -484,7 +494,7 @@ func TestAssetNameFollowsThePlatform(t *testing.T) {
 				}
 			}
 
-			if _, err := rig.start.Start(); err != nil {
+			if _, err := rig.start.Start(testCtx); err != nil {
 				t.Fatal(err)
 			}
 			rig.waitForJob(update.StateReady, update.StateFailed)
@@ -543,7 +553,7 @@ func TestStartUpdateDownloadUseCaseHappyPath(t *testing.T) {
 	rig.backup.gate = gate
 	rig.backup.entered = entered
 
-	status, err := rig.start.Start()
+	status, err := rig.start.Start(testCtx)
 
 	if err != nil || status.State != update.StateDownloading || status.StartedAt == nil {
 		t.Fatalf("status = %+v, err = %v", status, err)
@@ -582,7 +592,7 @@ func TestStartUpdateDownloadUseCaseGuards(t *testing.T) {
 	t.Run("without the helper nothing starts", func(t *testing.T) {
 		rig := newDownloadRig(t)
 		rig.helper.installed = false
-		if _, err := rig.start.Start(); !errors.Is(err, update.ErrNotPrepared) {
+		if _, err := rig.start.Start(testCtx); !errors.Is(err, update.ErrNotPrepared) {
 			t.Errorf("err = %v", err)
 		}
 		if rig.fetcher.totalCalls() != 0 {
@@ -594,7 +604,7 @@ func TestStartUpdateDownloadUseCaseGuards(t *testing.T) {
 		rig := newDownloadRig(t)
 		rig.helper.installed = false
 		rig.store.found = false
-		if _, err := rig.start.Start(); !errors.Is(err, update.ErrNotPrepared) {
+		if _, err := rig.start.Start(testCtx); !errors.Is(err, update.ErrNotPrepared) {
 			t.Errorf("err = %v", err)
 		}
 	})
@@ -603,7 +613,7 @@ func TestStartUpdateDownloadUseCaseGuards(t *testing.T) {
 		rig := newDownloadRig(t)
 		rig.jobs.put(update.Job{State: update.StateReady})
 		rig.store.found = false
-		if _, err := rig.start.Start(); !errors.Is(err, update.ErrJobInProgress) {
+		if _, err := rig.start.Start(testCtx); !errors.Is(err, update.ErrJobInProgress) {
 			t.Errorf("err = %v", err)
 		}
 	})
@@ -611,7 +621,7 @@ func TestStartUpdateDownloadUseCaseGuards(t *testing.T) {
 	t.Run("nothing stored", func(t *testing.T) {
 		rig := newDownloadRig(t)
 		rig.store.found = false
-		if _, err := rig.start.Start(); !errors.Is(err, update.ErrNothingToUpdate) {
+		if _, err := rig.start.Start(testCtx); !errors.Is(err, update.ErrNothingToUpdate) {
 			t.Errorf("err = %v", err)
 		}
 	})
@@ -619,7 +629,7 @@ func TestStartUpdateDownloadUseCaseGuards(t *testing.T) {
 	t.Run("a job record that cannot be saved is an error", func(t *testing.T) {
 		rig := newDownloadRig(t)
 		rig.jobs.saveErr = errRepositoryFailure
-		if _, err := rig.start.Start(); !errors.Is(err, errRepositoryFailure) {
+		if _, err := rig.start.Start(testCtx); !errors.Is(err, errRepositoryFailure) {
 			t.Errorf("err = %v", err)
 		}
 		if rig.fetcher.totalCalls() != 0 {
@@ -643,7 +653,7 @@ func TestTwoStartsAtOnceRunOneJob(t *testing.T) {
 		go func() {
 			ready.Done()
 			ready.Wait()
-			_, err := rig.start.Start()
+			_, err := rig.start.Start(testCtx)
 			results <- err
 		}()
 	}
@@ -922,7 +932,7 @@ func TestStartUpdateDownloadUseCaseProgressCadence(t *testing.T) {
 		}
 	}
 
-	if _, err := rig.start.Start(); err != nil {
+	if _, err := rig.start.Start(testCtx); err != nil {
 		t.Fatal(err)
 	}
 	rig.waitForJob(update.StateReady, update.StateFailed)
@@ -938,7 +948,7 @@ func TestStartUpdateDownloadUseCaseAcceptsAnUndeclaredSize(t *testing.T) {
 	rig := newDownloadRig(t)
 	rig.setAsset(rig.assetName, func(asset *update.Asset) { asset.Size = 0 })
 
-	if _, err := rig.start.Start(); err != nil {
+	if _, err := rig.start.Start(testCtx); err != nil {
 		t.Fatal(err)
 	}
 
@@ -961,7 +971,7 @@ func TestStartUpdateDownloadUseCaseReportsAFailedRecordSave(t *testing.T) {
 			}
 		}
 
-		if _, err := rig.start.Start(); err != nil {
+		if _, err := rig.start.Start(testCtx); err != nil {
 			t.Fatal(err)
 		}
 
@@ -978,7 +988,7 @@ func TestStartUpdateDownloadUseCaseReportsAFailedRecordSave(t *testing.T) {
 		rig := newDownloadRig(t)
 		rig.fetcher.errors[rig.assetName] = errDownloadNetwork
 
-		if _, err := rig.start.Start(); err != nil {
+		if _, err := rig.start.Start(testCtx); err != nil {
 			t.Fatal(err)
 		}
 		rig.waitForJob(update.StateFailed)

test/update_http_test.go

@@ -64,9 +64,9 @@ func newUpdateHarness(t *testing.T, running string) *updateHarness {
 		Token:                  token,
 		GetUserUseCase:         useCases.NewGetUserUseCase(users),
 		GetUpdateStatusUseCase: newUpdateStatusUseCase(store, &fakeJobStore{}, &fakeHelperDetector{}, running),
-		CheckForUpdateUseCase:  useCases.NewCheckForUpdateUseCase(feed, store, running, now),
+		CheckForUpdateUseCase:  useCases.NewCheckForUpdateUseCase(feed, store, running, now, discardRecorder),
 	}
-	return &updateHarness{router: api.NewSystemRouter(container), token: token, feed: feed, store: store}
+	return &updateHarness{router: api.NewSystemRouter(container, nil), token: token, feed: feed, store: store}
 }
 
 func (h *updateHarness) send(t *testing.T, method, path string, userId uint32, tokenVersion uint32) *httptest.ResponseRecorder {

test/update_restart_http_test.go

@@ -61,9 +61,9 @@ func newRestartHTTP(t *testing.T) *restartHTTP {
 		GetUpdateStatusUseCase: useCases.NewGetUpdateStatusUseCase(
 			h.store, h.jobs, h.helper, h.resultFiles, h.markers, updateRunning, false, h.clock.Now),
 		RequestRestartUseCase: useCases.NewRequestRestartUseCase(
-			h.store, h.jobs, h.helper, h.resultFiles, h.markers, updateRunning, h.clock.Now),
+			h.store, h.jobs, h.helper, h.resultFiles, h.markers, updateRunning, h.clock.Now, discardRecorder),
 	}
-	h.router = api.NewSystemRouter(container)
+	h.router = api.NewSystemRouter(container, nil)
 	return h
 }
 

test/update_restart_usecase_test.go

@@ -31,7 +31,7 @@ func newRestartRig(running string) *restartRig {
 		requests: &fakeRestartRequestStore{},
 		clock:    &fakeClock{now: restartBaseTime},
 	}
-	rig.request = useCases.NewRequestRestartUseCase(rig.store, rig.jobs, rig.helper, rig.results, rig.requests, running, rig.clock.Now)
+	rig.request = useCases.NewRequestRestartUseCase(rig.store, rig.jobs, rig.helper, rig.results, rig.requests, running, rig.clock.Now, discardRecorder)
 	rig.status = useCases.NewGetUpdateStatusUseCase(rig.store, rig.jobs, rig.helper, rig.results, rig.requests, running, false, rig.clock.Now)
 	return rig
 }
@@ -50,7 +50,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 		rig.readyJob()
 		rig.results.put(update.Result{Outcome: update.OutcomeRolledBack})
 
-		status, err := rig.request.Request(updateOwnerId, "")
+		status, err := rig.request.Request(testCtx, updateOwnerId, "")
 
 		if err != nil {
 			t.Fatal(err)
@@ -81,7 +81,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 				rig := newRestartRig(updateRunning)
 				prepare(rig)
 
-				status, err := rig.request.Request(updateOwnerId, update.RestartKindRestart)
+				status, err := rig.request.Request(testCtx, updateOwnerId, update.RestartKindRestart)
 
 				marker, _ := rig.requests.Read()
 				if err != nil || marker.Kind != update.RestartKindRestart || marker.Tag != "" || status.State != update.StateRestarting {
@@ -107,7 +107,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 				tc.prepare(rig)
 				jobBefore, _ := rig.jobs.Load()
 
-				_, err := rig.request.Request(updateOwnerId, tc.kind)
+				_, err := rig.request.Request(testCtx, updateOwnerId, tc.kind)
 
 				if !errors.Is(err, update.ErrRestartKindMismatch) {
 					t.Fatalf("err = %v", err)
@@ -140,7 +140,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 				resultBefore, foundBefore := rig.results.Read()
 				writesBefore := rig.requests.writes
 
-				_, err := rig.request.Request(updateOwnerId, "")
+				_, err := rig.request.Request(testCtx, updateOwnerId, "")
 
 				resultAfter, foundAfter := rig.results.Read()
 				if !errors.Is(err, tc.want) || rig.requests.writes != writesBefore || resultAfter != resultBefore || foundAfter != foundBefore || rig.results.deletes != 0 {
@@ -154,7 +154,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 		rig := newRestartRig(updateRunning)
 		rig.results.put(update.Result{Outcome: update.OutcomeRunning, StartedAt: restartBaseTime.Add(-6 * time.Minute)})
 
-		_, err := rig.request.Request(updateOwnerId, "")
+		_, err := rig.request.Request(testCtx, updateOwnerId, "")
 
 		if err != nil || rig.requests.writes != 1 {
 			t.Errorf("err = %v, writes = %d", err, rig.requests.writes)
@@ -167,7 +167,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 		rig.requests.writeErr = errors.New("disk full at /var/lib/renewcms")
 		jobBefore, _ := rig.jobs.Load()
 
-		_, err := rig.request.Request(updateOwnerId, "")
+		_, err := rig.request.Request(testCtx, updateOwnerId, "")
 
 		jobAfter, _ := rig.jobs.Load()
 		if err == nil || errors.Is(err, update.ErrRestartKindMismatch) || rig.requests.present || jobAfter != jobBefore {
@@ -183,7 +183,7 @@ func TestRequestRestartUseCase(t *testing.T) {
 			wait.Add(1)
 			go func() {
 				defer wait.Done()
-				_, errs[i] = rig.request.Request(uint32(i+1), "")
+				_, errs[i] = rig.request.Request(testCtx, uint32(i+1), "")
 			}()
 		}
 		wait.Wait()

test/update_test.go

@@ -199,7 +199,7 @@ func TestCheckForUpdateUseCase(t *testing.T) {
 		store := &fakeUpdateStore{}
 		feed := &fakeReleaseFeed{release: newRelease}
 
-		status, err := useCases.NewCheckForUpdateUseCase(feed, store, "v2.2.0-beta", now).Check()
+		status, err := useCases.NewCheckForUpdateUseCase(feed, store, "v2.2.0-beta", now, discardRecorder).Check(testCtx)
 
 		if err != nil || !status.Available || status.Latest != "v2.3.0-beta" {
 			t.Fatalf("status = %+v, err = %v", status, err)
@@ -211,7 +211,7 @@ func TestCheckForUpdateUseCase(t *testing.T) {
 
 	t.Run("nothing newer", func(t *testing.T) {
 		feed := &fakeReleaseFeed{release: update.Release{Tag: "v2.2.0-beta"}}
-		status, err := useCases.NewCheckForUpdateUseCase(feed, &fakeUpdateStore{}, "v2.2.0-beta", now).Check()
+		status, err := useCases.NewCheckForUpdateUseCase(feed, &fakeUpdateStore{}, "v2.2.0-beta", now, discardRecorder).Check(testCtx)
 		if err != nil || status.Available {
 			t.Errorf("status = %+v, err = %v", status, err)
 		}
@@ -221,7 +221,7 @@ func TestCheckForUpdateUseCase(t *testing.T) {
 		store := &fakeUpdateStore{result: newStoredUpdateResult(), found: true}
 		feed := &fakeReleaseFeed{err: update.ErrFeedUnavailable}
 
-		_, err := useCases.NewCheckForUpdateUseCase(feed, store, "v2.2.0-beta", now).Check()
+		_, err := useCases.NewCheckForUpdateUseCase(feed, store, "v2.2.0-beta", now, discardRecorder).Check(testCtx)
 
 		if !errors.Is(err, update.ErrFeedUnavailable) {
 			t.Errorf("err = %v", err)
@@ -234,7 +234,7 @@ func TestCheckForUpdateUseCase(t *testing.T) {
 	t.Run("store failure is returned", func(t *testing.T) {
 		store := &fakeUpdateStore{saveErr: errRepositoryFailure}
 		feed := &fakeReleaseFeed{release: newRelease}
-		if _, err := useCases.NewCheckForUpdateUseCase(feed, store, "v2.2.0-beta", now).Check(); !errors.Is(err, errRepositoryFailure) {
+		if _, err := useCases.NewCheckForUpdateUseCase(feed, store, "v2.2.0-beta", now, discardRecorder).Check(testCtx); !errors.Is(err, errRepositoryFailure) {
 			t.Errorf("err = %v", err)
 		}
 	})

test/use_case_baseline_test.go

@@ -29,10 +29,10 @@ func TestCreateArticleTitleLengthLimit(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(fmt.Sprintf("length_%d", tc.length), func(t *testing.T) {
 			repo := newMockArticleRepo()
-			uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{})
+			uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
 
 			title := strings.Repeat("a", tc.length)
-			result, err := uc.CreateArticle(useCases.CreateArticleCommand{Title: title, Body: "Some body text"})
+			result, err := uc.CreateArticle(testCtx, useCases.CreateArticleCommand{Title: title, Body: "Some body text"})
 
 			if tc.expectValid {
 				if err != nil {
@@ -62,9 +62,9 @@ func TestCreateArticleTitleLengthLimit(t *testing.T) {
 func TestCreateArticlePropagatesRepositoryFailure(t *testing.T) {
 	repo := newMockArticleRepo()
 	repo.fail.failNext("Create")
-	uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{})
+	uc := useCases.NewCreateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
 
-	_, err := uc.CreateArticle(useCases.CreateArticleCommand{Title: "Backyard Renovation Update", Body: "Some body text"})
+	_, err := uc.CreateArticle(testCtx, useCases.CreateArticleCommand{Title: "Backyard Renovation Update", Body: "Some body text"})
 
 	if !errors.Is(err, errRepositoryFailure) {
 		t.Errorf("expected repository failure, got %v", err)
@@ -242,8 +242,8 @@ func TestUpdateArticleDelegatesEachOperation(t *testing.T) {
 
 	t.Run("UpdateBody_id1", func(t *testing.T) {
 		repo := newRepo()
-		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{})
-		result, err := uc.UpdateBody(1, "New body", article.BodyFormatHTML)
+		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
+		result, err := uc.UpdateBody(testCtx, 1, "New body", article.BodyFormatHTML)
 		if err != nil {
 			t.Fatalf("expected no error, got %v", err)
 		}
@@ -254,8 +254,8 @@ func TestUpdateArticleDelegatesEachOperation(t *testing.T) {
 
 	t.Run("UpdateBody_id9", func(t *testing.T) {
 		repo := newRepo()
-		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{})
-		_, err := uc.UpdateBody(9, "New body", article.BodyFormatHTML)
+		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
+		_, err := uc.UpdateBody(testCtx, 9, "New body", article.BodyFormatHTML)
 		if !errors.Is(err, article.ErrArticleNotFound) {
 			t.Errorf("expected article.ErrArticleNotFound, got %v", err)
 		}
@@ -263,8 +263,8 @@ func TestUpdateArticleDelegatesEachOperation(t *testing.T) {
 
 	t.Run("UpdateIsOnline_id1", func(t *testing.T) {
 		repo := newRepo()
-		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{})
-		result, err := uc.UpdateIsOnline(1, true, article.BodyFormatHTML)
+		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
+		result, err := uc.UpdateIsOnline(testCtx, 1, true, article.BodyFormatHTML)
 		if err != nil {
 			t.Fatalf("expected no error, got %v", err)
 		}
@@ -275,8 +275,8 @@ func TestUpdateArticleDelegatesEachOperation(t *testing.T) {
 
 	t.Run("UpdateIsOnline_id9", func(t *testing.T) {
 		repo := newRepo()
-		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{})
-		_, err := uc.UpdateIsOnline(9, true, article.BodyFormatHTML)
+		uc := useCases.NewUpdateArticleUseCase(repo, &fakeBodyRenderer{}, discardRecorder)
+		_, err := uc.UpdateIsOnline(testCtx, 9, true, article.BodyFormatHTML)
 		if !errors.Is(err, article.ErrArticleNotFound) {
 			t.Errorf("expected article.ErrArticleNotFound, got %v", err)
 		}
@@ -287,9 +287,9 @@ func TestDeleteArticleReportsMissingArticle(t *testing.T) {
 	t.Run("id_1", func(t *testing.T) {
 		repo := newMockArticleRepo()
 		repo.articles[1] = article.Article{ID: 1}
-		uc := useCases.NewDeleteArticleUseCase(repo)
+		uc := useCases.NewDeleteArticleUseCase(repo, discardRecorder)
 
-		err := uc.DeleteArticle(1)
+		err := uc.DeleteArticle(testCtx, 1)
 		if err != nil {
 			t.Errorf("expected no error, got %v", err)
 		}
@@ -298,9 +298,9 @@ func TestDeleteArticleReportsMissingArticle(t *testing.T) {
 	t.Run("id_9", func(t *testing.T) {
 		repo := newMockArticleRepo()
 		repo.articles[1] = article.Article{ID: 1}
-		uc := useCases.NewDeleteArticleUseCase(repo)
+		uc := useCases.NewDeleteArticleUseCase(repo, discardRecorder)
 
-		err := uc.DeleteArticle(9)
+		err := uc.DeleteArticle(testCtx, 9)
 		if !errors.Is(err, article.ErrArticleNotFound) {
 			t.Errorf("expected article.ErrArticleNotFound, got %v", err)
 		}
@@ -311,9 +311,9 @@ func TestDeleteArticlePropagatesRepositoryFailure(t *testing.T) {
 	repo := newMockArticleRepo()
 	repo.articles[1] = article.Article{ID: 1}
 	repo.fail.failNext("Delete")
-	uc := useCases.NewDeleteArticleUseCase(repo)
+	uc := useCases.NewDeleteArticleUseCase(repo, discardRecorder)
 
-	err := uc.DeleteArticle(1)
+	err := uc.DeleteArticle(testCtx, 1)
 	if !errors.Is(err, errRepositoryFailure) {
 		t.Errorf("expected repository failure, got %v", err)
 	}
@@ -334,13 +334,13 @@ func TestCreateImageDelegatesContentTypeCheck(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(strings.ReplaceAll(tc.contentType, "/", "_"), func(t *testing.T) {
 			repo := newMockImageRepo()
-			uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+			uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
 			content := []byte("fake-image-data")
 			if tc.valid {
 				content = validBytesFor(t, tc.contentType)
 			}
-			result, err := uc.CreateImage(imageDomain.ImageInput{
+			result, err := uc.CreateImage(testCtx, imageDomain.ImageInput{
 				Content:     bytes.NewReader(content),
 				Filename:    "test.img",
 				ContentType: tc.contentType,
@@ -368,9 +368,9 @@ func TestCreateImageDelegatesContentTypeCheck(t *testing.T) {
 func TestCreateImagePropagatesRepositoryFailure(t *testing.T) {
 	repo := newMockImageRepo()
 	repo.fail.failNext("Create")
-	uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage())
+	uc := useCases.NewCreateImageUseCase(repo, newMockImageStorage(), discardRecorder)
 
-	_, err := uc.CreateImage(imageDomain.ImageInput{
+	_, err := uc.CreateImage(testCtx, imageDomain.ImageInput{
 		Content:     bytes.NewReader(pngBytes(t, 3, 2)),
 		Filename:    "test.png",
 		ContentType: "image/png",
@@ -385,9 +385,9 @@ func TestDeleteImageRequiresExistence(t *testing.T) {
 	t.Run("id_1", func(t *testing.T) {
 		repo := newMockImageRepo()
 		repo.images[1] = imageDomain.Image{ID: 1}
-		uc := useCases.NewDeleteMediaUseCase(repo, newMockImageStorage())
+		uc := useCases.NewDeleteMediaUseCase(repo, newMockImageStorage(), discardRecorder)
 
-		err := uc.Delete(1)
+		err := uc.Delete(testCtx, 1)
 		if err != nil {
 			t.Fatalf("expected no error, got %v", err)
 		}
@@ -399,9 +399,9 @@ func TestDeleteImageRequiresExistence(t *testing.T) {
 	t.Run("id_9", func(t *testing.T) {
 		repo := newMockImageRepo()
 		repo.images[1] = imageDomain.Image{ID: 1}
-		uc := useCases.NewDeleteMediaUseCase(repo, newMockImageStorage())
+		uc := useCases.NewDeleteMediaUseCase(repo, newMockImageStorage(), discardRecorder)
 
-		err := uc.Delete(9)
+		err := uc.Delete(testCtx, 9)
 		if !errors.Is(err, imageDomain.ErrImageNotFound) {
 			t.Errorf("expected image.ErrImageNotFound, got %v", err)
 		}
@@ -410,10 +410,10 @@ func TestDeleteImageRequiresExistence(t *testing.T) {
 
 func TestCreateUserAssignsVerificationCode(t *testing.T) {
 	repo := newMockUserRepo()
-	uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com")
+	uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com", discardRecorder)
 
 	before := time.Now()
-	result, err := uc.CreateUser(useCases.CreateUserCommand{
+	result, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 		Username: "alice",
 		Password: "hunter2example",
 		Email:    "alice@example.com",
@@ -441,7 +441,7 @@ func TestCreateUserAssignsVerificationCode(t *testing.T) {
 		t.Errorf("expected verification_expiration about 2 hours from now, got %v", result.VerificationExpiration)
 	}
 
-	second, err := uc.CreateUser(useCases.CreateUserCommand{
+	second, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 		Username: "bob",
 		Password: "hunter2example",
 		Email:    "bob@example.com",
@@ -457,9 +457,9 @@ func TestCreateUserAssignsVerificationCode(t *testing.T) {
 func TestCreateUserPropagatesRepositoryFailure(t *testing.T) {
 	repo := newMockUserRepo()
 	repo.fail.failNext("Create")
-	uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com")
+	uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com", discardRecorder)
 
-	_, err := uc.CreateUser(useCases.CreateUserCommand{
+	_, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{
 		Username: "alice",
 		Password: "hunter2example",
 		Email:    "alice@example.com",

test/user_display_name_test.go

@@ -25,12 +25,12 @@ var displayNameResponseKeys = []string{"id", "username", "email", "is_verified",
 func newDisplayNameRouter(userRepo *mockUserRepo, token *jwtauth.JWTAuth) *chi.Mux {
 	hasher := &stubHasher{}
 	getUser := useCases.NewGetUserUseCase(userRepo)
-	update := useCases.NewUpdateUserProfileUseCase(userRepo)
+	update := useCases.NewUpdateUserProfileUseCase(userRepo, discardRecorder)
 	handler := userhandler.NewHandler(update)
 	meHandler := auth.NewMeHandler(getUser)
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)
@@ -149,7 +149,7 @@ func TestUpdateUserProfileUseCase(t *testing.T) {
 	for _, tc := range successCases {
 		t.Run(tc.name, func(t *testing.T) {
 			repo := newRepo()
-			got, err := useCases.NewUpdateUserProfileUseCase(repo).UpdateDisplayName(7, tc.input)
+			got, err := useCases.NewUpdateUserProfileUseCase(repo, discardRecorder).UpdateDisplayName(testCtx, 7, tc.input)
 			if err != nil {
 				t.Fatalf("unexpected error: %v", err)
 			}
@@ -161,7 +161,7 @@ func TestUpdateUserProfileUseCase(t *testing.T) {
 
 	t.Run("61 emoji runes are refused without calling the repository", func(t *testing.T) {
 		repo := newRepo()
-		_, err := useCases.NewUpdateUserProfileUseCase(repo).UpdateDisplayName(7, strings.Repeat("😀", 61))
+		_, err := useCases.NewUpdateUserProfileUseCase(repo, discardRecorder).UpdateDisplayName(testCtx, 7, strings.Repeat("😀", 61))
 		if !errors.Is(err, user.ErrInvalidDisplayName) {
 			t.Fatalf("expected ErrInvalidDisplayName, got %v", err)
 		}
@@ -171,7 +171,7 @@ func TestUpdateUserProfileUseCase(t *testing.T) {
 	})
 
 	t.Run("unknown user", func(t *testing.T) {
-		_, err := useCases.NewUpdateUserProfileUseCase(newRepo()).UpdateDisplayName(99, "Marta")
+		_, err := useCases.NewUpdateUserProfileUseCase(newRepo(), discardRecorder).UpdateDisplayName(testCtx, 99, "Marta")
 		if !errors.Is(err, user.ErrUserNotFound) {
 			t.Fatalf("expected ErrUserNotFound, got %v", err)
 		}
@@ -180,7 +180,7 @@ func TestUpdateUserProfileUseCase(t *testing.T) {
 	t.Run("repository failure is returned unchanged", func(t *testing.T) {
 		repo := newRepo()
 		repo.fail.failNext("UpdateDisplayName")
-		_, err := useCases.NewUpdateUserProfileUseCase(repo).UpdateDisplayName(7, "Marta")
+		_, err := useCases.NewUpdateUserProfileUseCase(repo, discardRecorder).UpdateDisplayName(testCtx, 7, "Marta")
 		if !errors.Is(err, errRepositoryFailure) {
 			t.Fatalf("expected repository failure, got %v", err)
 		}

test/user_response_field_hygiene_test.go

@@ -21,12 +21,12 @@ func newUserFieldHygieneRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, t
 	hasher := &stubHasher{}
 	loginHandler := auth.NewLoginHandler(
 		token,
-		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
+		useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder),
 		useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder),
 		true,
 	)
 	verificationHandler := auth.NewVerificationHandler(
-		useCases.NewVerifyUserUseCase(userRepo, hasher),
+		useCases.NewVerifyUserUseCase(userRepo, hasher, discardRecorder),
 		useCases.NewCancelRegistrationUseCase(userRepo),
 		true,
 	)

test/user_roles_test.go

@@ -50,19 +50,19 @@ func newUserRolesFixture(t *testing.T, maxAttempts int) *userRolesFixture {
 	getUser := useCases.NewGetUserUseCase(f.users)
 	loginHandler := auth.NewLoginHandler(
 		f.token,
-		useCases.NewCreateUserUseCase(f.users, hasher, f.mail, invitePublicURL),
+		useCases.NewCreateUserUseCase(f.users, hasher, f.mail, invitePublicURL, discardRecorder),
 		useCases.NewAuthenticateUserUseCase(f.users, hasher, discardRecorder),
 		true,
 	)
 	acceptHandler := auth.NewAcceptInviteHandler(
 		useCases.NewGetInviteUseCase(f.invites, hasher),
-		useCases.NewAcceptInviteUseCase(f.users, f.invites, hasher),
+		useCases.NewAcceptInviteUseCase(f.users, f.invites, hasher, discardRecorder),
 		f.token,
 		true,
 	)
 	meHandler := auth.NewMeHandler(getUser)
 	inviteHandler := userhandler.NewInviteHandler(
-		useCases.NewCreateInviteUseCase(f.users, f.invites, hasher, f.mail, invitePublicURL),
+		useCases.NewCreateInviteUseCase(f.users, f.invites, hasher, f.mail, invitePublicURL, discardRecorder),
 		nil,
 		nil,
 		useCases.NewListUsersAndInvitesUseCase(f.users, f.invites),
@@ -352,9 +352,9 @@ func TestUserRolesHttp(t *testing.T) {
 func TestUserRolesUseCases(t *testing.T) {
 	t.Run("CreateUser returns an owner", func(t *testing.T) {
 		users := newMockUserRepo()
-		uc := useCases.NewCreateUserUseCase(users, &stubHasher{}, newMockMailRepo(), invitePublicURL)
+		uc := useCases.NewCreateUserUseCase(users, &stubHasher{}, newMockMailRepo(), invitePublicURL, discardRecorder)
 
-		created, err := uc.CreateUser(useCases.CreateUserCommand{Username: "marta", Password: "hunter2example12", Email: "marta@renew.example"})
+		created, err := uc.CreateUser(testCtx, useCases.CreateUserCommand{Username: "marta", Password: "hunter2example12", Email: "marta@renew.example"})
 
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
@@ -371,9 +371,9 @@ func TestUserRolesUseCases(t *testing.T) {
 		pending := pendingInvite(acceptEmail)
 		pending.HashedCode = "hashed:" + acceptCode
 		invites.seed(pending)
-		uc := useCases.NewAcceptInviteUseCase(users, invites, &stubHasher{})
+		uc := useCases.NewAcceptInviteUseCase(users, invites, &stubHasher{}, discardRecorder)
 
-		created, err := uc.AcceptInvite(useCases.AcceptInviteCommand{Code: acceptCode, Username: "lea", Password: acceptPassword})
+		created, err := uc.AcceptInvite(testCtx, useCases.AcceptInviteCommand{Code: acceptCode, Username: "lea", Password: acceptPassword})
 
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)

test/user_test.go

@@ -231,7 +231,7 @@ var _ user.Repository = &mockUserRepo{}
 
 func TestCreateUser(t *testing.T) {
 	repo := newMockUserRepo()
-	uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com")
+	uc := useCases.NewCreateUserUseCase(repo, &stubHasher{}, newMockMailRepo(), "https://cms.example.com", discardRecorder)
 
 	cmd := useCases.CreateUserCommand{
 		Username: "testuser",
@@ -239,7 +239,7 @@ func TestCreateUser(t *testing.T) {
 		Email:    "test@example.com",
 	}
 
-	res, err := uc.CreateUser(cmd)
+	res, err := uc.CreateUser(testCtx, cmd)
 	if err != nil {
 		t.Fatalf("User creation failed: %v", err)
 	}

test/verified_account_required_http_test.go

@@ -21,11 +21,11 @@ import (
 func newVerifiedAccountRequiredRouter(articleRepo *mockArticleRepo, userRepo *mockUserRepo, token *jwtauth.JWTAuth) *chi.Mux {
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)
 

test/write_not_found_errors_test.go

@@ -213,11 +213,11 @@ func newDeleteArticleRouter(articleRepo *mockArticleRepo, token *jwtauth.JWTAuth
 	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
 
 	articleHandler := article.NewHandler(
-		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewCreateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		useCases.NewGetArticleUseCase(articleRepo, &fakeBodyRenderer{}),
 		useCases.NewListArticlesUseCase(articleRepo, &fakeBodyRenderer{}),
-		useCases.NewDeleteArticleUseCase(articleRepo),
-		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}),
+		useCases.NewDeleteArticleUseCase(articleRepo, discardRecorder),
+		useCases.NewUpdateArticleUseCase(articleRepo, &fakeBodyRenderer{}, discardRecorder),
 		getUserUseCase,
 	)