fix(audit): give the audit trail the names that make it readable

Migration 029 made `actor_id`/`target_id` non-FK on the stated grounds that
"the record must survive the actor's account being removed, which is exactly
when it is most likely to be wanted". All eleven call sites then passed None
for both name columns — so what survived a deletion was a bare uuid resolving
to nothing: the guarantee, minus the only thing that made it useful.

`record` now resolves whatever the caller omitted, in one query, so no call
site can forget. `me::delete_account` passes its names explicitly because it
has already hard-deleted the row by then — that is the one record a host is
most likely to be reading the next morning ("whose photos disappeared?").

Also: `actor_role` is written with `as_str()` rather than
`format!("{actor_role:?}")`. The Debug spelling is not a stable wire format,
so a derive change or a renamed variant would have silently started writing a
different string into a column nothing validates.

Migration 029's header lists three action slugs (`promote_user`,
`demote_user`, `delete_user`) that no call site has ever emitted, and it
cannot be corrected — editing an applied migration changes its checksum and
crash-loops every database that ran it. The real list, verified against the
call sites, is documented in this module instead, along with the fact that
there is no read endpoint and the query to use by hand.

A NULL name fails silently, so it is now asserted: names resolved from ids,
names surviving the row's deletion, and a row still written when neither can
be resolved (an audit write must never fail the action it records).

backend/src/handlers/me.rs

@@ -248,15 +248,21 @@ pub async fn delete_account(
     ));
 
     // Audited like the host actions it resembles, with the actor and target being the same person.
+    //
+    // The names are passed EXPLICITLY here, unlike every other call site. `audit::record` resolves
+    // a missing name by looking the id up in `"user"` — and this handler has just hard-deleted that
+    // row, so the lookup would find nothing and write the NULL that makes the record unreadable.
+    // This is the row most likely to be read later ("whose photos disappeared?"), and migration 029
+    // made these columns non-FK precisely so it would survive the deletion.
     crate::services::audit::record(
         &state.pool,
         auth.event_id,
         auth.user_id,
-        None,
+        Some(&user.display_name),
         user.role.clone(),
         "delete_account",
         Some(auth.user_id),
-        None,
+        Some(&user.display_name),
         Some(serde_json::json!({ "uploads_removed": files.len() })),
     )
     .await;

backend/src/services/audit.rs

@@ -7,6 +7,21 @@
 //!  * **Never store a credential.** `reset_pin` is the action most worth recording and the one
 //!    whose payload must never be in `detail` — a table that could hand back a guest's PIN would
 //!    be a worse privacy problem than the gap it closes.
+//!
+//! **Action slugs actually written**, since migration 029's header lists three (`promote_user`,
+//! `demote_user`, `delete_user`) that no call site has ever emitted, and the migration file cannot
+//! be corrected without changing its checksum and crash-looping every database that ran it:
+//!
+//! `ban_user`, `unban_user`, `set_role`, `reset_pin`, `delete_upload`, `delete_comment`,
+//! `lock_uploads`, `unlock_uploads`, `release_gallery`, `delete_account`, `patch_config`.
+//! Eleven, one per `audit::record` call site — grep for it if this list ages.
+//!
+//! **There is deliberately no read endpoint.** The table is queried by hand:
+//!
+//! ```sql
+//! SELECT created_at, actor_name, actor_role, action, target_name, detail
+//!   FROM host_action_audit ORDER BY created_at DESC LIMIT 50;
+//! ```
 
 use serde_json::Value;
 use sqlx::PgPool;
@@ -32,6 +47,20 @@ pub async fn record(
     target_name: Option<&str>,
     detail: Option<Value>,
 ) {
+    // Resolve whatever names the caller did not supply.
+    //
+    // Migration 029 made `actor_id`/`target_id` deliberately non-FK so "the record survives the
+    // actor's account being removed, which is exactly when it is most likely to be wanted". Every
+    // caller passed None for both names, so what survived was a bare uuid resolving to nothing —
+    // the guarantee the column exists for, minus the only thing that made it readable.
+    //
+    // Resolved HERE rather than at eleven call sites so none can be missed. The one caller that
+    // destroys the row it is recording — `me::delete_account` — must still pass the name in, since
+    // by the time this runs there is nothing left to look up, and that is precisely the row a host
+    // will be reading the next morning ("whose photos disappeared?").
+    let (actor_name, target_name) =
+        resolve_names(pool, actor_id, actor_name, target_id, target_name).await;
+
     let result = sqlx::query(
         "INSERT INTO host_action_audit
            (event_id, actor_id, actor_name, actor_role, action, target_id, target_name, detail)
@@ -39,11 +68,14 @@ pub async fn record(
     )
     .bind(event_id)
     .bind(actor_id)
-    .bind(actor_name)
-    .bind(format!("{actor_role:?}").to_lowercase())
+    .bind(actor_name.as_deref())
+    // `as_str()`, not `format!("{actor_role:?}")`: the Debug spelling is not a stable wire format,
+    // so a `#[derive(Debug)]` change or a renamed variant would silently start writing a different
+    // string into a column nothing validates. `as_str` is the one the rest of the codebase uses.
+    .bind(actor_role.as_str())
     .bind(action)
     .bind(target_id)
-    .bind(target_name)
+    .bind(target_name.as_deref())
     .bind(detail)
     .execute(pool)
     .await;
@@ -60,3 +92,50 @@ pub async fn record(
         }
     }
 }
+
+/// Fill in any name the caller left as `None`, in ONE query.
+///
+/// Best-effort by the same rule as the insert: a failed lookup writes NULL rather than failing the
+/// action, and it is one round-trip whether zero, one or both names are missing.
+async fn resolve_names(
+    pool: &PgPool,
+    actor_id: Uuid,
+    actor_name: Option<&str>,
+    target_id: Option<Uuid>,
+    target_name: Option<&str>,
+) -> (Option<String>, Option<String>) {
+    let need_actor = actor_name.is_none();
+    let need_target = target_name.is_none() && target_id.is_some();
+    if !need_actor && !need_target {
+        return (
+            actor_name.map(str::to_owned),
+            target_name.map(str::to_owned),
+        );
+    }
+
+    let mut wanted: Vec<Uuid> = Vec::with_capacity(2);
+    if need_actor {
+        wanted.push(actor_id);
+    }
+    if let Some(t) = target_id
+        && need_target
+    {
+        wanted.push(t);
+    }
+
+    let rows: Vec<(Uuid, String)> =
+        sqlx::query_as("SELECT id, display_name FROM \"user\" WHERE id = ANY($1)")
+            .bind(&wanted)
+            .fetch_all(pool)
+            .await
+            .unwrap_or_default();
+
+    let lookup = |id: Uuid| rows.iter().find(|(i, _)| *i == id).map(|(_, n)| n.clone());
+
+    (
+        actor_name.map(str::to_owned).or_else(|| lookup(actor_id)),
+        target_name
+            .map(str::to_owned)
+            .or_else(|| target_id.and_then(lookup)),
+    )
+}