A11y:
- Add alt_text field to MediaAsset and ContentBlock (WCAG 2.1 AA 1.1.1)
- Expose alt_text in MediaAssetSerializer and ContentBlockSerializer so
frontends can render <img alt="..."> and <video aria-label="..."> correctly
- Migration 0002 adds the two alt_text columns
i18n:
- Add LocaleMiddleware to MIDDLEWARE stack (after SessionMiddleware per Django docs)
- Add LANGUAGES = [("de", ...), ("en", ...)] and LOCALE_PATHS = [BASE_DIR/"locale"]
- Add USE_L10N = True
- Seed locale/de/LC_MESSAGES/django.po and locale/en/LC_MESSAGES/django.po with
translations for all user-facing API strings (upload errors, notification titles)
Tests (tests/a11y/test_a11y_i18n.py):
- alt_text field round-trip on MediaAsset and ContentBlock
- Serializer exposes and accepts alt_text on create, list, PATCH
- LANGUAGES/LOCALE_PATHS/LocaleMiddleware settings assertions
- Accept-Language header switching smoke test against /api/v1/notifications/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Delivers the append-only audit trail system for all compliance-critical
actions per the TRA-246 acceptance criteria.
- tracking/models.py: AuditEvent model with ORM-level immutability guard
(save raises on update, delete raises on direct call)
- tracking/audit.py: single record() call point; never raises in production
- tracking/admin.py: read-only Django admin for AuditEvent inspection
- tracking/migrations/0001_initial.py: DB schema with composite indexes
- tracking/serializers.py: PII metadata gating (oidc_sub stripped for
non-admin callers)
- tracking/views.py: read-only AuditEventViewSet (IsPrivileged + 60/min
throttle)
- tracking/urls.py: registers audit/events/ router
- tracking/management/commands/prune_audit_log.py: retention enforcement
command with --dry-run and --class filter; writes access.admin_action
event on real prune runs
- config/settings/base.py: AUDIT_RETENTION_DAYS per event class + audit
throttle rate
- api/exceptions.py: wires access.permission_denied audit event on every
PermissionDenied exception (M1 integration point)
- tests/test_audit.py: 26-event taxonomy coverage, immutability, retention,
API permission, PII gating, and service helper unit tests
Co-Authored-By: Paperclip <noreply@paperclip.ing>
