hub(D62): restore_copy_deleted accepted and operator-only — the household's restore-copy delete is recorded (test red first)

hub/internal/api/d62_restore_copy_event_test.go

@@ -0,0 +1,19 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// D62 (operator 2026-10-29): the household's „Törlés most" on a restore copy sends restore_copy_deleted (who, app,
+// date, size). It is accepted from a box (an unlisted type is a 400 and the record is lost) AND operator-only — both
+// registers, same commit. RED-PROOF: seen failing before either entry existed.
+func TestD62_RestoreCopyDeletedIsAllowedAndOperatorOnly(t *testing.T) {
+	if !allowedEventTypes["restore_copy_deleted"] {
+		t.Errorf("restore_copy_deleted is not in allowedEventTypes — POST /event would 400 and the record would be lost")
+	}
+	if !notify.IsOperatorOnly("restore_copy_deleted") {
+		t.Errorf("restore_copy_deleted is not operator-only")
+	}
+}

hub/internal/api/handler.go

@@ -2432,6 +2432,10 @@ var allowedEventTypes = map[string]bool{
 	"app_unexplained_upload_cleared": true,
 	"app_unexplained_cpu":            true,
 	"app_unexplained_cpu_cleared":    true,
+	// D62 (operator 2026-10-29; controller „Törlés most" on a restore copy): the household deleted a restore copy by hand
+	// — who, app, the restore's date, size. Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same
+	// commit.
+	"restore_copy_deleted": true,
 	// Special
 	"test": true,
 }

hub/internal/notify/dispatcher.go

@@ -915,6 +915,10 @@ var operatorOnlyEvents = map[string]bool{
 	"app_unexplained_upload_cleared": true,
 	"app_unexplained_cpu":            true,
 	"app_unexplained_cpu_cleared":    true,
+	// D62 (operator 2026-10-29). The household deleted a restore copy with „Törlés most" on its own box: the audit line
+	// for support (who, app, date, size). The household did it and saw the warning; the record is the operator's.
+	// Registered in the same commit that mints it.
+	"restore_copy_deleted": true,
 	// R-971 (v0.157.0, controller v0.328.0, operator decision D2 = A). The box's catalog allow-list refused an app's
 	// definition: someone pushed a catalog change asking for container rights the box does not give. The household can
 	// do nothing; its app page says the app keeps its last good definition. Registered in the same commit that mints it.