feat(glossary-admin): show who changed each term, explain Active/Inactive and dashboard, offer only active portfolios

[yecksin]

Adjustments to the glossary admin panel requested on 2026-09-15 — Jira CLR-56.

Flow: feature → dev-v2 (test on clarisatest) → feature → staging → main. The branch is already merged into dev-v2 (d9f38449) and deployed on clarisatest since 2026-09-15 22:03 UTC — dev-v2 takes direct merges, so there is no separate PR for that hop; this PR is the next one, to staging.

What is still missing before merging: somebody with a session on clarisatest opening clarisa-panel/manage/glossary-admin and looking at it. Everything else (tests, lint, build, SonarCloud, the public contract) is verified and listed below.

What changes

• Last change column. Who changed each record last, and when. GlossaryAdminDto gains last_modified_at and last_modified_by — updated_by/updated_at, falling back to the creator when the row was never edited. The authors of the whole list are resolved in one query. An id that matches no user shows "Unknown user" instead of failing the list.
• What Active and Inactive mean, as a tooltip on the Status header and on every status tag: active terms are published in the public glossary and returned by GET api/glossary; inactive ones are hidden from both, nothing is deleted.
• What "Show in dashboard" means, under the checkbox in the term dialog and in bulk upload: it only adds the term to GET api/glossary/dashboard and does not change the public glossary page. Verified in glossary.controller.ts / glossary.service.ts.
• Only active portfolios in the pickers (term dialog, bulk upload, filter). Today that hides only CGIAR portfolio 2016-2021, which is inactive in test and production. A closed portfolio a term is already linked to stays in that term's edit dialog, marked (closed), so saving never drops the link.
• mergeInto refuses an inactive target (409). The panel already hid "Merge into" for inactive terms; a direct call could move portfolios onto a hidden row with no error. Raised in the review of release: glossary versioning per portfolio, expired sessions that log out, and the visual revamp #201.

Contract

• GET api/glossary and GET api/glossary/dashboard: unchanged.
• Admin endpoints: two new keys on each term, nothing removed.
• No migrations.

Verification

• Back 947/947, eslint and tsc clean. Front 362/362, development build clean.
• New tests: merge into an inactive term is rejected and nothing is saved; the author of the last change comes from updated_by or the creator, in a single user lookup, and an unknown id leaves it empty; pickers offer only active portfolios and keep a closed one the term already carries.

Not covered

• The public glossary page and the API documentation iframe are not touched.
• The last change is what the database records. Rows written directly into the database without updated_by show their creator.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud