Editor tracking: who created and last edited each feature, and when

[giswqs]

Summary

Optional editor tracking on editable layers: maintained created_by, created_at, edited_by, edited_at fields, written automatically on every feature create and update.

Why

When a feature changes, GeoLibre keeps no record of who changed it or when. The undo stack covers the current session and is cleared by loadProject (and, in a collaboration session, by any incoming remote snapshot — see docs/collaboration.md). Once the project is saved and reopened, the edit history is gone entirely.

That is tolerable for one person editing their own file and unworkable for anything shared:

• a field-collection or classroom workflow where several people edit one dataset and someone has to reconcile it;
• reviewing what changed between two versions of a project, which is currently a diff of coordinates with no attribution;
• answering "when was this last checked?" — a question about the data, not the file, and one that no file timestamp can answer per feature.

It is also a hard prerequisite for two other items in the access-control umbrella: own-features-only view definitions have nothing to match on without a creator column, and an audit log of feature edits has nothing to record.

Proposal

1. Opt-in per layer

A layer property enabling tracking, off by default. When enabled, ensure the four fields exist (creating them if absent) and mark them as maintained: not user-editable in the attribute table, not offered as targets in Field Calculator, and visually distinguished the way derived columns already are.

2. Written on every write path

The attribute table's cell edits, Field Calculator runs, geometry edits, feature creation from drawing tools, feature delete (where a tombstone makes sense), and the sidecar's postgis_write. One helper, called from each, rather than per-call-site logic.

3. Identity, with an honest fallback

• Signed in: the account identity, resolved server-side for server-backed layers so the client cannot claim to be someone else. This is the only variant that can be trusted.
• Collaboration session: the relay-assigned participant identity — the relay already assigns clientId server-side precisely so a participant cannot claim another's, which is the right authority to use.
• Local, not signed in: a local editor name from Settings, defaulting to the OS username. Label this clearly in the UI as self-reported. It is useful provenance, not attribution, and the docs should say so.

4. Surface it

Show the tracking fields in the identify popup and as attribute-table columns, and offer "sort by last edited" — the smallest thing that makes the feature immediately worth having rather than an invisible column.

Scope notes

• Editable layers only, per the per-layer capability issue. Read-only remote services are unaffected.
• For PostGIS layers, prefer real columns and let the server stamp them; a client-supplied edited_by is a claim, not a fact.
• Adding fields changes the schema of the user's data. Ask before modifying a layer that already has features, and never silently rename a colliding existing created_by.
• Keep the field names configurable — a table that already uses these names for its own purposes must not be trampled.

Effort

Medium, and independently useful — this can land before any identity work, with the self-reported fallback.

---

Part of #1665 (access control umbrella).