[#14683][5.1.x] Metadata tracker - fixes

[etj]

• open the tracking block before the resource is touched, so that what set_missing_info() writes is part of the change and not of its premises
• bracket the subclass managers: they change the resource both before and after delegating to the base one
• pass the user on from the geoapps manager and the upload handlers
• do not let an unresolvable default user break the change being tracked

Checklist

Reviewing is a process done by project maintainers, mostly on a volunteer basis. We try to keep the overhead as small as possible and appreciate if you help us to do so by completing the following items. Feel free to ask in a comment if you have troubles with any of them.

For all pull requests:

• Confirm you have read the contribution guidelines
• You have sent a Contribution Licence Agreement (CLA) as necessary (not required for small changes, e.g., fixing typos in the documentation)
• Make sure the first PR targets the master branch, eventual backports will be managed later. This can be ignored if the PR is fixing an issue that only happens in a specific branch, but not in newer ones.

The following are required only for core and extension modules (they are welcomed, but not required, for contrib modules):

• There is a ticket in https://github.com/GeoNode/geonode/issues describing the issue/improvement/feature (a notable exemption is, changes not visible to end-users)
• The issue connected to the PR must have Labels and Milestone assigned
• PR for bug fixes and small new features are presented as a single commit
• PR title must be in the form "[Fixes #<issue_number>] Title of the PR"
• New unit tests have been added covering the changes, unless there is an explanation on why the tests are not necessary/implemented

Submitting the PR does not require you to check all items, but by the time it gets merged, they should be either satisfied or inapplicable.

[Copilot]

Copilot review overview

🟡 Changes recommended

Map creation remains incompletely scoped, causing subclass mutations to be omitted from the creation change.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Keep create metadata mutations within the subclass tracking scope · New
• Add regression test for default_user failure during tracker scope exit · New

What changed in this PR

Improves metadata audit tracking boundaries and user attribution across resource managers and upload handlers.

Changes:

• Opens tracking before resource mutations.
• Propagates initiating users through update paths.
• Prevents unresolved default users from breaking operations.

File	Description
geonode/​upload/​handlers/​common/​vector.py	Passes the execution user to updates.
geonode/​upload/​handlers/​common/​remote.py	Attributes remote overwrites.
geonode/​upload/​handlers/​common/​raster.py	Attributes raster overwrites.
geonode/​resource/​manager.py	Starts tracking before initial mutations.
geonode/​metadata/​tracking/​operation.py	Handles default-user resolution failures.
geonode/​maps/​manager.py	Groups map update mutations.
geonode/​geoapps/​manager.py	Groups GeoApp mutations and propagates users.
geonode/​documents/​manager.py	Groups document creation mutations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 90.45226% with 19 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (5.1.x@a329dc2). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff            @@
##             5.1.x   #14699   +/-   ##
========================================
  Coverage         ?   75.58%           
========================================
  Files            ?      993           
  Lines            ?    62843           
  Branches         ?     8649           
========================================
  Hits             ?    47498           
  Misses           ?    13430           
  Partials         ?     1915           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot review overview

🟡 Changes recommended

Upload workflows remain split across tracker operations, and authenticated map updates can still be attributed to the default user.

Review effort: Balanced
Findings: 3

Open (3)

• Map update omits authenticated user from metadata audit tracking · New
• Overwrite XML update splits audit operation and misattributes actor · New
• Nested XML update creates split audit records and loses actor attribution · New

Resolved since last review (2)

• Keep create metadata mutations within the subclass tracking scope
• Add regression test for default_user failure during tracker scope exit

[etj]

One note related to last forced push. Passing user= to the map update flips a gate: MapResourceManager.update guards on if extent or request_user, so _apply_extent_and_role_defaults() now runs on every map update rather than only when an extent is supplied. That is safe today only because of a bug --" manager.py:1055 does setattr(user, field, ...) where field iterates ["is_approved", "is_published", "featured"], which are ResourceBase fields. It writes to the in-memory User, never saved, so the permission guard is a no-op.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new map attribution test mocks out the tracking path and cannot detect the regression it claims to cover.

Review effort: Balanced
Findings: 1

Open (1)

• Test bypasses metadata tracking and fails to verify attribution · New

Resolved since last review (3)

• Nested XML update creates split audit records and loses actor attribution
• Overwrite XML update splits audit operation and misattributes actor
• Map update omits authenticated user from metadata audit tracking