Legal holds, step 2: who a hold covers

A hold reaches an account by name, through any of its addresses'
domains, its groups or its tenant, as they are now, so an account added
to a held domain later is held too. An account that leaves a held
domain, group or tenant stays held: the registry write hook adds it to
the hold by name on every account change, whoever makes it (LH-2).
Server::holds_on answers for the deletion paths, from the store each
time so a hold binds every node at once.

crates/common/src/audit.rs

@@ -14,6 +14,7 @@ use crate::{
     auth::{AccessToken, AuthRequest, permissions::DefaultPermissions},
 };
 use directory::Credentials;
+use inbuxa_features::hold::{self, Member};
 use inbuxa_features::audit::{
     Action, Actor, AuditLog, EntryId, Outcome, Record, Target, Via, diff, log, scope,
 };
@@ -495,6 +496,20 @@ impl RegistryWriteHook for SystemWrites {
         change: RegistryChange<'a>,
     ) -> Pin<Box<dyn Future<Output = ()> + Send + 'a>> {
         Box::pin(async move {
+            // LH-2: every change to an account, whoever makes it: one that
+            // leaves a held domain, group or tenant stays held by name
+            if change.object_type == ObjectType::Account
+                && let (Some(before), Some(after)) = (change.before, change.after)
+                && let (Some(before), Some(after)) = (
+                    Member::of(change.id.document_id(), &before.inner),
+                    Member::of(change.id.document_id(), &after.inner),
+                )
+                && let Err(err) = hold::keep_moved(&self.data, &before, &after).await
+            {
+                trc::error!(err
+                    .account_id(after.account)
+                    .details("Failed to keep a moved account under its legal hold"));
+            }
             let subsystem = match scope::current() {
                 Some(scope::Scope::Request | scope::Scope::Quiet) => return,
                 Some(scope::Scope::System(subsystem)) => subsystem,

crates/common/src/hold.rs

@@ -0,0 +1,43 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! inbuxa: which legal holds cover an account (audit-hold-lock spec, LH-2,
+//! LH-11), for the paths that destroy data. Read from the store every time,
+//! not cached: a hold placed on one node must bind every node at once, and
+//! there are few holds.
+
+use crate::Server;
+use inbuxa_features::hold::{self, Hold, Member};
+
+impl Server {
+    /// The active holds covering `account_id`, through its own name, its
+    /// addresses' domains, its groups or its tenant. Empty for an account
+    /// that no longer exists: a deleted one is kept by LH-8's own check.
+    pub async fn holds_on(&self, account_id: u32) -> trc::Result<Vec<Hold>> {
+        let Ok(account) = self.account(account_id).await else {
+            return Ok(Vec::new());
+        };
+        let mut domains = account
+            .addresses
+            .iter()
+            .map(|address| address.domain_id)
+            .collect::<Vec<_>>();
+        domains.sort_unstable();
+        domains.dedup();
+        let member = Member {
+            account: account_id,
+            domains,
+            groups: account.id_member_of.iter().copied().collect(),
+            tenant: account.id_tenant,
+        };
+        hold::covering(self.store(), &member).await
+    }
+
+    /// Whether any active hold covers `account_id` at all.
+    pub async fn is_held(&self, account_id: u32) -> trc::Result<bool> {
+        Ok(!self.holds_on(account_id).await?.is_empty())
+    }
+}

crates/common/src/lib.rs

@@ -68,6 +68,7 @@ use utils::{
 pub mod auth;
 pub mod cache;
 pub mod audit; // inbuxa: the audit log (audit-hold-lock spec, AU)
+pub mod hold; // inbuxa: legal holds (audit-hold-lock spec, LH)
 pub mod config;
 pub mod expr;
 pub mod i18n;