Legal holds, step 2: who a hold covers

A hold reaches an account by name, through any of its addresses'
domains, its groups or its tenant, as they are now, so an account added
to a held domain later is held too. An account that leaves a held
domain, group or tenant stays held: the registry write hook adds it to
the hold by name on every account change, whoever makes it (LH-2).
Server::holds_on answers for the deletion paths, from the store each
time so a hold binds every node at once.

crates/common/src/audit.rs

@@ -14,6 +14,7 @@ use crate::{
     auth::{AccessToken, AuthRequest, permissions::DefaultPermissions},
 };
 use directory::Credentials;
+use inbuxa_features::hold::{self, Member};
 use inbuxa_features::audit::{
     Action, Actor, AuditLog, EntryId, Outcome, Record, Target, Via, diff, log, scope,
 };
@@ -495,6 +496,20 @@ impl RegistryWriteHook for SystemWrites {
         change: RegistryChange<'a>,
     ) -> Pin<Box<dyn Future<Output = ()> + Send + 'a>> {
         Box::pin(async move {
+            // LH-2: every change to an account, whoever makes it: one that
+            // leaves a held domain, group or tenant stays held by name
+            if change.object_type == ObjectType::Account
+                && let (Some(before), Some(after)) = (change.before, change.after)
+                && let (Some(before), Some(after)) = (
+                    Member::of(change.id.document_id(), &before.inner),
+                    Member::of(change.id.document_id(), &after.inner),
+                )
+                && let Err(err) = hold::keep_moved(&self.data, &before, &after).await
+            {
+                trc::error!(err
+                    .account_id(after.account)
+                    .details("Failed to keep a moved account under its legal hold"));
+            }
             let subsystem = match scope::current() {
                 Some(scope::Scope::Request | scope::Scope::Quiet) => return,
                 Some(scope::Scope::System(subsystem)) => subsystem,