Confluence Deleted Page Not in Trash? What Still Survives

1:34Before I really panic, let me see what Confluence does with a deleted page on its own, using a page I can do whatever I want with, our Remote Work Policy.

1:42It sits inside HR Policies, which only a few people can open, so it's locked away as well, and the Share menu says Restricted by a parent.

1:51So I delete it from the page's menu.

1:58Confluence warns me that once it's deleted, the parent's lock won't protect it anymore. Hang on to that, it comes back later.

2:07And there it is in the trash, where a space admin can bring it back or purge it.

2:12What the trash doesn't tell you is who deleted it. There's just no column for that.

2:17And somebody put my security policy in there before I ever emptied it. Who did that? I'll have to figure that out myself, and I have a hunch.

2:28And I'm not the only one who wants to know. People have been asking Atlassian for a deleted-by column in the trash since two thousand and five.

2:37Anyway, back to my test page.

2:40I want it back, so I hit Restore.

2:43And it's back. Well, sort of. It came back at the top of the space instead of inside HR Policies.

2:52And remember that warning? The lock didn't come back with it. The Share menu now says Open, so anyone in the space can read it. So if you ever restore a page, move it back where it was and check who can see it.

3:06Now I'm going to do on purpose what I did by accident. I delete it again, and this time I purge it from the trash.

3:15Confluence asks one more time, and now it spells it out. This action cannot be undone.

3:23Purged. It's only our test page, and yes, I meant it.

3:30So Confluence on its own can't bring a purged page back. The only way back is a backup made before the purge.

3:39Atlassian sells one, called Backup and Restore. It's a paid add-on for Confluence's two top plans, Premium and Enterprise, built to get a whole site back after a disaster, so it backs up all your spaces in one go.

3:53Restoring works the same way, all of it at once, and only into an empty Confluence, never into the one you're working in. So to get one page back, you'd need a second, empty site to restore everything into, just to fish that page out.

4:07It also leaves out what apps store, and our approvals live in an app. For one purged policy, then, a whole-Confluence restore is a big hammer that still wouldn't give me what I actually need, which is proof of who approved it, and why.

4:22That proof was never only on the page, though. Sentinel Vault, the approvals app my bosses at LeanZero make, keeps its own record of every request and every approval. So when the page went, that record shouldn't have gone with it. In theory.

4:39Every space that uses it gets a Sentinel Vault page in the sidebar...

4:46...and there's an Activity tab with everything the app did, or was asked to do, in this space.

4:52Okay, moment of truth. Take a guess. Did the purge take this history with it?

4:59There it is. Approval given. Iris approved version two of the policy, and her reason is still there too, read in full, and the signed copy matches.

5:10So I didn't purge the whole record after all. The page is gone, but the proof is still here. So if an auditor ever asks you who approved a page that's gone, and why, this is where you look.

5:23Let me pull out just this policy's rows for the auditor, so I'll type its title into the filter.

5:31Hmm. Nothing matches, and the rows were right there a second ago.

5:37Wait, look at the page column. There's no name anywhere, just the word Page and a long number. The only clue it's my policy is the signed file's name in one row.

5:50Okay, that one's on us. Our app remembered who did what and when, and forgot to write down what the page was called.

6:00And the spreadsheet I'd actually hand to that auditor has the same problem. The title column is empty.

6:08It's our app, so I'm going to fix it, right now, in the actual code.

6:13If you build apps on Forge, Atlassian's platform for apps like this one, here's the mistake we made. Our app saved only a page's number, and trusted it could always ask Confluence for the name later. I'll find where the name gets lost, catch it with a test, fix it, and prove the fix. Not a developer? Stick around anyway, because after that I try it on a real page.

6:36This is where each row of that history gets written. It saves the page's ID, which is just the number Confluence gives every page, and nothing about what the page was called.

6:47So how do the pages that still exist get a name? Every time the report opens, it asks Confluence for each title. Once a page is purged, there's nobody left to ask, so you get the number instead.

7:01That's the whole mistake. If your app is going to need something later, like a page's name, it has to write it down while Confluence can still tell it.

7:19First I'll write a test, a little script that plays the bug back. An approved page called Travel policy gets purged, and its history should still say Travel policy. I want to see it fail first, so I know I can trust it.

7:34It starts with an approved page called Travel policy, with its history already written, just like our policy this morning.

7:49It doesn't even need a real site. The test fakes Confluence, and deleting the page from that fake answers just like a purge does.

8:05Then it asks for the space's report and the spreadsheet export, and both should still say Travel policy. Right now, I'm betting they don't.

8:31Red, which in testing means it fails. Every row says Page five hundred and one, and the title column in the spreadsheet is empty. That's the bug, right there.

8:41Now the fix.

8:43When a row gets written, the page still exists, and the app is already asking Confluence which space it's in. That answer includes the title, so keeping it costs nothing extra.

8:59Down where the row gets written, the helper that looked up the page's space now hands back its name too.

9:21Before it goes in, the name is cut at two hundred and fifty-five characters, the same cap the app already puts on the other names it keeps.

9:29In the row itself, it's one line, and the name now sits right next to the page's ID.

9:35Now the other end, the report that reads these rows. A page's name can give things away, so keeping a copy means deciding again who sees it, and here that's only space and site admins.

10:06Then I hand that admin check to the code that fills in the page names, and it only gets asked when a stored name might be shown.

10:14And even they only see the stored name once Confluence can't tell the report the name any more.

10:26If the page still exists, its live name wins, so a page renamed since then shows its new name.

10:43That's every change. Now the exact same test as before, untouched, gets another go.

10:52Green! All fifty-three checks pass, so the purged page keeps its name now.

11:06And the rest of the tests? Still green, so nothing they check got broken.

11:15Then two linters. Forge lint is the one to know: it reads your manifest and your code, and catches things like a missing permission before you deploy.

11:29I commit the change, which saves it with a note on what it fixes, and send it up to GitHub.

11:35The note says what changed and why, so whoever reads the history later doesn't have to guess.

11:53Then I build it and deploy it, which installs it on our test site. It went out in a Sentinel Vault update the same night.

12:03This fix didn't need any new permissions, so Forge rolls the update out to installed sites on its own. One that did would have to wait for each site's admin to approve them.

12:14So that's the rule I'm taking with me. Write it down while you still can. Now, a real page.

12:22So here's a fresh one, the Acceptable Use Policy, also approved by Iris, sitting in the trash.

12:29I'll purge just this one page this time, not the whole trash.

12:35Back to the Activity report. Moment of truth, again.

12:41Acceptable Use Policy! The page is purged, and its history still has its name.

12:50And the title filter that found nothing earlier finds it now.

12:54There's one catch though, and it's on me. Only history written from now on keeps the name, so my Information Security Policy stays a number. I'll live with that one.

13:05So, is it really gone? The page, yes, unless a backup made before the purge still has it. The proof, no.

13:14What Sentinel Vault kept is the proof, who approved which version and why, and now the page's name as well. What it never knew, and what the trash never showed me, is who put my policy in there in the first place. My guess? Theo. Again.

13:30I've put a short checklist behind the link on screen, things to check before anyone empties the trash. Today, that someone was supposed to be me.

13:42Oh, and I still have a job. I checked.

13:47Next time, over in Jira, where teams track their work: a piece of work moves on with a field filled in, but filled in wrong. My bosses built an app for that too, CogniRunner, which checks the work against your rules before it can move on. See you there!