Audit shared-library source writes

A shared source goes live in every flow using it the moment it is saved, so
the write is recorded in the audit trail like a publish. Private source saves
stay drafts and are not audited.

backend/tests/api/routes/test_flows.py

@@ -581,3 +581,37 @@ def test_a_shared_node_in_use_is_retired_only_with_detach(
     assert source.json()["code"] == WORKING_NODE
 
     client.delete(f"{PREFIX}/shared", headers=superuser_token_headers)
+
+
+def test_a_shared_source_write_is_audited(
+    client: TestClient,
+    superuser_token_headers: dict[str, str],
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """It goes live at once, so it is recorded like a publish."""
+    client.put(
+        f"{PREFIX}/audited", headers=superuser_token_headers, json=a_flow("audited")
+    )
+    client.post(
+        f"{PREFIX}/audited/nodes/sensor/share",
+        headers=superuser_token_headers,
+        json={"lib_name": "audited_reading"},
+    )
+
+    published: list[dict] = []
+    monkeypatch.setattr(event_bus, "publish", published.append)
+    client.put(
+        f"{PREFIX}/audited/nodes/sensor/source",
+        headers=superuser_token_headers,
+        json={"code": WORKING_NODE},
+    )
+
+    (audit,) = [e for e in published if e["type"] == "audit"]
+    assert audit["action"] == "edited shared node 'audited_reading'"
+    assert audit["flow"] == "audited"
+
+    client.delete(
+        f"{PREFIX}/library/audited_reading?detach=true",
+        headers=superuser_token_headers,
+    )
+    client.delete(f"{PREFIX}/audited", headers=superuser_token_headers)