feat(events): show who performed an administrative action - #237
Merged
Conversation
The API records the acting administrator separately from the subject of an action. An administrative event names two people, and rendering only the subject reads as though they did it to themselves, which is the thing the API change set out to fix. The User column now shows the target with the administrator beneath it, each linking to their own detail page, and administrative events are labelled as such rather than as ordinary user-linked events. Refs fells-code/seamless-auth-api#159
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Client half of fells-code/seamless-auth-api#159. Pairs with fells-code/seamless-auth-api#188.
Why
The API now records the acting administrator in
actor_user_id, separately from the subject of the action inuser_id. Without surfacing it the column is recorded but invisible, which the issue notes would leave the fix delivering no operational value.An administrative event names two people. Rendering only the subject reads as though they revoked their own sessions and deleted their own passkeys, which is exactly the misreading the API change set out to fix.
What
@seamless-auth/typesbumped to 0.10.0Verification
71 files, 409 tests, 2 new: an administrative event rendering both parties and the administrative label, and an ordinary user event staying unattributed.
typecheck,lint,format:checkclean.Merge order
Safe to merge before or after the API change.
actor_user_idis optional in the shared schema, so an event without one renders exactly as it does today.