command_tower 0.11.0 → 0.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2becbc85a78f04d571714ca6a99a1442cc0bc9c270a322fe25d8d3881af9252
-  data.tar.gz: ab5432203fd213f203bdd1e5fc2af0ea81a873c5b0ee9fdd25afa357aca50988
+  metadata.gz: d495e295241fa7ac4f9179acc5fd2d4c47fcb8a0603dccdf5353ac08e7c98b28
+  data.tar.gz: 9d56364ffd4a79ad9bcabe07e2713a2613b2d43112039bc5f31db855f3baad2d
 SHA512:
-  metadata.gz: 8622b2e00ceb1218df245a00aad41f17e8840779e2f4b91531cdeecc6316bfa18305ce06c569e5a92582819875c87a58acb8ef396cfdcecfcc69752715e99671
-  data.tar.gz: 391cca33f7e186d24fa8f904be8a4f3dad6f5cb12d9615c84e54da2b0e59dc2fb4f49c8bd4279ca41083e204e8735e5864a575fc9c09e5de6694ce2afc2ace94
+  metadata.gz: f605fe2a8117b8e5b6af32dc7c65df55c9400a33a5d50220f5a0c992efd74f28545a8fbfe8c293982f062f398dcc3b86aa552de12d1ec87f733e5a2d6435169e
+  data.tar.gz: 85072dd065a8589a239166286a2261a331a7cd9c59e0b0c7eb870e5bc60dcfdeb4d32df84671015a93d2edcd3a93592e7647210cf5f553c4a47a346abb214bdb

data/app/models/command_tower/audit/event.rb

@@ -17,11 +17,13 @@ module CommandTower
       validates :scope_class, inclusion: { in: SCOPE_CLASSES.values }
       validates :originating_administrator_id, presence: true, if: :impersonation_active?
 
-      after_initialize do
-        write_attribute(:change_set, {}) if has_attribute?(:change_set) && read_attribute(:change_set).nil?
-        write_attribute(:metadata, {}) if has_attribute?(:metadata) && read_attribute(:metadata).nil?
-        write_attribute(:sensitive_fields, []) if has_attribute?(:sensitive_fields) && read_attribute(:sensitive_fields).nil?
-      end
+      # Force JSON attribute types so writes are JSON.generate'd on every adapter.
+      # MySQL 8 already maps t.json → Type::Json (serialize is rejected). MariaDB
+      # often stores t.json as LONGTEXT + json_valid CHECK and would otherwise
+      # persist Hash#inspect — failing the CHECK (HTTP 500 on login_failed audit).
+      attribute :metadata, :json, default: -> { {} }
+      attribute :change_set, :json, default: -> { {} }
+      attribute :sensitive_fields, :json, default: -> { [] }
 
       before_update :reject_mutation
       before_destroy :reject_mutation

data/db/migrate/20260816000001_create_command_tower_audit_events.rb

@@ -2,7 +2,7 @@
 
 class CreateCommandTowerAuditEvents < ActiveRecord::Migration[7.2]
   def change
-    create_table :command_tower_audit_events, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci" do |t|
+    create_table :command_tower_audit_events do |t|
       t.string :event_uuid, null: false
       t.string :action, null: false
       t.datetime :occurred_at, null: false

data/docs/upgrades/0.11.1.md

@@ -0,0 +1,25 @@
+# Upgrade: CommandTower 0.11.1
+
+**From:** `0.11.0`  
+**To:** `0.11.1`
+
+Patch release for MariaDB-safe audit persistence and install migrations.
+
+## Host-visible changes
+
+| Change | Host impact |
+|--------|-------------|
+| `CommandTower::Audit::Event` JSON coding | `metadata`, `change_set`, and `sensitive_fields` declare `attribute :…, :json`. Forces JSON encoding on MySQL 8 and MariaDB (where `t.json` is often LONGTEXT + `json_valid` CHECK). Fixes HTTP 500 `ActiveRecord::CheckViolation` on failed-login audit writes. |
+| Audit events migration collation | Engine migration no longer hardcodes MySQL 8–only `utf8mb4_0900_ai_ci`. Fresh installs / `command_tower:install:migrations` copies inherit the database default (e.g. `utf8mb4_unicode_ci` on MariaDB 10.11). |
+
+## Host actions
+
+1. Bump gem to `0.11.1` and deploy.
+2. **No new migration** is required if `command_tower_audit_events` already exists.
+3. Already-installed host copies of the audit migration that still contain `utf8mb4_0900_ai_ci` only matter for **new** databases; runtime login fix does not depend on re-running that migration.
+4. Smoke: unknown-user `POST /auth/plain-text/login` should return auth failure (e.g. `invalid_credentials`), **not** `internal_error` / 500.
+
+## Not in this release
+
+- Jumbotron / host `t.json` columns outside CommandTower
+- Altering charset/collation on already-created production audit tables

data/docs/upgrades/README.md

@@ -4,6 +4,7 @@ Host-facing upgrade / change summaries for CommandTower releases.
 
 | Version | Summary |
 |---------|---------|
+| [0.11.1](0.11.1.md) | Audit Event `attribute :json` (MariaDB); audit migration without `utf8mb4_0900_ai_ci` |
 | [0.11.0](0.11.0.md) | Execution context, audit ledger, Admin Workspace, principal capabilities, impersonation, Admin Users |
 | [0.10.0](0.10.0.md) | Modern Auth/Me/Messaging platform; SchemaHelper removal; host RBAC required |
 

data/lib/command_tower/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CommandTower
-  VERSION = "0.11.0"
+  VERSION = "0.11.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: command_tower
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.1
 platform: ruby
 authors:
 - matt-taylor
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-21 00:00:00.000000000 Z
+date: 2026-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: phonelib
@@ -759,6 +759,7 @@ files:
 - docs/testing.md
 - docs/upgrades/0.10.0.md
 - docs/upgrades/0.11.0.md
+- docs/upgrades/0.11.1.md
 - docs/upgrades/README.md
 - lib/command_tower.rb
 - lib/command_tower/admin_scope.rb