forest_admin_agent 1.38.2 → 1.39.0

data/lib/forest_admin_agent/audit_trail/capture.rb

@@ -0,0 +1,229 @@
+module ForestAdminAgent
+  module AuditTrail
+    # Datasource-agnostic capture layer, installed by the agent factory as soon as an audit-trail database is
+    # configured. It instruments every collection through the Forest customizer hooks, so it behaves the same
+    # whatever the audited datasource is (ActiveRecord, Mongoid, ...).
+    #
+    # Every operation is recorded twice: a PENDING row before the write, confirmed DONE after it. One code
+    # path in both `critical` modes, so `status` always means the same thing — and what the protocol buys is
+    # that no write goes unaudited, not that every row holds exact after-values. A row left pending says the
+    # write may or may not have landed, which is evidence rather than a defect.
+    class Capture
+      include Recording
+
+      # Signature imposed by DatasourceCustomizer#use; the agent always instruments the whole datasource.
+      def run(datasource_customizer, _collection_customizer = nil, options = {})
+        @store = options[:store]
+        @redact = options[:redact] || {}
+        @snapshots = Snapshots.new
+
+        datasource_customizer.collections.each_value { |collection| instrument(collection) }
+      end
+
+      private
+
+      def instrument(collection_customizer)
+        schema = collection_customizer.collection.schema
+        # Writable columns only: Forest audits what it writes. Read-only fields cover computed/virtual
+        # fields and DB-managed columns, none of which Forest mutates.
+        columns = schema[:fields].select do |_name, field|
+          field.type == 'Column' && !field.is_read_only
+        end.keys
+        primary_keys = ForestAdminDatasourceToolkit::Utils::Schema.primary_keys(collection_customizer.collection)
+        # Reads must carry the primary keys (even read-only ones) so the record id can be built; the
+        # diff itself stays restricted to the writable columns.
+        projection = ForestAdminDatasourceToolkit::Components::Query::Projection.new(
+          (primary_keys + columns).uniq
+        )
+        target = { columns: columns, primary_keys: primary_keys, projection: projection,
+                   name: collection_customizer.name }
+
+        add_create_hooks(collection_customizer, target)
+        add_update_hooks(collection_customizer, target)
+        add_delete_hooks(collection_customizer, target)
+      end
+
+      # The "after" hooks are prepended: `execute_after` stops at the first exception, so a customization
+      # raising in its own after hook would otherwise drop the record of a write that already happened.
+      # The "before" hooks stay appended, so they read the data, filter and patch every other customization
+      # has had its say on.
+      def add_create_hooks(collection_customizer, target)
+        collection_customizer.add_hook('Before', 'Create') do |context|
+          # No record id yet — that is what the column being nullable is for.
+          rows = [{ record_id: nil, new_values: pick(context.data, target[:columns]) }]
+
+          @snapshots.push(context.data, ids: pending_rows(context.caller, 'create', target[:name], rows))
+        end
+
+        collection_customizer.add_hook('After', 'Create', prepend: true) do |context|
+          pending = @snapshots.pop_for(context.data)
+          next unless pending
+
+          confirm(pending[:ids].first,
+                  record_id: record_id(context.record, target[:primary_keys]),
+                  new_values: redacted(target[:name], pick(context.record, target[:columns])))
+        end
+      end
+
+      def add_update_hooks(collection_customizer, target)
+        collection_customizer.add_hook('Before', 'Update') do |context|
+          records = @snapshots.take(context, target[:projection])
+          @snapshots.push(
+            context.filter,
+            records: records,
+            patch: context.patch,
+            ids: pending_rows(
+              context.caller, 'update', target[:name],
+              records.map do |record|
+                { record_id: record_id(record, target[:primary_keys]),
+                  previous_values: pick(record, context.patch.keys & target[:columns]),
+                  new_values: pick(context.patch, target[:columns]) }
+              end
+            )
+          )
+        end
+
+        collection_customizer.add_hook('After', 'Update', prepend: true) do |context|
+          pending = @snapshots.pop_for(context.filter)
+          next unless pending
+
+          confirm_updates(context, pending, target)
+        end
+      end
+
+      def add_delete_hooks(collection_customizer, target)
+        collection_customizer.add_hook('Before', 'Delete') do |context|
+          records = @snapshots.take(context, target[:projection])
+          @snapshots.push(
+            context.filter,
+            records: records,
+            ids: pending_rows(
+              context.caller, 'delete', target[:name],
+              records.map do |record|
+                { record_id: record_id(record, target[:primary_keys]),
+                  previous_values: pick(record, target[:columns]) }
+              end
+            )
+          )
+        end
+
+        collection_customizer.add_hook('After', 'Delete', prepend: true) do |context|
+          pending = @snapshots.pop_for(context.filter)
+          next unless pending
+
+          pending[:ids].each { |id| confirm(id) }
+        end
+      end
+
+      # The diff is taken against the record as persisted, not the patch that was requested, so a value the
+      # datasource normalised or a decorator rewrote is recorded as what actually landed. The id is packed from
+      # those same values, so an update that changed a primary key files the row under the id the history will
+      # be queried by.
+      def confirm_updates(context, pending, target)
+        pks = target[:primary_keys]
+        persisted = reread(context, pending[:records], pending[:patch], target)
+        empty = []
+
+        pending[:records].each_with_index do |record, index|
+          # No row read back: the write may or may not have landed, and inventing after-values from the patch
+          # would confirm — or worse, discard — a row for something that may never have happened. Left pending,
+          # which is exactly what that state means.
+          after = persisted[record_id(record.merge(pending[:patch]), pks)]
+          next if after.nil?
+
+          delta = Diff.changed_values(record, after, target[:columns])
+
+          if delta[:new_values].empty?
+            empty << pending[:ids][index]
+          else
+            before_id = record_id(record, pks)
+            after_id = record_id(after, pks)
+
+            confirm(pending[:ids][index],
+                    record_id: after_id,
+                    # Only when the key actually moved, so a history query can walk back to the rows filed
+                    # under the id this record used to have.
+                    previous_record_id: after_id == before_id ? nil : before_id,
+                    previous_values: redacted(target[:name], delta[:previous_values]),
+                    new_values: redacted(target[:name], delta[:new_values]))
+          end
+        end
+
+        audit_safely { @store.discard(empty.compact) } if empty.any?
+      end
+
+      # Reads the updated records back in one query, keyed by their own id, so each snapshot can find what
+      # actually landed — including when the patch moved a primary key.
+      def reread(context, records, patch, target)
+        pks = target[:primary_keys]
+        return {} if records.empty?
+
+        audit_safely do
+          condition = ids_condition(pks, records.map { |record| record.merge(patch).slice(*pks) })
+          filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new(condition_tree: condition)
+
+          context.collection.list(filter, target[:projection]).to_h { |row| [record_id(row, pks), row] }
+        end || {}
+      end
+
+      # Built from the primary keys the instrumentation already resolved, rather than through
+      # ConditionTreeFactory, which would need the underlying collection a hook context does not hand out.
+      def ids_condition(primary_keys, ids)
+        leaf = ForestAdminDatasourceToolkit::Components::Query::ConditionTree::Nodes::ConditionTreeLeaf
+        factory = ForestAdminDatasourceToolkit::Components::Query::ConditionTree::ConditionTreeFactory
+
+        operators = ForestAdminDatasourceToolkit::Components::Query::ConditionTree::Operators
+
+        if primary_keys.size == 1
+          key = primary_keys.first
+
+          leaf.new(key, operators::IN, ids.map { |id| id[key] }.uniq)
+        else
+          factory.union(
+            ids.map { |id| factory.intersect(id.map { |key, value| leaf.new(key, operators::EQUAL, value) }) }
+          )
+        end
+      end
+
+      # The one place the audit trail may refuse an operation, and only under `critical: true`: if we cannot
+      # record that a write is about to happen, the write does not happen.
+      def pending_rows(caller, operation, collection, rows)
+        timestamp = now
+        correlation_key = correlation_key_for(caller)
+        identity = identity_of(caller)
+
+        AuditTrail.gate do
+          @store.append_all(
+            rows.map do |row|
+              AuditRecord.new(
+                timestamp: timestamp, operation: operation, collection: collection, status: PENDING,
+                correlation_key: correlation_key, record_id: row[:record_id],
+                previous_values: redacted(collection, row[:previous_values] || {}),
+                new_values: redacted(collection, row[:new_values] || {}),
+                **identity
+              )
+            end
+          )
+        end || []
+      end
+
+      def confirm(id, attributes = {})
+        return unless id
+
+        audit_safely { @store.confirm(id, attributes) }
+      end
+
+      def redacted(collection, values)
+        redact(values, @redact[collection] || [])
+      end
+
+      def record_id(record, primary_keys)
+        primary_keys.map { |pk| record[pk].to_s }.join('|')
+      end
+
+      def pick(record, columns)
+        columns.to_h { |column| [column, record[column]] }
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/audit_trail/diff.rb

@@ -0,0 +1,156 @@
+module ForestAdminAgent
+  module AuditTrail
+    # Minimal structural diff. Nested hashes and arrays of hashes are recursed into, so only the
+    # keys/indexes whose leaf value actually changed are kept — a single sub-field change does not
+    # store the whole object/array. Scalars, primitive arrays, dates and other values are compared and
+    # kept as a whole.
+    #
+    # Ruby's `==` already performs deep, key-order-independent equality on Hash and (ordered) equality
+    # on Array, so it is used directly as the equality primitive.
+    module Diff
+      # A key that does not exist on one side of the diff. It is never stored: the key is simply left out
+      # of that side's hash, so `{"flag" => nil}` (a key holding nil) and `{}` (no key) stay tellable
+      # apart in the database — which a revert needs and a string sentinel would only fake.
+      ABSENT = Object.new.freeze
+
+      module_function
+
+      # @return [Hash{Symbol=>Object}, nil] { previous:, next: } of the changed leaves, or nil when equal.
+      def diff(before, after)
+        return nil if before == after
+
+        return diff_hashes(before, after) if before.is_a?(Hash) && after.is_a?(Hash)
+
+        return diff_object_arrays(before, after) if object_array?(before) && object_array?(after)
+
+        { previous: before.nil? ? nil : before, next: after.nil? ? nil : after }
+      end
+
+      # Build the previous/new value hashes for the writable columns that actually changed.
+      #
+      # @param before [Hash] snapshot of the record before the change (string keys)
+      # @param patch [Hash] the values being written (string keys); only present keys are considered
+      # @param columns [Array<String>] writable column names to inspect
+      # @return [Hash{Symbol=>Hash}] { previous_values:, new_values: }
+      def changed_values(before, patch, columns)
+        previous_values = {}
+        new_values = {}
+
+        columns.each do |column|
+          delta = patch.key?(column) ? diff(before[column], patch[column]) : nil
+          next unless delta
+
+          previous_values[column] = delta[:previous]
+          new_values[column] = delta[:next]
+        end
+
+        { previous_values: previous_values, new_values: new_values }
+      end
+
+      # Arrays whose every element is a hash (record-like collections, e.g. a workflow history).
+      def object_array?(value)
+        value.is_a?(Array) && !value.empty? && value.all?(Hash)
+      end
+
+      def diff_hashes(before, after)
+        previous = {}
+        next_values = {}
+
+        (before.keys | after.keys).each do |key|
+          sub = diff_at(before, after, key)
+          next unless sub
+
+          previous[key] = sub[:previous] unless sub[:previous].equal?(ABSENT)
+          next_values[key] = sub[:next] unless sub[:next].equal?(ABSENT)
+        end
+
+        { previous: previous, next: next_values }
+      end
+
+      # A key held with a nil value is not the same thing as a missing key: recursing on the values alone
+      # reads both as nil and reports no change at all.
+      def diff_at(before, after, key)
+        return diff(before[key], after[key]) if before.key?(key) == after.key?(key)
+
+        {
+          previous: before.key?(key) ? before[key] : ABSENT,
+          next: after.key?(key) ? after[key] : ABSENT
+        }
+      end
+
+      def diff_object_arrays(before, after)
+        previous = {}
+        next_values = {}
+
+        [before.length, after.length].max.times do |index|
+          sub = diff(before[index], after[index])
+          next unless sub
+
+          # Same rule as for hash keys: an index one side does not reach is left out of that side, so a
+          # revert can tell an appended element (drop it) from one whose value became nil (keep it).
+          previous[index] = sub[:previous] if index < before.length
+          next_values[index] = sub[:next] if index < after.length
+        end
+
+        { previous: previous, next: next_values }
+      end
+
+      # Undo one recorded change: given the value as it stands now and the two sides of the diff that
+      # produced it, return the value as it was before. Nested hashes are walked so untouched keys keep
+      # their current value; a key missing from `previous` was added by the change, so it goes away.
+      #
+      # @param current [Object] the value as it stands now (may be nil when the record is gone)
+      # @param previous [Object] the `previous_values` side of the recorded diff
+      # @param changed [Object] the `new_values` side of the recorded diff
+      def revert(current, previous, changed)
+        return revert_array(current, previous, changed) if current.is_a?(Array) && partial?(previous, changed)
+        return revert_hash(current, previous, changed) if current.is_a?(Hash) && partial?(previous, changed)
+
+        previous
+      end
+
+      # Both sides being hashes is what `diff` emits for a structural diff; anything else replaced the
+      # value as a whole.
+      def partial?(previous, changed)
+        previous.is_a?(Hash) && changed.is_a?(Hash)
+      end
+
+      def revert_hash(current, previous, changed)
+        (previous.keys | changed.keys).each_with_object(current.dup) do |key, result|
+          if previous.key?(key)
+            result[key] = revert(current[key], previous[key], changed[key])
+          else
+            # Only the change introduced this key, so before the change there was none.
+            result.delete(key)
+          end
+        end
+      end
+
+      # Arrays of objects are diffed index by index, and JSON turns those indexes into strings on the way
+      # back out. Highest index first, so dropping an element the change appended leaves the lower ones
+      # where the diff expects them.
+      def revert_array(current, previous, changed)
+        indexes = (previous.keys | changed.keys).map(&:to_i).sort.reverse
+
+        indexes.each_with_object(current.dup) do |index, result|
+          if index?(previous, index)
+            result[index] = revert(current[index], at(previous, index), at(changed, index))
+          else
+            result.delete_at(index)
+          end
+        end
+      end
+
+      def index?(hash, index)
+        hash.key?(index) || hash.key?(index.to_s)
+      end
+
+      def at(hash, index)
+        hash.key?(index) ? hash[index] : hash[index.to_s]
+      end
+
+      private_class_method :diff_hashes, :diff_at, :diff_object_arrays, :partial?, :revert_hash,
+                           :revert_array, :index?, :at
+    end
+  end
+end

data/lib/forest_admin_agent/audit_trail/record_state.rb

@@ -0,0 +1,43 @@
+module ForestAdminAgent
+  module AuditTrail
+    # Rebuilds a record as it stood at a given instant by walking its history backwards from the record as
+    # it stands now, undoing every entry recorded after that instant (newest first).
+    #
+    # Only audited columns are reconstructed — read-only, computed and DB-managed fields are never recorded,
+    # so they cannot be restored.
+    module RecordState
+      module_function
+
+      # @param current [Hash, nil] the record as it stands now, nil when it no longer exists
+      # @param entries [Array<AuditRecord>] entries recorded after the instant, newest first
+      # @return [Hash, nil] the record at that instant, nil when it did not exist then
+      def at(current, entries)
+        entries.reduce(current) { |state, entry| undo(state, entry) }
+      end
+
+      def undo(state, entry)
+        case entry.operation
+        when 'create'
+          # Created after the instant, so it did not exist then. An older entry can still bring a previous
+          # life of the same id back — the walk carries on.
+          nil
+        when 'delete'
+          # The delete recorded the whole record, which is exactly the state it was deleted from.
+          entry.previous_values
+        when 'update'
+          revert_columns(state, entry)
+        else
+          # Action rows carry no field change: their two value columns hold what was submitted to the action
+          # and what it answered, so applying either as a column change would corrupt the rebuild.
+          state
+        end
+      end
+
+      def revert_columns(state, entry)
+        entry.previous_values.each_with_object((state || {}).dup) do |(column, previous), result|
+          result[column] = Diff.revert(result[column], previous, entry.new_values[column])
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/audit_trail/recording.rb

@@ -0,0 +1,57 @@
+require 'time'
+
+module ForestAdminAgent
+  module AuditTrail
+    # Shared by the two capture layers: {Capture} for the changes Forest writes, {ActionCapture} for the
+    # smart actions it runs. Holds the write protocol's vocabulary and its failure policy.
+    module Recording
+      REDACTED = '[redacted]'.freeze
+      # A row is inserted before the write and confirmed after it. One left PENDING means the write may or
+      # may not have landed — that residue is evidence, and it is the point.
+      PENDING = 'pending'.freeze
+      DONE = 'done'.freeze
+
+      IDENTITY = { user_id: :id, user_first_name: :first_name,
+                   user_last_name: :last_name, user_email: :email }.freeze
+
+      # Denormalised at write time, so the row says who acted then rather than whoever holds that id today.
+      # Read defensively: a caller built by another code path need not carry a full identity, and a
+      # NoMethodError here would refuse the write outright under `critical: true`.
+      def identity_of(caller)
+        IDENTITY.transform_values { |reader| caller.respond_to?(reader) ? caller.public_send(reader) : nil }
+      end
+
+      # Same id for every change made within one request — set on the caller by the agent (see
+      # CallerParser), mirroring the Node agent's caller.requestId.
+      #
+      # nil when the caller carries none, which is what a write outside any request looks like. Inventing one
+      # would group the row into a request of its own, indistinguishable from a genuine single-row request.
+      def correlation_key_for(caller)
+        caller.respond_to?(:request_id) ? caller.request_id : nil
+      end
+
+      def redact(values, redacted_fields)
+        return values if redacted_fields.empty?
+
+        values.each_with_object({}) do |(field, value), result|
+          result[field] = redacted_fields.include?(field) ? REDACTED : value
+        end
+      end
+
+      def now
+        Time.now.utc.iso8601(3)
+      end
+
+      # Everything after the pending insert is best-effort: by then the write has happened, so raising would
+      # report a failure for an operation that succeeded (and invite a retry that duplicates it). Losing the
+      # row is the lesser evil, so it is logged and dropped. Only the pending insert itself can refuse an
+      # operation, and only under `critical: true` — see {AuditTrail.critical?}.
+      def audit_safely
+        yield
+      rescue StandardError => e
+        AuditTrail.log_failure(e)
+        nil
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/audit_trail/snapshots.rb

@@ -0,0 +1,85 @@
+module ForestAdminAgent
+  module AuditTrail
+    # What a "before" hook leaves for the matching "after" hook: the records as they stood, the patch, and the
+    # ids of the pending rows to confirm.
+    #
+    # Entries are keyed by the object the hook decorator hands to both contexts — the filter, or the data on a
+    # create — because taking the newest entry is wrong as soon as writes nest: an inner write that fails skips
+    # its after hook and stays on the stack, and the outer hook would then confirm the failed operation's rows
+    # as done and leave its own stranded. Both directions of that are lies.
+    #
+    # An operation raising between the two hooks strands its entry, hence the cap; its rows stay `pending` in
+    # the table, which is the truthful state for a write that may not have landed.
+    class Snapshots
+      include Recording
+
+      # ponytail: 16 deep is far past any legitimate nesting; raise it if one ever gets that far.
+      MAX_PENDING = 16
+
+      def push(key, snapshot)
+        stack = pending
+        stack.shift while stack.size >= MAX_PENDING
+        stack.push(snapshot.merge(key: key))
+      end
+
+      # The entry this operation left, or nothing rather than someone else's.
+      #
+      # A customization that replaced the filter or the data leaves no identity to match on: our before hook saw
+      # the replacement and the after context carries the original. With a single operation in flight that is
+      # unambiguous, so it still pairs; with several it does not guess, and the rows stay pending.
+      def pop_for(key)
+        stack = pending
+        index = stack.rindex { |entry| entry[:key].equal?(key) }
+        index = 0 if index.nil? && stack.size == 1
+
+        index.nil? ? nil : stack.delete_at(index)
+      end
+
+      # The records an operation is about to touch, capped. Reading "delete all" unbounded would materialise
+      # every matched row — and the pending/confirm protocol writes each of them twice. Truncation is logged
+      # rather than silent: an incomplete audit somebody knows about beats an OOM.
+      #
+      # Read outside the write's transaction — hooks bracket the write as separate calls and the data layer
+      # exposes no lock, on purpose, since it spans ActiveRecord, Mongoid, HTTP APIs. So two updates racing on
+      # one record both snapshot the same state, and the one that lands second records a `previous_values` that
+      # was already overwritten.
+      #
+      # An empty list on failure rather than no snapshot at all: the after hook pops unconditionally, so
+      # skipping the push would pair it with an unrelated entry. Reading it goes through the gate, not
+      # `audit_safely`: knowing what an operation is about to touch is part of being able to record it, so
+      # under `critical: true` a snapshot that cannot be read refuses the operation.
+      def take(context, projection)
+        cap = AuditTrail::MAX_RECORDS_PER_OPERATION
+        page = ForestAdminDatasourceToolkit::Components::Query::Page.new(offset: 0, limit: cap + 1)
+        records = AuditTrail.gate { context.collection.list(context.filter.override(page: page), projection) } || []
+        return records if records.size <= cap
+
+        refuse_or_truncate(context, records, cap)
+      end
+
+      private
+
+      # Truncating means the operation writes more records than it audits. Tolerable when the audit trail is
+      # advisory; under `critical: true` it breaks the one invariant the mode exists for, so the operation is
+      # refused instead — before the write, so there is nothing to repair.
+      def refuse_or_truncate(context, records, cap)
+        AuditTrail.refuse_over_cap! if AuditTrail.critical?
+
+        kept = records.first(cap)
+        AuditTrail.log_truncation(kept.size, audit_safely { count_matching(context) })
+
+        kept
+      end
+
+      def count_matching(context)
+        aggregation = ForestAdminDatasourceToolkit::Components::Query::Aggregation.new(operation: 'Count')
+
+        context.collection.aggregate(context.filter, aggregation).first&.fetch('value', nil)
+      end
+
+      def pending
+        Thread.current[:forest_audit_trail_snapshots] ||= []
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/audit_trail/sql/audit_connection_base.rb

@@ -0,0 +1,53 @@
+begin
+  require 'active_record'
+rescue LoadError
+  raise LoadError, 'config.audit_trail needs the activerecord gem: add `gem "activerecord"` to your Gemfile.'
+end
+
+module ForestAdminAgent
+  module AuditTrail
+    module Sql
+      # Dedicated abstract base so the audit storage keeps its own connection pool, isolated from the
+      # host application's ActiveRecord::Base connection. Also the level the `attribute` overrides in
+      # AuditLog need: declaring them straight on an ActiveRecord::Base child resolves the type
+      # eagerly and blows up before any connection is established.
+      class AuditConnectionBase < ActiveRecord::Base
+        self.abstract_class = true
+
+        class << self
+          # `establish_connection` is class-level, so two stores pointed at different databases would silently
+          # clobber each other's pool and both end up writing to whichever connected last. One audit database
+          # per agent is the supported shape; a second, different one is a configuration mistake worth hearing
+          # about at boot.
+          #
+          # Under one mutex for all stores, not one each: the check, the connect and the assignment have to be
+          # one step, or two stores connecting at once both pass the check and the loser writes to the winner's
+          # database.
+          def connect_to(database)
+            connection_mutex.synchronize do
+              if @database && @database != database
+                raise ForestAdminDatasourceToolkit::Exceptions::ForestException,
+                      'The audit trail is already connected to another database. One agent, one audit database.'
+              end
+              next if @database
+
+              establish_connection(database)
+              @database = database
+            end
+          end
+
+          def disconnect!
+            connection_mutex.synchronize do
+              @database = nil
+              remove_connection
+            end
+          end
+
+          def connection_mutex
+            @connection_mutex ||= Mutex.new
+          end
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/audit_trail/sql/audit_log.rb

@@ -0,0 +1,16 @@
+module ForestAdminAgent
+  module AuditTrail
+    module Sql
+      # Abstract template for the audit model. Each Store builds its own concrete subclass bound to its
+      # own (schema-qualified) table, so stores with different `table_name`/`schema` can't clobber a
+      # shared one. The JSON attribute overrides force Hash <-> JSON casting on every adapter (Postgres
+      # json, or text on SQLite) and are inherited by every subclass.
+      class AuditLog < AuditConnectionBase
+        self.abstract_class = true
+
+        attribute :previous_values, :json
+        attribute :new_values, :json
+      end
+    end
+  end
+end