sealed_trail 0.1.0

data/lib/generators/sealed_trail/install/templates/sealed_trail.rb.tt

@@ -0,0 +1,71 @@
+# SealedTrail records an audit trail of changes to your models.
+# Add `has_sealed_trail` to any model you want to track.
+SealedTrail.configure do |config|
+  # Turn all tracking off, e.g. in a one-off data migration.
+  # config.enabled = true
+
+  # --- Redaction -------------------------------------------------------------
+  # Attributes whose values are never stored in plain text. Strings match the
+  # exact attribute name; Regexps match any part of it; a Hash picks a strategy
+  # per rule. The defaults cover passwords, tokens, secrets, API/private keys,
+  # OTP fields, salts, encrypted_*, email, *_email, phone, *_phone and mobile.
+  # config.redact_attributes += [:ssn, /\Abank_account/, { date_of_birth: :mask }]
+
+  # How redacted values are stored unless a rule says otherwise:
+  #   :redact      => "[REDACTED]"
+  #   :fingerprint => "hmac:<hex>" (HMAC-SHA256; equal values match, see
+  #                   SealedTrail::Entry.with_fingerprint)
+  #   :mask        => "j***@example.com", "******1234"
+  #   or a callable ->(value, attribute_name) { ... }
+  # config.redaction_strategy = :redact
+
+  # Secret for :fingerprint. Defaults to a key derived from secret_key_base;
+  # changing it (or secret_key_base) changes all future fingerprints.
+  # config.fingerprint_secret = Rails.application.credentials.sealed_trail_fingerprint_secret
+
+  # Also redact attributes declared with `encrypts` (default: true).
+  # config.redact_encrypted_attributes = true
+
+  # Attributes never recorded in any model.
+  # config.ignore_attributes = [:updated_at]
+
+  # --- When an audit entry cannot be written ---------------------------------
+  # :log (default) logs the error, instruments "write_failed.sealed_trail" and
+  # lets the user's save succeed. :raise rolls the change back instead.
+  # A callable ->(error, payload) { ... } replaces the default handling.
+  # config.on_failure = :log
+
+  # Extra reporting in :log mode, e.g. to Sentry or Rails.error.
+  # config.error_handler = ->(error, payload) { Rails.error.report(error, context: payload.except(:error)) }
+
+  # --- Who made the change -----------------------------------------------------
+  # Controller method that returns the current actor (default: :current_user).
+  # config.actor_method = :current_user
+
+  # Recorded in a request when nobody is signed in (default: "anonymous").
+  # config.anonymous_actor = "anonymous"
+
+  # Recorded when nothing else identifies the actor (default: "system").
+  # Rake tasks are labelled "rake:<task>", the console "console", and jobs
+  # "job:<JobClass>" unless they inherited an actor from where they were enqueued.
+  # config.default_actor = "system"
+  # config.detect_process_context = true
+
+  # Carry the actor, request id and metadata into Active Job jobs (default: true).
+  # config.active_job_integration = true
+
+  # Include SealedTrail::Controller in all controllers automatically.
+  # config.auto_include_controller = true
+
+  # --- Bulk operations ---------------------------------------------------------
+  # Record update_all, delete_all, insert_all, insert_all! and upsert_all on
+  # tracked models as one summary entry each (default: true).
+  # config.track_bulk_operations = true
+
+  # Maximum affected ids stored per bulk entry (default: 1000).
+  # config.bulk_id_limit = 1000
+
+  # WHERE/SET SQL of bulk operations: :masked (string literals replaced with
+  # '?', default), :full or :none.
+  # config.bulk_sql = :masked
+end

data/lib/sealed_trail/bulk.rb

@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+module SealedTrail
+  # Records one summary entry per bulk operation (update_all, delete_all,
+  # insert_all, insert_all!, upsert_all) on tracked models.
+  #
+  # The summary is stored in the entry's metadata under "bulk":
+  #
+  #   "operation"     => "update_all"
+  #   "row_count"     => rows affected (nil when the database does not say)
+  #   "ids"           => affected primary keys as strings (capped by
+  #                      config.bulk_id_limit)
+  #   "ids_truncated" => true when more ids matched than were stored
+  #   "where_sql"     => the WHERE clause (per config.bulk_sql)
+  #   "set_sql"       => for update_all with a SQL string
+  #   "columns"       => for inserts, the columns written
+  #
+  # For update_all with a Hash, the values set are stored in object_changes as
+  # [nil, value], redacted like any other change.
+  module Bulk
+    ITEM_ID = "*"
+
+    module_function
+
+    # Rails 7.2+ defines insert_all and friends on Relation; Rails 7.1 only on
+    # the model class.
+    def relation_inserts?
+      ActiveRecord::Relation.method_defined?(:insert_all)
+    end
+
+    def track?(model)
+      SealedTrail.config.track_bulk_operations &&
+        SealedTrail.tracking? &&
+        model.respond_to?(:sealed_trail?) && model.sealed_trail? &&
+        model.sealed_trail_options.bulk
+    end
+
+    def update_all(relation, updates)
+      model = relation.klass
+      changes = nil
+      set_sql = nil
+
+      if updates.is_a?(Hash)
+        changes = AttributeFilter.new(model).call(
+          updates.to_h { |name, value| [ name.to_s.split(".").last, [ nil, sql_value(value) ] ] }
+        )
+        return yield if changes.empty? && updates.any?
+      else
+        set_sql = format_sql(model.sanitize_sql_for_assignment(updates))
+      end
+
+      ids, truncated = capture_ids(relation)
+      where_sql = where_sql(relation)
+      row_count = yield
+
+      summary = { "operation" => "update_all", "row_count" => row_count, "ids" => ids, "ids_truncated" => truncated, "where_sql" => where_sql }
+      summary["set_sql"] = set_sql if set_sql
+      write(model, "bulk_update", changes, summary)
+      row_count
+    end
+
+    def delete_all(relation)
+      model = relation.klass
+      ids, truncated = capture_ids(relation)
+      where_sql = where_sql(relation)
+      row_count = yield
+
+      write(model, "bulk_delete", nil,
+        "operation" => "delete_all", "row_count" => row_count, "ids" => ids, "ids_truncated" => truncated, "where_sql" => where_sql)
+      row_count
+    end
+
+    def insert(model, operation, rows)
+      result = yield
+      rows = Array(rows)
+      filter = AttributeFilter.new(model)
+      columns = rows.flat_map { |row| row.to_h.keys.map(&:to_s) }.uniq.select { |name| filter.tracked?(name) }.sort
+
+      pk = model.primary_key
+      returned_ids = (result.columns.include?(pk) if pk.is_a?(String) && result.respond_to?(:columns))
+      ids = returned_ids ? result.rows.map { |row| row[result.columns.index(pk)].to_s } : nil
+      limit = SealedTrail.config.bulk_id_limit
+      truncated = !!(ids && limit && ids.size > limit)
+      ids = ids.first(limit) if ids && limit
+
+      write(model, operation == :upsert_all ? "bulk_upsert" : "bulk_insert", nil,
+        "operation" => operation.to_s,
+        "row_count" => returned_ids ? result.rows.size : nil,
+        "attempted_count" => rows.size,
+        "ids" => ids,
+        "ids_truncated" => truncated,
+        "columns" => columns)
+      result
+    end
+
+    def write(model, event, changes, summary)
+      Writer.write(
+        item_type: model.polymorphic_name,
+        item_id: ITEM_ID,
+        event: event,
+        object_changes: changes,
+        metadata: { "bulk" => summary.compact }
+      )
+    end
+
+    def capture_ids(relation)
+      pk = relation.klass.primary_key
+      return [ nil, false ] unless pk.is_a?(String)
+
+      cap = SealedTrail.config.bulk_id_limit
+      scope = relation.except(:select, :includes, :preload, :eager_load)
+      fetch = cap && cap + 1
+      fetch = [ fetch, relation.limit_value ].compact.min if relation.limit_value
+      scope = scope.limit(fetch) if fetch
+      ids = scope.pluck(relation.klass.arel_table[pk]).map(&:to_s)
+      truncated = !!(cap && ids.size > cap)
+      [ cap ? ids.first(cap) : ids, truncated ]
+    end
+
+    def where_sql(relation)
+      return nil if SealedTrail.config.bulk_sql == :none
+
+      return nil if relation.where_clause.empty?
+
+      connection = relation.klass.connection
+      # Compile only the WHERE conditions, with bind values inlined.
+      sql = connection.unprepared_statement do
+        connection.visitor.compile(relation.where_clause.ast, connection.send(:collector))
+      end
+      format_sql(sql)
+    rescue StandardError
+      nil
+    end
+
+    def format_sql(sql)
+      return nil if sql.blank?
+
+      case SealedTrail.config.bulk_sql
+      when :none then nil
+      when :full then sql
+      else sql.gsub(/'(?:[^'\\]|''|\\.)*'/, "'?'")
+      end
+    end
+
+    def sql_value(value)
+      value.respond_to?(:to_sql) ? value.to_sql : value
+    end
+
+    # Prepended to ActiveRecord::Relation.
+    module RelationHooks
+      def update_all(updates)
+        return super unless SealedTrail::Bulk.track?(klass)
+
+        SealedTrail::Bulk.update_all(self, updates) { super }
+      end
+
+      def delete_all
+        return super unless SealedTrail::Bulk.track?(klass)
+
+        SealedTrail::Bulk.delete_all(self) { super }
+      end
+    end
+
+    # Prepended to ActiveRecord::Relation (Rails 7.2+) or to each tracked
+    # model's singleton class (Rails 7.1).
+    module InsertHooks
+      %i[insert_all insert_all! upsert_all].each do |operation|
+        define_method(operation) do |attributes, **options|
+          model = is_a?(ActiveRecord::Relation) ? klass : self
+          return super(attributes, **options) unless SealedTrail::Bulk.track?(model)
+
+          SealedTrail::Bulk.insert(model, operation, attributes) { super(attributes, **options) }
+        end
+      end
+    end
+  end
+end

data/lib/sealed_trail/configuration.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module SealedTrail
+  # Global settings. Change them with:
+  #
+  #   SealedTrail.configure do |config|
+  #     config.redact_attributes += [:ssn, { email: :fingerprint }]
+  #   end
+  class Configuration
+    # Attribute names (Strings/Symbols, matched exactly) or Regexps whose
+    # values are redacted with config.redaction_strategy. A Hash entry maps a
+    # name or Regexp to its own strategy, e.g. { email: :fingerprint }.
+    DEFAULT_REDACT_ATTRIBUTES = [
+      /passw(or)?d/i,
+      /token/i,
+      /secret/i,
+      /\Aencrypted_/i,
+      /api_?key/i,
+      /private_?key/i,
+      /\Aotp_/i,
+      /salt\z/i,
+      /(\A|_)e?mail(_address)?\z/i,
+      /(\A|_)phone(_number)?\z/i,
+      /(\A|_)mobile(_number)?\z/i
+    ].freeze
+
+    ON_FAILURE_MODES = %i[log raise].freeze
+    BULK_SQL_MODES = %i[masked full none].freeze
+
+    # Switch all tracking off (for example in a seed task). Default: true.
+    attr_accessor :enabled
+
+    # Redaction rules applied to every tracked model, after the per-model
+    # +redact:+ rules. Default: DEFAULT_REDACT_ATTRIBUTES.
+    attr_accessor :redact_attributes
+
+    # How redacted values are stored unless a rule names its own strategy:
+    # :redact ("[REDACTED]"), :fingerprint ("hmac:<hex>"), :mask
+    # ("j***@example.com", "******1234") or a callable(value, attribute_name).
+    # Default: :redact.
+    attr_accessor :redaction_strategy
+
+    # Secret for the :fingerprint strategy and SealedTrail.fingerprint.
+    # Default: derived from Rails' secret_key_base.
+    attr_writer :fingerprint_secret
+
+    # Also redact attributes declared with Rails' +encrypts+. Default: true.
+    attr_accessor :redact_encrypted_attributes
+
+    # Attributes never recorded in any model. Default: none.
+    attr_accessor :ignore_attributes
+
+    # What to do when an audit entry cannot be written:
+    # :log (default) logs it, instruments "write_failed.sealed_trail", calls
+    # error_handler and lets the user's save succeed; :raise re-raises so the
+    # change is rolled back; a callable(error, payload) is called instead.
+    attr_accessor :on_failure
+
+    # Called with (error, payload) when a write fails in :log mode, e.g.
+    #   config.error_handler = ->(error, payload) { Rails.error.report(error, context: payload) }
+    attr_accessor :error_handler
+
+    # Logger for write failures. Default: Rails.logger.
+    attr_writer :logger
+
+    # The controller method used to find the actor for a request. It is called
+    # lazily, the first time an entry is recorded in that request.
+    # Default: :current_user.
+    attr_accessor :actor_method
+
+    # Actor recorded in a request when the actor method returns nil.
+    # Default: "anonymous". Set to nil to fall back to default_actor.
+    attr_accessor :anonymous_actor
+
+    # Actor recorded when nothing else identifies one (after the explicit
+    # actor, the request, the job, and the console/rake context). A label, a
+    # record, or a callable returning one. Default: "system".
+    attr_accessor :default_actor
+
+    # Label rake tasks ("rake:<task>") and the console ("console").
+    # Default: true.
+    attr_accessor :detect_process_context
+
+    # Carry the actor, request id and metadata from where a job is enqueued
+    # into the job, and label jobs "job:<JobClass>". Default: true.
+    attr_accessor :active_job_integration
+
+    # Automatically include SealedTrail::Controller into ActionController::Base
+    # and ActionController::API. Default: true.
+    attr_accessor :auto_include_controller
+
+    # Record update_all, delete_all, insert_all, insert_all! and upsert_all on
+    # tracked models as one summary entry per operation. Default: true.
+    attr_accessor :track_bulk_operations
+
+    # Maximum number of affected ids stored in a bulk entry (nil: no limit).
+    # Default: 1000.
+    attr_accessor :bulk_id_limit
+
+    # How the WHERE/SET SQL of bulk operations is stored: :masked (quoted string
+    # literals replaced with '?'), :full, or :none. Default: :masked.
+    attr_accessor :bulk_sql
+
+    def initialize
+      @enabled = true
+      @redact_attributes = DEFAULT_REDACT_ATTRIBUTES.dup
+      @redaction_strategy = :redact
+      @fingerprint_secret = nil
+      @redact_encrypted_attributes = true
+      @ignore_attributes = []
+      @on_failure = :log
+      @error_handler = nil
+      @logger = nil
+      @actor_method = :current_user
+      @anonymous_actor = "anonymous"
+      @default_actor = "system"
+      @detect_process_context = true
+      @active_job_integration = true
+      @auto_include_controller = true
+      @track_bulk_operations = true
+      @bulk_id_limit = 1000
+      @bulk_sql = :masked
+    end
+
+    def logger
+      @logger || (defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger) || ActiveRecord::Base.logger
+    end
+
+    def fingerprint_secret
+      return @fingerprint_secret if @fingerprint_secret.present?
+
+      if defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        @derived_fingerprint_secret ||= Rails.application.key_generator.generate_key("sealed_trail/fingerprint", 32)
+      else
+        raise ConfigurationError, "Set SealedTrail.config.fingerprint_secret to use the :fingerprint strategy"
+      end
+    end
+  end
+end

data/lib/sealed_trail/controller.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module SealedTrail
+  # Captures the actor, request id and remote IP for every request.
+  #
+  # Included automatically into ActionController::Base and ActionController::API
+  # (set config.auto_include_controller = false to include it yourself).
+  #
+  # The actor is resolved lazily by calling #sealed_trail_actor the first time
+  # an entry is recorded, so it works with authentication that runs in a later
+  # before_action. When it returns nil, config.anonymous_actor ("anonymous")
+  # is recorded. Override #sealed_trail_actor to customise it:
+  #
+  #   def sealed_trail_actor
+  #     current_admin || current_user
+  #   end
+  module Controller
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_sealed_trail_context
+    end
+
+    private
+
+    # The actor recorded for this request. By default calls the method named by
+    # SealedTrail.config.actor_method (:current_user) when the controller has it.
+    def sealed_trail_actor
+      method_name = SealedTrail.config.actor_method
+      send(method_name) if method_name && respond_to?(method_name, true)
+    end
+
+    # Extra metadata stored with every entry recorded in this request.
+    # Override to add, e.g., { "user_agent" => request.user_agent }.
+    def sealed_trail_metadata
+      {}
+    end
+
+    def set_sealed_trail_context
+      current = SealedTrail::Current
+      current.request_id = request.request_id
+      current.remote_ip = request.remote_ip
+      current.actor_resolver = -> { sealed_trail_actor }
+      current.context_label = SealedTrail.config.anonymous_actor
+      metadata = sealed_trail_metadata
+      current.metadata = (current.metadata || {}).merge(metadata.to_h.stringify_keys) if metadata.present?
+    end
+  end
+end

data/lib/sealed_trail/current.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module SealedTrail
+  # Per-request (and per-job) state, isolated per thread or fiber according to
+  # Rails' isolation level and reset automatically by the Rails executor.
+  class Current < ActiveSupport::CurrentAttributes
+    # Explicit actor: an Active Record object, or a String/Symbol label.
+    attribute :actor
+    # A callable that returns the actor; used when +actor+ is not set. The
+    # controller concern stores one so authentication can run later.
+    attribute :actor_resolver
+    # Fallback label for this unit of work, e.g. "anonymous" in a request or
+    # "job:ImportJob" in a job.
+    attribute :context_label
+    attribute :request_id
+    attribute :remote_ip
+    attribute :metadata
+    attribute :tracking_disabled
+
+    # The explicit or request actor, without fallbacks.
+    def identified_actor
+      return actor unless actor.nil?
+
+      actor_resolver&.call
+    end
+  end
+end

data/lib/sealed_trail/entry.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+module SealedTrail
+  # One audit entry: a create, update, destroy or touch of one record, or a
+  # summary of one bulk operation (bulk_update, bulk_delete, bulk_insert,
+  # bulk_upsert) on a model.
+  #
+  # Columns: item_type, item_id ("*" for bulk entries), event, object_changes
+  # ({"attr" => [before, after]}), metadata, actor_type, actor_id, request_id,
+  # remote_ip, created_at.
+  #
+  # Entries are append-only through Active Record: once saved they are
+  # read-only, so +update+ and +destroy+ raise ActiveRecord::ReadOnlyRecord.
+  # (This does not stop raw SQL; tamper evidence is a SealedTrail Pro feature.)
+  class Entry < ActiveRecord::Base
+    self.table_name = "sealed_trail_entries"
+
+    belongs_to :item, polymorphic: true, optional: true
+    belongs_to :actor, polymorphic: true, optional: true
+
+    validates :item_type, :item_id, :event, presence: true
+    validates :event, inclusion: { in: SealedTrail::Model::ALL_EVENTS }
+
+    scope :chronological, -> { order(:created_at, :id) }
+    scope :reverse_chronological, -> { order(created_at: :desc, id: :desc) }
+
+    # Entries attributed to +actor+: an Active Record object or a label such
+    # as "system", "console", "rake:db:seed" or "job:ImportJob".
+    scope :for_actor, lambda { |actor|
+      if actor.is_a?(ActiveRecord::Base)
+        where(actor_type: actor.class.polymorphic_name, actor_id: actor.id.to_s)
+      else
+        where(actor_type: nil, actor_id: actor.to_s)
+      end
+    }
+
+    # Per-record entries about one record. Accepts a record, or a class (or
+    # class name) and an id, which also works after the record was destroyed:
+    #
+    #   SealedTrail::Entry.for_item(post)
+    #   SealedTrail::Entry.for_item(Post, 42)
+    scope :for_item, lambda { |item_or_class, id = nil|
+      type, id = item_key(item_or_class, id)
+      where(item_type: type, item_id: id)
+    }
+
+    # Per-record entries plus bulk entries whose stored ids include the record.
+    # Bulk matching searches the JSON text, so it misses ids beyond
+    # config.bulk_id_limit and operations without ids (e.g. inserts on MySQL).
+    scope :affecting, lambda { |item_or_class, id = nil|
+      type, id = item_key(item_or_class, id)
+      bulk_matches = where(item_type: type, event: SealedTrail::Model::BULK_EVENTS)
+        .where("#{json_text_sql(:metadata)} LIKE ?", "%#{sanitize_sql_like(id.to_json)}%")
+      where(item_type: type, item_id: id).or(bulk_matches)
+    }
+
+    # Entries for any record of a model class.
+    scope :for_item_type, lambda { |klass|
+      klass = klass.to_s.constantize unless klass.is_a?(Class)
+      where(item_type: klass.polymorphic_name)
+    }
+
+    # Entries created in a time range. Either end may be nil for an open range.
+    scope :between, ->(from, to) { where(created_at: from..to) }
+
+    # Entries for the given events: events(:update), events(:create, :destroy).
+    scope :events, ->(*names) { where(event: names.flatten.map(&:to_s)) }
+
+    # Bulk operation summaries.
+    scope :bulk, -> { where(event: SealedTrail::Model::BULK_EVENTS) }
+
+    scope :for_request, ->(request_id) { where(request_id: request_id) }
+
+    # Entries that stored +value+ with the :fingerprint strategy.
+    scope :with_fingerprint, lambda { |value|
+      where("#{json_text_sql(:object_changes)} LIKE ?", "%#{sanitize_sql_like(SealedTrail.fingerprint(value))}%")
+    }
+
+    def self.item_key(item_or_class, id)
+      if item_or_class.is_a?(ActiveRecord::Base)
+        [ item_or_class.class.polymorphic_name, item_or_class.id.to_s ]
+      else
+        klass = item_or_class.is_a?(Class) ? item_or_class : item_or_class.to_s.constantize
+        [ klass.polymorphic_name, id.to_s ]
+      end
+    end
+
+    # SQL for a JSON column as text, for LIKE searches.
+    def self.json_text_sql(column)
+      quoted = "#{connection.quote_table_name(table_name)}.#{connection.quote_column_name(column)}"
+      case connection.adapter_name
+      when /postg/i then "CAST(#{quoted} AS text)"
+      when /mysql|trilogy/i then "CAST(#{quoted} AS CHAR)"
+      else quoted
+      end
+    end
+
+    def readonly?
+      persisted? || super
+    end
+
+    # Names of the attributes this entry recorded.
+    def changed_attribute_names
+      (object_changes || {}).keys
+    end
+
+    # [before, after] for one attribute, or nil if it was not recorded.
+    def change_for(attribute)
+      (object_changes || {})[attribute.to_s]
+    end
+
+    def create? = event == "create"
+    def update? = event == "update"
+    def destroy? = event == "destroy"
+    def bulk? = event.to_s.start_with?("bulk_")
+
+    # The bulk summary hash ("operation", "row_count", "ids", ...), or nil.
+    def bulk_summary
+      (metadata || {})["bulk"] if bulk?
+    end
+
+    # Affected ids stored for a bulk entry (strings), or nil.
+    def bulk_ids
+      bulk_summary&.fetch("ids", nil)
+    end
+  end
+end

data/lib/sealed_trail/job_context.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module SealedTrail
+  # Carries the actor, request id, remote IP and metadata from where a job is
+  # enqueued into the job, and labels entries recorded by a job without an
+  # actor as "job:<JobClass>". Included into ActiveJob::Base by the Railtie.
+  module JobContext
+    KEY = "sealed_trail"
+
+    extend ActiveSupport::Concern
+
+    included do
+      around_perform :with_sealed_trail_context
+    end
+
+    def serialize
+      data = super
+      context = SealedTrail::JobContext.capture
+      data[KEY] = context if context
+      data
+    end
+
+    def deserialize(job_data)
+      super
+      @sealed_trail_context = job_data[KEY]
+    end
+
+    def self.capture
+      return unless SealedTrail.config.active_job_integration
+
+      context = {}
+      actor = SealedTrail::Current.identified_actor
+      case actor
+      when nil then nil
+      when ActiveRecord::Base
+        if actor.respond_to?(:to_global_id) && actor.persisted?
+          context["actor_gid"] = actor.to_global_id.to_s
+        else
+          context["actor"] = "#{actor.class.polymorphic_name}##{actor.id}"
+        end
+      else
+        context["actor"] = actor.to_s
+      end
+      context["request_id"] = SealedTrail::Current.request_id if SealedTrail::Current.request_id
+      context["remote_ip"] = SealedTrail::Current.remote_ip if SealedTrail::Current.remote_ip
+      context["metadata"] = SealedTrail::Current.metadata.as_json if SealedTrail::Current.metadata.present?
+      context.presence
+    end
+
+    def self.locate_actor(context)
+      if (gid = context["actor_gid"])
+        GlobalID::Locator.locate(gid) || gid
+      else
+        context["actor"]
+      end
+    rescue ActiveRecord::RecordNotFound
+      gid
+    end
+
+    private
+
+    def with_sealed_trail_context(&)
+      return yield unless SealedTrail.config.active_job_integration
+
+      attributes = { context_label: "job:#{self.class.name}" }
+      if (context = @sealed_trail_context)
+        actor = SealedTrail::JobContext.locate_actor(context)
+        attributes[:actor] = actor unless actor.nil?
+        attributes[:request_id] = context["request_id"] if context["request_id"]
+        attributes[:remote_ip] = context["remote_ip"] if context["remote_ip"]
+        attributes[:metadata] = (SealedTrail::Current.metadata || {}).merge(context["metadata"]) if context["metadata"]
+      end
+      SealedTrail::Current.set(attributes, &)
+    end
+  end
+end