standard_audit 0.13.1 → 0.13.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ca3b859a3eb6993caa5c57a9a43621f67a44871c5ee3f05b2ea5d5ca79860b4
-  data.tar.gz: 7a85141df78963fa16c7b223da7a7d48270c368538815f26d8e097a09487c0ff
+  metadata.gz: 77f38f95622eab13dc70d4376ad9694a3bbb03d3d54f5f2c43f63012e041ea23
+  data.tar.gz: 5d68228d9da02a23808db8cc2588dc358df1dc7f7a82d86da4447d98038f6411
 SHA512:
-  metadata.gz: b74d1bbbd38c3580fb36f4db24f40f7fd01c9f6f807035e3aee8e0a3979692f0c4dc8175cdb53799291d578fdf0e8ca80add04e6df1b09b819425717088abea1
-  data.tar.gz: 32dd1f53798d592fe517966dd4677abf42ce5ab7dd650176f56dfcd873025a43a3a81a048e276da37fdf90954cc68d3746fb9355e9c1e40559d123c87ab605af
+  metadata.gz: c5ca114c4894594f1e0de803d0d0e207bd308f887e130237af3d967a4ed33bc476ac72f28b1cff8b83af5f2d5c56e158542a917c560680c96e3f686ec339c6ec
+  data.tar.gz: 991e7cbfd6c21c73f54bc1bc1ed64aa1df8faaa2a6d44dfdf75222ab79911eb462de275ca086d74ef72108db70bad6df1f8c9f65fab9ec7ea115c0bb5bb99f1e

data/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.3] - 2026-10-21
+
+### Fixed
+
+- The default `scope_extractor` returns the payload's `scope:` only when it is a
+  record (responds to `to_global_id`). standard_id publishes `scope:` as a
+  Symbol or String (the OAuth scope or auth plane), and the old default passed it
+  to `to_global_id`, so those events failed to write (`NoMethodError`,
+  fundbright-web FUNDBRIGHT-WEB-41). A non-record scope now falls through to
+  `current_scope_resolver`, like an absent one. A custom `scope_extractor` and an
+  explicit `scope:` on `StandardAudit.record` are unchanged.
+
+## [0.13.2] - 2026-10-02
+
+### Fixed
+
+- The canonical checksum works on json 3. `Checksum.json_round_trip` passed
+  `create_additions: false` to `JSON.parse`; json 3 removed that keyword, so
+  from the canonical cutover (2026-10-01T00:00:00Z) every audit row with a
+  Hash or Array field raised `ArgumentError: unknown keyword:
+  create_additions` before it was saved. Hosts on json 3 lost those rows
+  (luminality-web, LUMINALITY-WEB-1N). Hosts on json 2.x were unaffected,
+  and the digest is unchanged: JSON.parse never creates additions by default.
+
 ## [0.13.1] - 2026-09-25
 
 Fixes the checksum so it survives PostgreSQL `jsonb`

data/README.md

@@ -508,7 +508,7 @@ StandardAudit.configure(baseline: true) do |config|
   # Defaults shown below.
   config.actor_extractor  = ->(payload) { payload[:actor] }
   config.target_extractor = ->(payload) { payload[:target] }
-  config.scope_extractor  = ->(payload) { payload[:scope] }
+  config.scope_extractor  = ->(payload) { payload[:scope] } # default keeps it only if it responds to to_global_id
 
   # -- Current Attribute Resolvers --
   # Fallbacks used when payload values are nil.

data/lib/standard_audit/checksum.rb

@@ -141,8 +141,11 @@ module StandardAudit
     # What a JSON column hands back for `value`: encoded exactly as
     # ActiveRecord's JSON type encodes on write, then parsed. Key ORDER is
     # the one thing this does not settle — canonical_json does.
+    #
+    # No `create_additions:` option: JSON.parse never creates additions by
+    # default, and json 3 removed the keyword (passing it raises).
     def json_round_trip(value)
-      JSON.parse(ActiveSupport::JSON.encode(value), max_nesting: false, create_additions: false)
+      JSON.parse(ActiveSupport::JSON.encode(value), max_nesting: false)
     end
 
     # Deterministic JSON: object keys sorted bytewise at every depth, no

data/lib/standard_audit/configuration.rb

@@ -24,7 +24,15 @@ module StandardAudit
 
       @actor_extractor = ->(payload) { payload[:actor] }
       @target_extractor = ->(payload) { payload[:target] }
-      @scope_extractor = ->(payload) { payload[:scope] }
+      # Only a record can be a scope (it is stored by GlobalID). Payloads also
+      # use `scope:` for other things: standard_id publishes the OAuth scope
+      # or auth plane there as a Symbol/String, which would raise NoMethodError
+      # on `to_global_id` at write time. Anything else falls through to
+      # `current_scope_resolver`.
+      @scope_extractor = ->(payload) {
+        scope = payload[:scope]
+        scope if scope.respond_to?(:to_global_id)
+      }
 
       # Tries StandardId's `Current.account` first, then the Rails-generator
       # convention `Current.user`. Each is respond_to?-guarded, so an app that

data/lib/standard_audit/version.rb

@@ -1,3 +1,3 @@
 module StandardAudit
-  VERSION = "0.13.1"
+  VERSION = "0.13.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_audit
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.13.3
 platform: ruby
 authors:
 - Jaryl Sim