standard_id 0.37.0 → 0.38.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 26e62c374edcaa53ab63756178e869a2d0c54c7ab00d26c2da823b28867fbeb6
-  data.tar.gz: 1a9a4e63f3e7f0e603c771c78f9fe503aad2768ea6302f675c360056f9d7c8d7
+  metadata.gz: ea8084bb866fc4da82d81ec18d2b24676e3209ac8d21975c20deb9aa334160fc
+  data.tar.gz: 1cc922486ca4204c8308ff489dc5f425424c06e758a1a4b77276b6670a637f10
 SHA512:
-  metadata.gz: d29d16c5b0d02017f574df54ee5a14a2455e4440da51c72d6cb480e89c284de9167fbb5f0dbdf4bb8e659009c2020ec06d80f7e7b56c2e06323969b5356c9db2
-  data.tar.gz: 510aaa0c2252ae3a1a1ab548a9f4272fdaa304cef732cb9b87995d0996734340f5673750abfe827af29b875dde7e0b08cf88b345da2e1543b9459879d4072168
+  metadata.gz: 3e030d75f3f08d7961ac1cab6ede04da0940ee5471191bfc5c06ef832469f6da2a9af44539fa04e889801defded08c8bdf138c7a8bd1661d8c0628c5b707d08f
+  data.tar.gz: b5301f0db610433bcb542699f95beddcd9e91e93dda098f940edafc9af5c70ab264ef6c70b427e84ac34a9edae861316cf3d608f4f5c2dad6996eb6b9780cbcf

data/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.38.0] - 2026-08-06
+
+### Added
+
+- **Event payloads now carry record identifiers alongside the records — the emitter half of rarebit-one/rarebit-ops#296.** This gem publishes whole ActiveRecord objects on the notification bus (`account:`, `current_account:`, `session:`, `code_challenge:`), and a record serialises with **all** its attributes. That is how `account.password_digest`, `session.token_digest`, `session.lookup_hash` and the plaintext passwordless OTP in `code_challenge.code` reached append-only audit rows across the estate.
+
+  `standard_audit` 0.11.0 closed its own write path with `dereference_record_metadata`, but it could only ever protect `audit_logs`. Every host subscriber receives the same payload and may put the record into Sentry context, a structured log, or a table of its own — all outside that gem's reach. Curating at the emitter is the only fix that closes the class.
+
+  `config.events.publish_record_identifiers` (default **`true`**) adds `<key>_id` and `<key>_gid` beside every record-valued key and **removes nothing**.
+
+- **`config.events.publish_records` (default `true`) is the opt-out** for hosts ready to stop receiving the records themselves.
+
+### Notes for hosts
+
+- **This release is additive on purpose — no consumer changes behaviour today.** All five consumers configure an `actor_extractor` reading `payload[:actor] || payload[:current_account] || payload[:account]` and calling `to_global_id` on the result, so swapping records for identifiers in one step would break actor attribution in five apps simultaneously.
+
+  The migration path is per-host and provable: point your subscribers at the new `_gid` keys, confirm in staging that nothing depends on the records, then set `publish_records` to `false`. The intended end state is for that to default to `false` in a later major, and for the records to go away in the one after.
+
+- **Both `_id` and `_gid` are published.** A GlobalID carries the class, and `account_id` alone cannot tell an `Account` from anything else sharing a primary key. The audit gems key on the GID.
+
+- **`to_global_id` is rescued.** It raises on an unpersisted record, and publishing sits on the authentication path — an event must never fail because of metadata this method adds to it.
+
 ## [0.37.0] - 2026-08-05
 
 ### Fixed

data/lib/standard_id/config/schema.rb

@@ -108,6 +108,34 @@ StandardId::ConfigSchema.define do
 
   scope :events do
     field :enable_logging, type: :boolean, default: false
+
+    # Publish `<key>_id` / `<key>_gid` alongside every record-valued payload key
+    # (rarebit-one/rarebit-ops#296).
+    #
+    # StandardId publishes whole ActiveRecord objects on the notification bus —
+    # `account:`, `current_account:`, `session:`, `code_challenge:` — and a
+    # record serialises with ALL its attributes. `standard_audit` 0.11.0 stopped
+    # that reaching `audit_logs`, but the bus is not the audit gem's to police:
+    # a host's own subscribers still receive the full record and may put it in
+    # Sentry context, a structured log, or a table of their own.
+    #
+    # On by default because it only ADDS keys. Nothing that reads `account:`
+    # today changes behaviour — including every consumer's `actor_extractor`,
+    # which reads the record to call `to_global_id` on it.
+    field :publish_record_identifiers, type: :boolean, default: true
+
+    # The other half of the migration, and deliberately OFF by default.
+    #
+    # Turning it off stops the records themselves being published, leaving only
+    # the identifiers. That IS a breaking payload change — it is the whole point
+    # — so it is a host's opt-in, taken once its subscribers read the `_id`/`_gid`
+    # keys instead. A host can flip it in staging to prove nothing depends on
+    # the records before committing.
+    #
+    # The intended end state is this defaulting to false in a later major, and
+    # the records going away in the one after. Until a host opts in, behaviour
+    # is exactly as it was.
+    field :publish_records, type: :boolean, default: true
   end
 
   scope :passwordless do

data/lib/standard_id/events.rb

@@ -132,7 +132,65 @@ module StandardId
           enriched[:scope] ||= ::Current.scope if ::Current.respond_to?(:scope) && ::Current.scope.present?
         end
 
-        enriched.merge(payload)
+        with_record_identifiers(enriched.merge(payload))
+      end
+
+      # Adds `<key>_id` and `<key>_gid` next to every record-valued key, and —
+      # only when a host opts in — removes the records themselves.
+      #
+      # WHY (rarebit-one/rarebit-ops#296)
+      # ---------------------------------
+      # This gem publishes whole ActiveRecord objects: `account:`,
+      # `current_account:`, `session:`, `code_challenge:`. A record serialises
+      # with ALL its attributes, which is how `account.password_digest`,
+      # `session.token_digest`, `session.lookup_hash` and the plaintext
+      # passwordless OTP in `code_challenge.code` reached append-only audit rows
+      # — 3,007 of them on one app, unrepairable because the table refuses
+      # UPDATE by design.
+      #
+      # `standard_audit` 0.11.0 fixed its own write path. It cannot fix the bus:
+      # every host subscriber still receives the full record and may put it
+      # anywhere. Publishing the identifier alongside is what lets a subscriber
+      # stop needing the record at all.
+      #
+      # WHY ADDITIVE FIRST
+      # ------------------
+      # Swapping records for identifiers in one step breaks every consumer's
+      # `actor_extractor` simultaneously — all five apps configure one, and they
+      # read `payload[:actor] || payload[:current_account] || payload[:account]`
+      # expecting something they can call `to_global_id` on. So the default adds
+      # keys and removes nothing; `config.events.publish_records = false` is the
+      # opt-out a host takes once its subscribers read the identifiers.
+      #
+      # `_gid` as well as `_id` because a GlobalID carries the class, and the
+      # audit gems key on it. `to_global_id` is rescued: a new or unpersisted
+      # record raises, and an event must never fail because of the metadata this
+      # method adds to it.
+      def with_record_identifiers(payload)
+        return payload unless defined?(::ActiveRecord::Base)
+
+        config = StandardId.config.events
+        return payload unless config.publish_record_identifiers || !config.publish_records
+
+        payload.each_with_object({}) do |(key, value), out|
+          unless value.is_a?(::ActiveRecord::Base)
+            out[key] = value
+            next
+          end
+
+          out[key] = value if config.publish_records
+
+          next unless config.publish_record_identifiers
+
+          out[:"#{key}_id"] ||= value.id
+          out[:"#{key}_gid"] ||= safe_global_id(value)
+        end.compact
+      end
+
+      def safe_global_id(record)
+        record.to_global_id.to_s
+      rescue StandardError
+        nil
       end
     end
   end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.37.0"
+  VERSION = "0.38.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.37.0
+  version: 0.38.0
 platform: ruby
 authors:
 - Jaryl Sim