anbaric-cloud-hosting 1.6.0 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -17,15 +17,17 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.6.0",
-    "anbaric-tsapi": "^1.6.0",
+    "anbaric-data-store": "^1.8.0",
+    "anbaric-plugins": "^1.8.0",
+    "anbaric-tsapi": "^1.8.0",
+    "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.6.0",
-    "anbaric-state-machine": "^1.6.0",
+    "anbaric-impl-cloud": "^1.8.0",
+    "anbaric-state-machine": "^1.8.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/app-management/FargateBuildLayer.ts

@@ -23,6 +23,8 @@ type FargateBuildLayerOptions = {
     appExecutionRoleArn : string,
     appsLogGroup : string,
     platformUrl : string,
+    servicesUrl? : string,
+    servicesApiKey? : string,
 };
 
 type AwsClients = {
@@ -151,6 +153,8 @@ class FargateBuildLayer extends BaseBuildLayer {
                     { name: "ANBARIC_AUDITOR_TYPE", value: "cloud" },
                     { name: "ANBARIC_CONSUMER_PORT", value: String(deployment.consumerPort) },
                     { name: "ANBARIC_CONSUMER_URL", value: `http://${deployment.appHost}:${deployment.consumerPort}` },
+                    ...(this.options.servicesUrl ? [{ name: "ANBARIC_SERVICES_URL", value: this.options.servicesUrl }] : []),
+                    ...(this.options.servicesApiKey ? [{ name: "ANBARIC_SERVICES_API_KEY", value: this.options.servicesApiKey }] : []),
                 ],
                 logConfiguration: {
                     logDriver: "awslogs",

package/src/auditing/AuditRecordStore.ts

@@ -1,9 +1,10 @@
-import {AuditChange, AuditRecord} from "anbaric-tsapi";
+import {AuditInteraction, AuditRecord} from "anbaric-tsapi";
 
 type AuditFilter = {
-    jobId? : string,
+    resourceType? : string,
+    resourceId? : string,
     actorId? : string,
-    change? : AuditChange,
+    interaction? : AuditInteraction,
     search? : string,
     pageSize? : number,
     page? : number,

package/src/auditing/InMemoryAuditRecordStore.ts

@@ -15,9 +15,10 @@ class InMemoryAuditRecordStore implements AuditRecordStore {
         const page = filter.page ?? 0;
 
         return this.records
-            .filter(record => !filter.jobId || record.jobId === filter.jobId)
+            .filter(record => !filter.resourceType || record.resourceType === filter.resourceType)
+            .filter(record => !filter.resourceId || record.resourceId === filter.resourceId)
             .filter(record => !filter.actorId || record.actorId === filter.actorId)
-            .filter(record => !filter.change || record.change === filter.change)
+            .filter(record => !filter.interaction || record.interaction.includes(filter.interaction))
             .filter(record => !filter.search ||
                 record.description.toLowerCase().includes(filter.search.toLowerCase()))
             .reverse()

package/src/data-store/PostgresAuditRecordStore.ts

@@ -1,16 +1,37 @@
-import {AuditRecord} from "anbaric-tsapi";
+import {AuditInteraction, AuditRecord} from "anbaric-tsapi";
 import {Pool} from "pg";
 import {AuditFilter, AuditRecordStore} from "../auditing/AuditRecordStore";
 
+const DEFAULT_WRITE_MASK : Array<AuditInteraction> = [
+    AuditInteraction.CREATE, AuditInteraction.UPDATE_PROPERTIES, AuditInteraction.CHANGE_STATE, AuditInteraction.DELETE,
+];
+
+/* Persists audit records, subject to a write mask: only the interactions in
+   the mask are stored, so high-volume reads can be audited at the call site
+   yet kept out of the durable trail. The mask defaults to every write and is
+   overridable via ANBARIC_AUDIT_INTERACTIONS. */
 class PostgresAuditRecordStore implements AuditRecordStore {
 
-    constructor(private pool : Pool) {}
+    private writeMask : Set<AuditInteraction>;
+
+    constructor(private pool : Pool, writeMask : Set<AuditInteraction> = PostgresAuditRecordStore.maskFromEnvironment()) {
+        this.writeMask = writeMask;
+    }
+
+    static maskFromEnvironment() : Set<AuditInteraction> {
+        const configured = process.env.ANBARIC_AUDIT_INTERACTIONS;
+        if (!configured) return new Set(DEFAULT_WRITE_MASK);
+        return new Set(configured.split(",").map(entry => entry.trim()).filter(Boolean) as Array<AuditInteraction>);
+    }
 
     async save(record : AuditRecord) : Promise<void> {
+        if (!record.interaction.some(interaction => this.writeMask.has(interaction))) return;
+
         await this.pool.query(
-            `INSERT INTO anbaric_system.audit_records (job_id, actor_id, actor_type, change, description, details)
-             VALUES ($1, $2, $3, $4, $5, $6)`,
-            [record.jobId, record.actorId, record.actorType, record.change,
+            `INSERT INTO anbaric_system.audit_records
+                (resource_type, resource_id, actor_id, actor_type, interaction, description, details)
+             VALUES ($1, $2, $3, $4, $5::anbaric_system.audit_interaction[], $6, $7)`,
+            [record.resourceType, record.resourceId, record.actorId, record.actorType, record.interaction,
                 record.description, JSON.stringify(record.details ?? null)],
         );
     }
@@ -19,17 +40,21 @@ class PostgresAuditRecordStore implements AuditRecordStore {
         const conditions : Array<string> = [];
         const parameters : Array<any> = [];
 
-        if (filter.jobId) {
-            parameters.push(filter.jobId);
-            conditions.push(`job_id = $${parameters.length}`);
+        if (filter.resourceType) {
+            parameters.push(filter.resourceType);
+            conditions.push(`resource_type = $${parameters.length}`);
+        }
+        if (filter.resourceId) {
+            parameters.push(filter.resourceId);
+            conditions.push(`resource_id = $${parameters.length}`);
         }
         if (filter.actorId) {
             parameters.push(filter.actorId);
             conditions.push(`actor_id = $${parameters.length}`);
         }
-        if (filter.change) {
-            parameters.push(filter.change);
-            conditions.push(`change = $${parameters.length}::anbaric_system.audit_change`);
+        if (filter.interaction) {
+            parameters.push(filter.interaction);
+            conditions.push(`$${parameters.length}::anbaric_system.audit_interaction = ANY(interaction)`);
         }
         if (filter.search) {
             parameters.push(`%${filter.search}%`);
@@ -43,7 +68,7 @@ class PostgresAuditRecordStore implements AuditRecordStore {
         const offset = `OFFSET $${parameters.length}`;
 
         const result = await this.pool.query(
-            `SELECT id, job_id, actor_id, actor_type, change, description, details, at
+            `SELECT id, resource_type, resource_id, actor_id, actor_type, interaction, description, details, at
              FROM anbaric_system.audit_records ${where}
              ORDER BY at DESC, id DESC ${limit} ${offset}`,
             parameters,
@@ -51,10 +76,11 @@ class PostgresAuditRecordStore implements AuditRecordStore {
 
         return result.rows.map(row => ({
             id: String(row.id),
-            jobId: row.job_id,
+            resourceType: row.resource_type,
+            resourceId: row.resource_id,
             actorId: row.actor_id,
             actorType: row.actor_type,
-            change: row.change,
+            interaction: row.interaction,
             description: row.description,
             details: row.details,
             at: row.at.toISOString(),

package/src/data-store/PostgresJobPersistence.ts

@@ -1,4 +1,4 @@
-import {Job, JobPersistence, JobTransition, deserializeJob} from "anbaric-tsapi";
+import {Auditor, Job, JobPersistence, NoOpAuditor, deserializeJob} from "anbaric-tsapi";
 import {Pool} from "pg";
 
 type JobRow = {
@@ -9,28 +9,28 @@ type JobRow = {
     started_at : Date,
     started_by : string,
     last_updated : Date,
-    transitions : Array<JobTransition>,
 };
 
-const JOB_COLUMNS = "id, state, properties, workflow_id, started_at, started_by, last_updated, transitions";
+const JOB_COLUMNS = "id, state, properties, workflow_id, started_at, started_by, last_updated";
 
-class PostgresJobPersistence implements JobPersistence {
+class PostgresJobPersistence extends JobPersistence {
 
-    constructor(private pool : Pool) {}
+    constructor(private pool : Pool, auditor : Auditor = new NoOpAuditor()) {
+        super(auditor);
+    }
 
-    async save(job : Job) : Promise<void> {
+    protected async saveInternal(job : Job) : Promise<void> {
         await this.pool.query(
-            `INSERT INTO jobs (id, state, properties, workflow_id, started_at, started_by, last_updated, transitions)
-             VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+            `INSERT INTO jobs (id, state, properties, workflow_id, started_at, started_by, last_updated)
+             VALUES ($1, $2, $3, $4, $5, $6, $7)
              ON CONFLICT (id) DO UPDATE SET state = EXCLUDED.state, properties = EXCLUDED.properties,
-                 workflow_id = EXCLUDED.workflow_id, last_updated = EXCLUDED.last_updated,
-                 transitions = EXCLUDED.transitions`,
-            [job.id, job.stateId, Object.fromEntries(job.properties), job.workflowId,
-                job.startedAt, job.startedBy, job.lastUpdated, JSON.stringify(job.transitions)],
+                 workflow_id = EXCLUDED.workflow_id, last_updated = EXCLUDED.last_updated`,
+            [job.id, job.state, Object.fromEntries(job.properties), job.workflowId,
+                job.startedAt, job.startedBy, job.lastUpdated],
         );
     }
 
-    async retrieve(id : string) : Promise<Job> {
+    protected async retrieveInternal(id : string) : Promise<Job> {
         const result = await this.pool.query(
             `SELECT ${JOB_COLUMNS} FROM jobs WHERE id = $1`,
             [id],
@@ -40,11 +40,11 @@ class PostgresJobPersistence implements JobPersistence {
         return this.deserializeRow(result.rows[0]);
     }
 
-    async delete(id : string) : Promise<void> {
+    protected async deleteInternal(id : string) : Promise<void> {
         await this.pool.query("DELETE FROM jobs WHERE id = $1", [id]);
     }
 
-    async list(pageSize : number = 100, page : number = 0) : Promise<Array<Job>> {
+    protected async listInternal(pageSize : number = 100, page : number = 0) : Promise<Array<Job>> {
         const result = await this.pool.query(
             `SELECT ${JOB_COLUMNS} FROM jobs ORDER BY inserted_at LIMIT $1 OFFSET $2`,
             [pageSize, page * pageSize],
@@ -60,18 +60,9 @@ class PostgresJobPersistence implements JobPersistence {
             startedAt: row.started_at.toISOString(),
             startedBy: row.started_by,
             lastUpdated: row.last_updated.toISOString(),
-            transitions: row.transitions,
         });
     }
 
-    async updateProperties(id : string, properties : Map<string, any>) : Promise<void> {
-        const result = await this.pool.query(
-            "UPDATE jobs SET properties = properties || $2::jsonb, last_updated = now() WHERE id = $1",
-            [id, Object.fromEntries(properties)],
-        );
-        if (result.rowCount === 0) throw new Error(`No job found with id "${id}"`);
-    }
-
 }
 
 export { PostgresJobPersistence }

package/src/data-store/PostgresJsonStore.ts

@@ -1,11 +1,13 @@
-import {JsonStore} from "anbaric-tsapi";
+import {Auditor, JsonStore, NoOpAuditor} from "anbaric-tsapi";
 import {Pool} from "pg";
 
-class PostgresJsonStore implements JsonStore {
+class PostgresJsonStore extends JsonStore {
 
-    constructor(private pool : Pool, private collection : string) {}
+    constructor(private pool : Pool, collection : string, auditor : Auditor = new NoOpAuditor()) {
+        super(auditor, collection);
+    }
 
-    async save(id : string, document : any) : Promise<void> {
+    protected async saveInternal(id : string, document : any) : Promise<void> {
         await this.pool.query(
             `INSERT INTO documents (collection, id, document) VALUES ($1, $2, $3)
              ON CONFLICT (collection, id) DO UPDATE SET document = EXCLUDED.document`,
@@ -13,7 +15,7 @@ class PostgresJsonStore implements JsonStore {
         );
     }
 
-    async retrieve(id : string) : Promise<any> {
+    protected async retrieveInternal(id : string) : Promise<any> {
         const result = await this.pool.query(
             "SELECT document FROM documents WHERE collection = $1 AND id = $2",
             [this.collection, id],
@@ -23,11 +25,11 @@ class PostgresJsonStore implements JsonStore {
         return result.rows[0].document;
     }
 
-    async delete(id : string) : Promise<void> {
+    protected async deleteInternal(id : string) : Promise<void> {
         await this.pool.query("DELETE FROM documents WHERE collection = $1 AND id = $2", [this.collection, id]);
     }
 
-    async list(pageSize : number = 100, page : number = 0) : Promise<Array<any>> {
+    protected async listInternal(pageSize : number = 100, page : number = 0) : Promise<Array<any>> {
         const result = await this.pool.query(
             "SELECT document FROM documents WHERE collection = $1 ORDER BY inserted_at LIMIT $2 OFFSET $3",
             [this.collection, pageSize, page * pageSize],

package/src/data-store/Schema.ts

@@ -54,30 +54,59 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
     await pool.query("ALTER TABLE anbaric_system.cli_keys ADD COLUMN IF NOT EXISTS tenant TEXT");
     await pool.query(`
         DO $$ BEGIN
-            CREATE TYPE anbaric_system.audit_change AS ENUM ('CREATE', 'UPDATE_PROPERTIES', 'CHANGE_STATE', 'DELETE');
+            CREATE TYPE anbaric_system.audit_interaction AS ENUM
+                ('CREATE', 'UPDATE_PROPERTIES', 'CHANGE_STATE', 'DELETE', 'READ', 'LIST');
         EXCEPTION WHEN duplicate_object THEN null;
         END $$
     `);
     await pool.query(`
         CREATE TABLE IF NOT EXISTS anbaric_system.audit_records (
-            id          BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-            job_id      TEXT NOT NULL,
-            actor_id    TEXT NOT NULL,
-            actor_type  TEXT NOT NULL,
-            change      anbaric_system.audit_change NOT NULL,
-            description TEXT NOT NULL,
-            details     JSONB,
-            at          TIMESTAMPTZ NOT NULL DEFAULT now()
+            id            BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            resource_type TEXT NOT NULL,
+            resource_id   TEXT NOT NULL,
+            actor_id      TEXT NOT NULL,
+            actor_type    TEXT NOT NULL,
+            interaction   anbaric_system.audit_interaction[] NOT NULL,
+            description   TEXT NOT NULL,
+            details       JSONB,
+            at            TIMESTAMPTZ NOT NULL DEFAULT now()
         )
     `);
-    await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS change anbaric_system.audit_change");
-    await pool.query("UPDATE anbaric_system.audit_records SET change = 'UPDATE_PROPERTIES' WHERE change IS NULL");
-    await pool.query("UPDATE anbaric_system.audit_records SET actor_id = 'system' WHERE actor_id IS NULL");
-    await pool.query("UPDATE anbaric_system.audit_records SET actor_type = 'CODE' WHERE actor_type IS NULL");
-    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN change SET NOT NULL");
-    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN actor_id SET NOT NULL");
-    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN actor_type SET NOT NULL");
-    await pool.query("CREATE INDEX IF NOT EXISTS audit_records_job_id ON anbaric_system.audit_records (job_id)");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS resource_type TEXT");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS resource_id TEXT");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS interaction anbaric_system.audit_interaction[]");
+    await pool.query(`
+        DO $$ BEGIN
+            IF EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'anbaric_system' AND table_name = 'audit_records'
+                         AND column_name = 'interaction' AND data_type <> 'ARRAY') THEN
+                ALTER TABLE anbaric_system.audit_records
+                    ALTER COLUMN interaction TYPE anbaric_system.audit_interaction[] USING ARRAY[interaction];
+            END IF;
+        END $$
+    `);
+    await pool.query(`
+        DO $$ BEGIN
+            IF EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'anbaric_system' AND table_name = 'audit_records'
+                         AND column_name = 'job_id') THEN
+                UPDATE anbaric_system.audit_records
+                    SET resource_type = COALESCE(resource_type, 'job'),
+                        resource_id = COALESCE(resource_id, job_id),
+                        interaction = COALESCE(interaction, ARRAY[change::text::anbaric_system.audit_interaction])
+                    WHERE resource_id IS NULL OR interaction IS NULL;
+                ALTER TABLE anbaric_system.audit_records DROP COLUMN job_id;
+                ALTER TABLE anbaric_system.audit_records DROP COLUMN change;
+            END IF;
+        END $$
+    `);
+    await pool.query("UPDATE anbaric_system.audit_records SET resource_type = 'job' WHERE resource_type IS NULL");
+    await pool.query("UPDATE anbaric_system.audit_records SET resource_id = 'unknown' WHERE resource_id IS NULL");
+    await pool.query("UPDATE anbaric_system.audit_records SET interaction = ARRAY['UPDATE_PROPERTIES']::anbaric_system.audit_interaction[] WHERE interaction IS NULL");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN resource_type SET NOT NULL");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN resource_id SET NOT NULL");
+    await pool.query("ALTER TABLE anbaric_system.audit_records ALTER COLUMN interaction SET NOT NULL");
+    await pool.query("CREATE INDEX IF NOT EXISTS audit_records_resource ON anbaric_system.audit_records (resource_type, resource_id)");
 };
 
 export { ensureSchema }

package/src/data-store/SecretsManagerSecretStore.ts

@@ -8,13 +8,16 @@ import {
     ResourceNotFoundException,
     SecretsManagerClient,
 } from "@aws-sdk/client-secrets-manager";
-import {SecretStore} from "anbaric-tsapi";
+import {Auditor, NoOpAuditor, SecretStore} from "anbaric-tsapi";
 
-class SecretsManagerSecretStore implements SecretStore {
+class SecretsManagerSecretStore extends SecretStore {
 
-    constructor(private client : SecretsManagerClient, private prefix : string = "anbaric/") {}
+    constructor(private client : SecretsManagerClient, private prefix : string = "anbaric/",
+                auditor : Auditor = new NoOpAuditor()) {
+        super(auditor);
+    }
 
-    async save(name : string, value : string) : Promise<void> {
+    protected async saveInternal(name : string, value : string) : Promise<void> {
         try {
             await this.client.send(new CreateSecretCommand({ Name: this.prefix + name, SecretString: value }));
         } catch (error) {
@@ -23,7 +26,7 @@ class SecretsManagerSecretStore implements SecretStore {
         }
     }
 
-    async retrieve(name : string) : Promise<string> {
+    protected async retrieveInternal(name : string) : Promise<string> {
         try {
             const secret = await this.client.send(new GetSecretValueCommand({ SecretId: this.prefix + name }));
             return secret.SecretString ?? "";
@@ -33,7 +36,7 @@ class SecretsManagerSecretStore implements SecretStore {
         }
     }
 
-    async delete(name : string) : Promise<void> {
+    protected async deleteInternal(name : string) : Promise<void> {
         try {
             await this.client.send(new DeleteSecretCommand({ SecretId: this.prefix + name, ForceDeleteWithoutRecovery: true }));
         } catch (error) {
@@ -41,7 +44,7 @@ class SecretsManagerSecretStore implements SecretStore {
         }
     }
 
-    async list() : Promise<Array<string>> {
+    protected async listInternal() : Promise<Array<string>> {
         const result = await this.client.send(new ListSecretsCommand({
             Filters: [{ Key: "name", Values: [this.prefix] }],
         }));

package/src/hosting/HostingServer.ts

@@ -20,8 +20,11 @@ import {PingHandler} from "./handlers/PingHandler";
 import {QueueHandler} from "./handlers/QueueHandler";
 import {SecretsHandler} from "./handlers/SecretsHandler";
 import {StateMachinesHandler} from "./handlers/StateMachinesHandler";
+import {PluginsHandler} from "./handlers/PluginsHandler";
 import {AuthenticationMiddleware} from "./middleware/AuthenticationMiddleware";
 import {SessionMiddleware} from "./middleware/SessionMiddleware";
+import {PageDirectory} from "../plugins/PageDirectory";
+import {LoadedPlugin} from "../plugins/Plugin";
 import {Request} from "./Request";
 import {Router} from "./Router";
 import {Server} from "./Server";
@@ -47,7 +50,8 @@ class HostingServer {
                 cliAuthorizer? : CliAuthorizer,
                 tokenAuthenticator? : TokenAuthenticator,
                 tenant? : string,
-                auditRecords? : AuditRecordStore) {
+                auditRecords? : AuditRecordStore,
+                plugins : Array<LoadedPlugin> = []) {
         const pages = new PagesHandler();
         const ping = new PingHandler(tenant);
         const jobs = new JobsHandler(persistence);
@@ -60,6 +64,12 @@ class HostingServer {
 
         const publicRouter = new Router();
         publicRouter.registerRoot(pages);
+        if (plugins.length > 0) {
+            for (const segment of new PageDirectory(plugins).topLevelSegments) {
+                publicRouter.register(segment, pages);
+            }
+            publicRouter.register("plugins", new PluginsHandler(plugins));
+        }
         publicRouter.register("ping", ping);
         publicRouter.register("audit", pages);
         publicRouter.register("whoami", new WhoamiHandler());

package/src/hosting/Request.ts

@@ -94,6 +94,11 @@ class Request {
         this.response.end(page);
     }
 
+    replyJavaScript(script : string) : void {
+        this.response.writeHead(200, { "content-type": "text/javascript" });
+        this.response.end(script);
+    }
+
     notFound() : void {
         this.reply(404, { error: "Not found" });
     }

package/src/hosting/handlers/AuditsHandler.ts

@@ -1,9 +1,9 @@
-import {AuditChange} from "anbaric-tsapi";
+import {AuditInteraction} from "anbaric-tsapi";
 import {AuditRecordStore} from "../../auditing/AuditRecordStore";
 import {Request} from "../Request";
 import {RequestHandler} from "../RequestHandler";
 
-const AUDIT_CHANGES = new Set(["CREATE", "UPDATE_PROPERTIES", "CHANGE_STATE", "DELETE"]);
+const AUDIT_INTERACTIONS = new Set(["CREATE", "UPDATE_PROPERTIES", "CHANGE_STATE", "DELETE", "READ", "LIST"]);
 
 class AuditsHandler implements RequestHandler {
 
@@ -23,21 +23,24 @@ class AuditsHandler implements RequestHandler {
 
     private async handleRecord(request : Request) : Promise<void> {
         const record = await request.body();
-        if (typeof record?.jobId !== "string" || typeof record?.description !== "string"
-            || typeof record?.actorId !== "string" || typeof record?.actorType !== "string"
-            || !AUDIT_CHANGES.has(record?.change)) {
-            return request.reply(400, { error: "Expected a body of { jobId, actorId, actorType, change, description, ... }" });
+        if (typeof record?.resourceType !== "string" || typeof record?.resourceId !== "string"
+            || typeof record?.description !== "string" || typeof record?.actorId !== "string"
+            || typeof record?.actorType !== "string"
+            || !Array.isArray(record?.interaction) || record.interaction.length === 0
+            || !record.interaction.every((interaction : unknown) => typeof interaction === "string" && AUDIT_INTERACTIONS.has(interaction))) {
+            return request.reply(400, { error: "Expected a body of { resourceType, resourceId, actorId, actorType, interaction: [...], description, ... }" });
         }
         await this.auditRecords.save(record);
         request.reply(204);
     }
 
     private async handleQuery(request : Request) : Promise<void> {
-        const change = request.query("change");
+        const interaction = request.query("interaction");
         const records = await this.auditRecords.list({
-            jobId: request.query("jobId"),
+            resourceType: request.query("resourceType"),
+            resourceId: request.query("resourceId"),
             actorId: request.query("actorId"),
-            change: change && AUDIT_CHANGES.has(change) ? change as AuditChange : undefined,
+            interaction: interaction && AUDIT_INTERACTIONS.has(interaction) ? interaction as AuditInteraction : undefined,
             search: request.query("search"),
             pageSize: request.query("pageSize") === undefined ? undefined : Number(request.query("pageSize")),
             page: request.query("page") === undefined ? undefined : Number(request.query("page")),

package/src/hosting/handlers/DocumentsHandler.ts

@@ -1,4 +1,4 @@
-import {JsonStore} from "anbaric-tsapi";
+import {JsonStore, SystemActor} from "anbaric-tsapi";
 import {Request} from "../Request";
 import {RequestHandler} from "../RequestHandler";
 
@@ -17,12 +17,12 @@ class DocumentsHandler implements RequestHandler {
     private async handleDocument(request : Request, store : JsonStore, documentId : string) : Promise<void> {
         switch (request.method) {
             case "PUT":
-                await store.save(documentId, await request.body());
+                await store.create(SystemActor.actor, documentId, await request.body());
                 return request.reply(204);
             case "GET":
-                return request.reply(200, await store.retrieve(documentId));
+                return request.reply(200, await store.retrieve(documentId, SystemActor.actor));
             case "DELETE":
-                await store.delete(documentId);
+                await store.delete(documentId, SystemActor.actor);
                 return request.reply(204);
         }
         request.notFound();
@@ -33,7 +33,7 @@ class DocumentsHandler implements RequestHandler {
             case "GET": {
                 const pageSize = Number(request.query("pageSize") ?? 100);
                 const page = Number(request.query("page") ?? 0);
-                return request.reply(200, await store.list(pageSize, page));
+                return request.reply(200, await store.list(SystemActor.actor, pageSize, page));
             }
         }
         request.notFound();

package/src/hosting/handlers/JobsHandler.ts

@@ -1,4 +1,4 @@
-import {JobPersistence, deserializeJob, serializeJob} from "anbaric-tsapi";
+import {JobPersistence, SystemActor, deserializeJob, serializeJob} from "anbaric-tsapi";
 import {Request} from "../Request";
 import {RequestHandler} from "../RequestHandler";
 
@@ -7,37 +7,20 @@ class JobsHandler implements RequestHandler {
     constructor(private persistence : JobPersistence) {}
 
     async handle(request : Request) : Promise<void> {
-        switch (request.subresource) {
-            case "properties":
-                if (request.id) return this.handleProperties(request, request.id);
-                break;
-            case undefined:
-                if (request.id) return this.handleJob(request, request.id);
-                return this.handleCollection(request);
-        }
-        request.notFound();
-    }
-
-    private async handleProperties(request : Request, id : string) : Promise<void> {
-        switch (request.method) {
-            case "PATCH": {
-                const properties = new Map<string, any>(Object.entries(await request.body()));
-                await this.persistence.updateProperties(id, properties);
-                return request.reply(204);
-            }
-        }
-        request.notFound();
+        if (request.subresource) return request.notFound();
+        if (request.id) return this.handleJob(request, request.id);
+        return this.handleCollection(request);
     }
 
     private async handleJob(request : Request, id : string) : Promise<void> {
         switch (request.method) {
             case "PUT":
-                await this.persistence.save(deserializeJob(await request.body()));
+                await this.persistence.create(SystemActor.actor, deserializeJob(await request.body()));
                 return request.reply(204);
             case "GET":
-                return request.reply(200, serializeJob(await this.persistence.retrieve(id)));
+                return request.reply(200, serializeJob(await this.persistence.retrieve(id, SystemActor.actor)));
             case "DELETE":
-                await this.persistence.delete(id);
+                await this.persistence.delete(id, SystemActor.actor);
                 return request.reply(204);
         }
         request.notFound();
@@ -48,7 +31,7 @@ class JobsHandler implements RequestHandler {
             case "GET": {
                 const pageSize = Number(request.query("pageSize") ?? 100);
                 const page = Number(request.query("page") ?? 0);
-                const jobs = await this.persistence.list(pageSize, page);
+                const jobs = await this.persistence.list(SystemActor.actor, pageSize, page);
                 return request.reply(200, jobs.map(serializeJob));
             }
         }