pipework 0.115.0 → 0.116.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.116.0
+
+- **Added: a step graph run carries the requesting actor** (#601). `request()` records the requesting Flow's actor (`auth.userId`) on the run (new nullable `pipework_step_run.actor` column; run `pipework generate` for an existing database). Every step job, the `finish` job that delivers `onDone`, and `onFailed` run with `auth = { userId }`, so audited writes in them name the user who started the run. A later request by another user carries that user for the steps it queues. `RequestOptions.carryActor: false` records none.
+- **Added: `EnqueueOptions.actor?: string | null`**: record this actor instead of the Flow's (`null` for none); overrides `carryActor`.
+- **Fixed: `onFailed` ran with no `auth` in its Flow** (its trace had the actor, its audited writes did not).
+
 ## 0.115.0
 
 - **Added: every traced answer carries `x-pipework-trace-id`** (#599), the request's trace row id (`trace.id`). A browser reads it once the route's CORS `exposedHeaders` lists it, and sends it as `ClientFaultReport.traceId`, which then names a real trace. Not set with tracing off, or on an answer refused before the request's context is built (a 401 from auth, a 404 before routing). `x-request-id` is unchanged.

package/REFERENCE.md

@@ -250,7 +250,7 @@ Computes the next fire time for a CronSchedule after a given date, with optional
 - **Trace.** The job's trace is a child of the enqueuing trace: `trace.parent_id` is the enqueuing trace, `root_id` its root, `parent_step_id` the step open at enqueue. Nothing is recorded when tracing is off or the enqueuing trace is truncated.
 - **Tenant.** The job runs under the enqueuing Flow's `tenant` (the tenant string, whatever its key type), so row-level security applies as it does for a request.
 - **Actor.** Only with `carryActor: true`: the job's `auth` is `{ userId }` from the Flow's `auth.userId`, so audited writes record that `actor_id`. Otherwise the job's `auth` is `null`.
-- **Options on `EnqueueOptions`.** `continueFlow?: boolean` (default `true`; `false` records none of the above, so the job is a root trace with no tenant), `tenant?: string | null` (run under this tenant instead of the Flow's; `null` runs without one), `carryActor?: boolean` (default `false`).
+- **Options on `EnqueueOptions`.** `continueFlow?: boolean` (default `true`; `false` records none of the above, so the job is a root trace with no tenant), `tenant?: string | null` (run under this tenant instead of the Flow's; `null` runs without one), `carryActor?: boolean` (default `false`), `actor?: string | null` (record this actor instead of the Flow's, `null` for none; overrides `carryActor`).
 - **No Flow.** Enqueued outside any Flow (a script, a schedule): the columns are null and the job runs as before. Schedule-fired jobs never continue a flow.
 - **Retries and `enqueueAndWait`** keep the recorded flow. `ClaimedJob.flow` exposes `{ traceId, rootId, stepId, tenant, actor }`.
 - **`executeJob`** takes `parent?: ParentTraceRef | null` (`{ id, rootId, stepId? }`); omitted, it continues the active Flow's trace and records the open step as `parent_step_id`.