auth/cell_grant_audit_metadata.ts

Audit-log metadata schemas for the cell_grant ACL events.

IDs only — no display-name snapshots. By convention audit logs store references, not denormalized strings; viewer tooling resolves actor_id → actor.name, scope_id → scope name, etc. at read time.

Apps register these via extra_events: on create_audit_log_config alongside the other cell metadata schemas.

view source

Declarations
#

3 declarations

CellGrantCreateAuditMetadata
#

auth/cell_grant_audit_metadata.ts view source

ZodObject<{ cell_id: $ZodBranded<ZodUUID, "Uuid", "out">; grant_id: $ZodBranded<ZodUUID, "Uuid", "out">; level: ZodEnum<{ viewer: "viewer"; editor: "editor"; }>; principal: ZodUnion<...>; }, $loose>

import type {CellGrantCreateAuditMetadata} from '@fuzdev/fuz_app/auth/cell_grant_audit_metadata.js';

Metadata envelope for cell_grant_create.

Emitted on every successful create OR re-share update path (UPSERT-on-unique-index). The audit reader correlates create-vs-update via grant_id if needed; the design doesn't require distinguishing the two at the metadata level.

CellGrantPrincipalAuditMetadata
#

auth/cell_grant_audit_metadata.ts view source

ZodUnion<readonly [ZodObject<{ actor_id: $ZodBranded<ZodUUID, "Uuid", "out">; }, $loose>, ZodObject<{ role: ZodString; scope_id: ZodNullable<$ZodBranded<ZodUUID, "Uuid", "out">>; }, $loose>]>

import type {CellGrantPrincipalAuditMetadata} from '@fuzdev/fuz_app/auth/cell_grant_audit_metadata.js';

Principal columns as stored on cell_grant. Discriminated by which keys are present: {actor_id} for an actor-shaped grant, {role, scope_id} for a role-shaped grant. Actor-shaped grants carry only the id; names are never persisted in the audit envelope.

CellGrantRevokeAuditMetadata
#

auth/cell_grant_audit_metadata.ts view source

ZodObject<{ cell_id: $ZodBranded<ZodUUID, "Uuid", "out">; grant_id: $ZodBranded<ZodUUID, "Uuid", "out">; level: ZodEnum<{ viewer: "viewer"; editor: "editor"; }>; principal: ZodUnion<...>; self: ZodOptional<...>; }, $loose>

import type {CellGrantRevokeAuditMetadata} from '@fuzdev/fuz_app/auth/cell_grant_audit_metadata.js';

Metadata envelope for cell_grant_revoke.

self: true distinguishes the recipient-side "leave shared cell" path (actor-shaped grant where the principal actor === caller actor) from a delegator-side revoke. Single event type for both — the boolean is enough for forensic review and avoids surface- doubling with a parallel cell_grant_leave event.