53416f6535
Record auditable provenance for every configuration mutation. - Add system and verified/unverified API configuration actors. - Propagate request provenance through settings, workflow, sync, and portability routes. - Cover mutation attribution across core persistence and dashboard routes. Files changed: .changeset/fn-8851-settings-attribution.md | 7 + .../postgres/settings-persistence.pg.test.ts | 17 +++ .../settings-revision-attribution.test.ts | 102 ++++++++++++++ packages/core/src/automation/automation-store.ts | 11 +- packages/core/src/automation/routine-store.ts | 9 +- packages/core/src/config/global-settings.ts | 5 +- packages/core/src/index.gate.ts | 1 + packages/core/src/index.ts | 1 + packages/core/src/task-store/settings-ops.ts | 5 +- packages/core/src/task-store/task-mutation-ops.ts | 5 +- packages/core/src/types.ts | 2 + packages/core/src/types/agents/agents.ts | 12 ++ .../src/__tests__/auth-middleware.test.ts | 29 +++- .../dashboard/src/__tests__/request-actor.test.ts | 46 ++++++ packages/dashboard/src/auth-middleware.ts | 8 ++ packages/dashboard/src/request-actor.ts | 13 ++ .../register-org-portability-routes.test.ts | 17 ++- .../register-settings-memory-worktrunk.test.ts | 45 +++++- .../__tests__/settings-sync-attribution.test.ts | 156 +++++++++++++++++++++ .../src/routes/__tests__/workflow-setting-attribution.test.ts | 73 ++++++++++ .../src/routes/register-org-portability-routes.ts | 3 +- .../src/routes/register-settings-memory-routes.ts | 3 +- .../src/routes/register-settings-sync-inbound-routes.ts | 18 ++- .../src/routes/register-settings-sync-routes.ts | 18 ++- .../src/routes/register-workflow-routes.ts | 3 + 25 files changed, 576 insertions(+), 33 deletions(-) Fusion-Task-Id: FN-8851 Fusion-Task-Lineage: 27a51666-f9ed-4395-99dc-d7ae47f119e1 Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
14 lines
643 B
TypeScript
14 lines
643 B
TypeScript
import type { ConfigChangedBy } from "@fusion/core";
|
|
import { CONFIG_CHANGED_BY_API_UNVERIFIED, CONFIG_CHANGED_BY_API_VERIFIED_TOKEN } from "@fusion/core";
|
|
import type { Request } from "express";
|
|
import { hasVerifiedDaemonRequest } from "./auth-middleware.js";
|
|
|
|
/*
|
|
FNXC:ConfigVersioning 2026-08-09-04:06:
|
|
A shared daemon token never identifies a human. This helper reads only the
|
|
middleware verification marker, never client credentials or request input.
|
|
*/
|
|
export function resolveRequestActor(req: Request): ConfigChangedBy {
|
|
return hasVerifiedDaemonRequest(req) ? CONFIG_CHANGED_BY_API_VERIFIED_TOKEN : CONFIG_CHANGED_BY_API_UNVERIFIED;
|
|
}
|