From c99ca0e46174f4d3c8104b9ec2b3cdbde43a1740 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Fri, 15 May 2026 15:09:58 +0200
Subject: [PATCH] update audit entry to more specified perfomed by

---
 .../buildcounter.txt                          |  2 +-
 .../AutopilotMonitor.Agent/buildcounter.txt   |  2 +-
 .../Deletion/SessionDeletionHandler.cs        | 24 ++++++++++++++++++-
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
index 29988c80..e2979846 100644
--- a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
@@ -1 +1 @@
-751
+754
diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index 07aeb9bc..79abba84 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-1345
+1348
diff --git a/src/Backend/AutopilotMonitor.Functions/Services/Deletion/SessionDeletionHandler.cs b/src/Backend/AutopilotMonitor.Functions/Services/Deletion/SessionDeletionHandler.cs
index d300ac3b..f99099ed 100644
--- a/src/Backend/AutopilotMonitor.Functions/Services/Deletion/SessionDeletionHandler.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Services/Deletion/SessionDeletionHandler.cs
@@ -276,7 +276,7 @@ namespace AutopilotMonitor.Functions.Services.Deletion
                 action: "deletion_completed",
                 entityType: "Session",
                 entityId: sessionId,
-                performedBy: "system",
+                performedBy: FormatCompletedPerformer(manifest.CreatedBy),
                 details: BuildCompletedDetails(manifestId, manifest, sw.ElapsedMilliseconds))
                 .ConfigureAwait(false);
 
@@ -647,6 +647,28 @@ namespace AutopilotMonitor.Functions.Services.Deletion
             };
         }
 
+        /// <summary>
+        /// Surfaces the original cascade trigger on the <c>deletion_completed</c> audit row so a
+        /// GA can tell admin-triggered deletes apart from retention-cutoff sweeps at a glance,
+        /// without having to cross-reference the (suppressed-for-retention) <c>deletion_started</c>
+        /// entry.
+        /// <list type="bullet">
+        ///   <item><c>admin</c> path → <c>"system (admin: {user})"</c> — same UPN that's on deletion_started.</item>
+        ///   <item><c>maintenance</c> path → <c>"system (maintenance)"</c> — distinct from the raw
+        ///       <c>"System.Maintenance"</c> string that the suppression filter still matches on, so this
+        ///       audit row stays visible in the human-facing list.</item>
+        /// </list>
+        /// </summary>
+        private static string FormatCompletedPerformer(DeletionActor createdBy)
+        {
+            if (string.Equals(createdBy.Type, "maintenance", StringComparison.OrdinalIgnoreCase))
+                return "system (maintenance)";
+            if (string.Equals(createdBy.Type, "admin", StringComparison.OrdinalIgnoreCase)
+                && !string.IsNullOrWhiteSpace(createdBy.Actor))
+                return $"system (admin: {createdBy.Actor})";
+            return "system";
+        }
+
         private void LogStepFailed(
             string tenantId, string sessionId, string manifestId, DeletionStep step, Exception ex)
         {