Merge pull request #1440 from openziti/entity-change-events

entity change events

controller/handler_edge_ctrl/common.go

@@ -115,27 +115,32 @@ type baseSessionRequestContext struct {
 }
 
 func (self *baseSessionRequestContext) newChangeContext() *change.Context {
-	result := change.New().SetSource(fmt.Sprintf("ctrl[edge/%v]", self.handler.getChannel().Underlay().GetRemoteAddr().String()))
+	result := change.New().SetSourceType(change.SourceTypeControlChannel).
+		SetSourceMethod(self.handler.Label()).
+		SetSourceLocal(self.handler.getChannel().Underlay().GetLocalAddr().String()).
+		SetSourceRemote(self.handler.getChannel().Underlay().GetRemoteAddr().String())
 	if self.session != nil {
 		result.
+			SetChangeAuthorType(change.AuthorTypeIdentity).
 			SetChangeAuthorId(self.session.IdentityId).
-			SetChangeAuthorName(self.apiSession.Identity.Name).
-			SetChangeAuthorType("identity")
+			SetChangeAuthorName(self.apiSession.Identity.Name)
 	} else if self.sourceRouter != nil {
 		result.
+			SetChangeAuthorType(change.AuthorTypeRouter).
 			SetChangeAuthorId(self.sourceRouter.Id).
-			SetChangeAuthorName(self.sourceRouter.Name).
-			SetChangeAuthorType("router")
+			SetChangeAuthorName(self.sourceRouter.Name)
 	}
 	return result
 }
 
 func (self *baseSessionRequestContext) newTunnelChangeContext() *change.Context {
-	return change.New().
+	return change.New().SetSourceType(change.SourceTypeControlChannel).
+		SetSourceMethod(self.handler.Label()).
+		SetSourceLocal(self.handler.getChannel().Underlay().GetLocalAddr().String()).
+		SetSourceRemote(self.handler.getChannel().Underlay().GetRemoteAddr().String()).
+		SetChangeAuthorType(change.AuthorTypeRouter).
 		SetChangeAuthorId(self.sourceRouter.Id).
-		SetChangeAuthorName(self.sourceRouter.Name).
-		SetChangeAuthorType("router").
-		SetSource(fmt.Sprintf("ctrl[edge:tunnel/%v]", self.handler.getChannel().Underlay().GetRemoteAddr().String()))
+		SetChangeAuthorName(self.sourceRouter.Name)
 }
 
 func (self *baseSessionRequestContext) GetMessage() *channel.Message {

controller/handler_edge_ctrl/extend_enrollment.go

@@ -17,7 +17,6 @@
 package handler_edge_ctrl
 
 import (
-	"fmt"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/channel/v2"
 	"github.com/openziti/edge/controller/env"
@@ -33,11 +32,13 @@ func newRouterChangeContext(router interface {
 	models.Named
 	GetId() string
 }, ch channel.Channel) *change.Context {
-	return change.New().
+	return change.New().SetSourceType(change.SourceTypeControlChannel).
+		SetSourceMethod("extend.router.enrollment").
+		SetSourceLocal(ch.Underlay().GetLocalAddr().String()).
+		SetSourceRemote(ch.Underlay().GetRemoteAddr().String()).
+		SetChangeAuthorType(change.AuthorTypeRouter).
 		SetChangeAuthorId(router.GetId()).
-		SetChangeAuthorName(router.GetName()).
-		SetChangeAuthorType("router").
-		SetSource(fmt.Sprintf("ctrl[edge/%v]", ch.Underlay().GetRemoteAddr().String()))
+		SetChangeAuthorName(router.GetName())
 }
 
 type extendEnrollmentHandler struct {

controller/internal/policy/api_session_enforcer.go

@@ -98,7 +98,7 @@ func (s *ApiSessionEnforcer) Run() error {
 
 		logrus.Debugf("found %v expired api-sessions to remove", len(ids))
 
-		ctx := change.New().SetSource("api-session.enforcer").SetChangeAuthorType("controller")
+		ctx := change.New().SetSourceType("api-session.enforcer").SetChangeAuthorType(change.AuthorTypeController)
 		if err = s.appEnv.GetManagers().ApiSession.DeleteBatch(ids, ctx); err != nil {
 			logrus.WithError(err).Error("failure while batch deleting expired api sessions")
 

controller/internal/policy/service_policy_enforcer.go

@@ -102,7 +102,7 @@ func (enforcer *ServicePolicyEnforcer) handleServiceEvent(event *persistence.Ser
 		}
 	}
 
-	ctx := change.New().SetSource("service-policy.enforcer").SetChangeAuthorType("controller")
+	ctx := change.New().SetSourceType("service-policy.enforcer").SetChangeAuthorType(change.AuthorTypeController)
 	for _, sessionId := range sessionsToDelete {
 		_ = enforcer.appEnv.GetManagers().Session.Delete(sessionId, ctx)
 		log.Debugf("session %v deleted", sessionId)
@@ -152,7 +152,7 @@ func (enforcer *ServicePolicyEnforcer) Run() error {
 			if session.Type == persistence.SessionTypeBind {
 				policyType = persistence.PolicyTypeBind
 			}
-			query := fmt.Sprintf(`id = "%v" and not isEmpty(from servicePolicies where type = %v and anyOf(services) = "%v")`, identity.Id, int32(policyType), session.ServiceId)
+			query := fmt.Sprintf(`id = "%v" and not isEmpty(from servicePolicies where type = %v and anyOf(services) = "%v")`, identity.Id, policyType.Id(), session.ServiceId)
 			_, count, err := enforcer.appEnv.GetStores().Identity.QueryIds(tx, query)
 			if err != nil {
 				return err
@@ -168,7 +168,7 @@ func (enforcer *ServicePolicyEnforcer) Run() error {
 		return err
 	}
 
-	ctx := change.New().SetSource("service-policy.enforcer").SetChangeAuthorType("controller")
+	ctx := change.New().SetSourceType("service-policy.enforcer").SetChangeAuthorType(change.AuthorTypeController)
 	for _, sessionId := range sessionsToRemove {
 		_ = enforcer.appEnv.GetManagers().Session.Delete(sessionId, ctx)
 	}

controller/model/api_session_manager.go

@@ -169,7 +169,7 @@ func (self *ApiSessionManager) MarkActivityByTokens(tokens ...string) ([]string,
 }
 
 func (self *ApiSessionManager) heartbeatFlush(beats []*Heartbeat) {
-	changeCtx := change.New().SetSource("heartbeat.flush").SetChangeAuthorType("controller")
+	changeCtx := change.New().SetSourceType("heartbeat.flush").SetChangeAuthorType(change.AuthorTypeController)
 	err := self.GetDb().Batch(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
 		store := self.Store.(persistence.ApiSessionStore)
 

controller/model/edge_router_manager_test.go

@@ -21,7 +21,7 @@ func (ctx *TestContext) testGetEdgeRoutersForServiceAndIdentity(*testing.T) {
 	identity := ctx.requireNewIdentity(false)
 	service := ctx.requireNewService()
 	service.RoleAttributes = []string{eid.New()}
-	ctx.NoError(ctx.managers.EdgeService.Update(service, nil, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.EdgeService.Update(service, nil, change.New()))
 
 	ctx.requireNewEdgeRouterPolicy(ss("#all"), ss("#all"))
 
@@ -38,7 +38,7 @@ func (ctx *TestContext) testGetEdgeRoutersForServiceAndIdentity(*testing.T) {
 	ctx.False(ctx.managers.EdgeRouter.IsSharedEdgeRouterPresent(identity.Id, service.Id))
 
 	serp.EdgeRouterRoles = []string{"@" + edgeRouter.Id}
-	ctx.NoError(ctx.managers.ServiceEdgeRouterPolicy.Update(serp, nil, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.ServiceEdgeRouterPolicy.Update(serp, nil, change.New()))
 
 	// should be accessible if we limit to our specific router
 	ctx.True(ctx.isEdgeRouterAccessible(edgeRouter.Id, identity.Id, service.Id))

controller/model/edge_service_manager.go

@@ -350,7 +350,7 @@ func (self *EdgeServiceManager) GetPolicyPostureChecks(identityId, serviceId str
 			policyName := boltz.FieldToString(policyNameSymbol.Eval(tx, policyIdBytes))
 			policyType := persistence.PolicyTypeDial
 			if fieldType, policyTypeValue := policyTypeSymbol.Eval(tx, policyIdBytes); fieldType == boltz.TypeInt32 {
-				policyType = persistence.PolicyType(*boltz.BytesToInt32(policyTypeValue))
+				policyType = persistence.GetPolicyTypeForId(*boltz.BytesToInt32(policyTypeValue))
 			}
 
 			//required to provide an entry for policies w/ no checks

controller/model/enrollment.go

@@ -186,7 +186,7 @@ func (context *EnrollmentContextHttp) FillFromHttpRequest(request *http.Request,
 	context.Data = enrollData
 	context.Certs = request.TLS.PeerCertificates
 	context.Headers = headers
-	context.ChangeContext = changeCtx
+	context.ChangeContext = changeCtx.SetChangeAuthorType("enrollment")
 
 	return nil
 }

controller/model/enrollment_mod_erott.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/apierror"
 	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/pkg/errors"
 	"time"
@@ -67,6 +68,11 @@ func (module *EnrollModuleEr) Process(context EnrollmentContext) (*EnrollmentRes
 		return nil, apierror.NewInvalidEnrollmentToken()
 	}
 
+	context.GetChangeContext().
+		SetChangeAuthorType(change.AuthorTypeRouter).
+		SetChangeAuthorId(edgeRouter.Id).
+		SetChangeAuthorName(edgeRouter.Name)
+
 	if time.Now().After(*enrollment.ExpiresAt) {
 		return nil, apierror.NewEnrollmentExpired()
 	}

controller/model/enrollment_mod_ott.go

@@ -23,6 +23,7 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/eid"
 	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/models"
 )
 
@@ -64,6 +65,11 @@ func (module *EnrollModuleOtt) Process(ctx EnrollmentContext) (*EnrollmentResult
 		return nil, apierror.NewInvalidEnrollmentToken()
 	}
 
+	ctx.GetChangeContext().
+		SetChangeAuthorType(change.AuthorTypeIdentity).
+		SetChangeAuthorId(identity.Id).
+		SetChangeAuthorName(identity.Name)
+
 	csrPem := ctx.GetDataAsByteArray()
 
 	csr, err := cert.ParseCsrPem(csrPem)

controller/model/enrollment_mod_ottca.go

@@ -23,6 +23,7 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/internal/cert"
 	fabricApiError "github.com/openziti/fabric/controller/apierror"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/models"
 )
 
@@ -64,6 +65,11 @@ func (module *EnrollModuleOttCa) Process(ctx EnrollmentContext) (*EnrollmentResu
 		return nil, apierror.NewInvalidEnrollmentToken()
 	}
 
+	ctx.GetChangeContext().
+		SetChangeAuthorType(change.AuthorTypeIdentity).
+		SetChangeAuthorId(identity.Id).
+		SetChangeAuthorName(identity.Name)
+
 	if enrollment.CaId == nil {
 		return nil, apierror.NewInvalidEnrollmentToken()
 	}

controller/model/enrollment_mod_trott.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/apierror"
 	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/change"
 	"time"
 )
 
@@ -63,6 +64,11 @@ func (module *EnrollModuleRouterOtt) Process(context EnrollmentContext) (*Enroll
 		return nil, apierror.NewInvalidEnrollmentToken()
 	}
 
+	context.GetChangeContext().
+		SetChangeAuthorType(change.AuthorTypeRouter).
+		SetChangeAuthorId(txRouter.Id).
+		SetChangeAuthorName(txRouter.Name)
+
 	if time.Now().After(*enrollment.ExpiresAt) {
 		return nil, apierror.NewEnrollmentExpired()
 	}

controller/model/enrollment_mod_updb.go

@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/edge/crypto"
 	"github.com/openziti/edge/eid"
 	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/foundation/v2/errorz"
 )
@@ -66,6 +67,11 @@ func (module *EnrollModuleUpdb) Process(ctx EnrollmentContext) (*EnrollmentResul
 		return nil, apierror.NewInvalidEnrollmentToken()
 	}
 
+	ctx.GetChangeContext().
+		SetChangeAuthorType(change.AuthorTypeIdentity).
+		SetChangeAuthorId(identity.Id).
+		SetChangeAuthorName(identity.Name)
+
 	data := ctx.GetDataAsMap()
 
 	password := ""

controller/model/identity_manager.go

@@ -239,7 +239,7 @@ func (self *IdentityManager) InitializeDefaultAdmin(username, password, name str
 		},
 	}
 
-	ctx := change.New().SetSource("cli.init").SetChangeAuthorType("cli")
+	ctx := change.New().SetSourceType("cli.init").SetChangeAuthorType(change.AuthorTypeController)
 	if err = self.Create(defaultAdmin, ctx); err != nil {
 		return err
 	}

controller/model/policy_advisor.go

@@ -88,8 +88,8 @@ func (advisor *PolicyAdvisor) getServicePermissions(identityId, serviceId string
 			return err
 		}
 		if servicePolicyStore.IsEntityRelated(tx, servicePolicyId, db.EntityTypeServices, serviceId) {
-			if !stringz.Contains(permissions, servicePolicy.GetPolicyTypeName()) {
-				permissions = append(permissions, servicePolicy.GetPolicyTypeName())
+			if !stringz.Contains(permissions, string(servicePolicy.PolicyType)) {
+				permissions = append(permissions, string(servicePolicy.PolicyType))
 			}
 		}
 		return nil

controller/model/posture_response_manager.go

@@ -209,7 +209,7 @@ func (self *PostureResponseManager) postureDataUpdated(env Env, identityId strin
 
 	for _, sessionId := range sessionIdsToDelete {
 		//todo: delete batch?
-		_ = self.env.GetManagers().Session.Delete(sessionId, change.New().SetSource("posture.cache").SetChangeAuthorType("controller"))
+		_ = self.env.GetManagers().Session.Delete(sessionId, change.New().SetSourceType("posture.cache").SetChangeAuthorType(change.AuthorTypeController))
 	}
 }
 

controller/model/posture_response_model.go

@@ -153,7 +153,7 @@ func (pc *PostureCache) evaluate() {
 
 		//delete sessions that failed pc checks, clear list
 		for _, sessionId := range toDeleteSessionIds {
-			err := pc.env.GetManagers().Session.Delete(sessionId, change.New().SetSource("posture.cache").SetChangeAuthorType("controller"))
+			err := pc.env.GetManagers().Session.Delete(sessionId, change.New().SetSourceType("posture.cache").SetChangeAuthorType(change.AuthorTypeController))
 			if err != nil {
 				log.WithError(err).Errorf("error removing session [%s] due to posture check failure, delete error: %v", sessionId, err)
 			}

controller/model/service_policy_model.go

@@ -78,16 +78,9 @@ func (entity *ServicePolicy) toBoltEntityForUpdate(_ *bbolt.Tx, _ Env, checker b
 }
 
 func (entity *ServicePolicy) fillFrom(_ Env, _ *bbolt.Tx, boltServicePolicy *persistence.ServicePolicy) error {
-	policyType := "Invalid"
-	if boltServicePolicy.PolicyType == persistence.PolicyTypeDial {
-		policyType = persistence.PolicyTypeDialName
-	} else if boltServicePolicy.PolicyType == persistence.PolicyTypeBind {
-		policyType = persistence.PolicyTypeBindName
-	}
-
 	entity.FillCommon(boltServicePolicy)
 	entity.Name = boltServicePolicy.Name
-	entity.PolicyType = policyType
+	entity.PolicyType = string(boltServicePolicy.PolicyType)
 	entity.Semantic = boltServicePolicy.Semantic
 	entity.ServiceRoles = boltServicePolicy.ServiceRoles
 	entity.IdentityRoles = boltServicePolicy.IdentityRoles

controller/model/session_manager_test.go

@@ -24,7 +24,7 @@ func (ctx *TestContext) testSessionIdempotency(t *testing.T) {
 	service := ctx.requireNewService()
 	service2 := ctx.requireNewService()
 	service.RoleAttributes = []string{eid.New()}
-	ctx.NoError(ctx.managers.EdgeService.Update(service, nil, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.EdgeService.Update(service, nil, change.New()))
 
 	ctx.requireNewServicePolicy(persistence.PolicyTypeDialName, ss("#all"), ss("#all"))
 	ctx.requireNewServicePolicy(persistence.PolicyTypeBindName, ss("#all"), ss("#all"))
@@ -69,7 +69,7 @@ func (ctx *TestContext) testSessionIdempotency(t *testing.T) {
 	req.Equal(sessSvc1Dial.Id, sessSvc1Dial3.Id)
 	req.Equal(sessSvc1Bind.Id, sessSvc1Bind3.Id)
 
-	req.NoError(ctx.managers.ApiSession.Delete(apiSession.Id, change.New().SetSource("test")))
+	req.NoError(ctx.managers.ApiSession.Delete(apiSession.Id, change.New()))
 	done, err := ctx.GetStores().EventualEventer.Trigger()
 	ctx.NoError(err)
 

controller/model/testing.go

@@ -170,7 +170,7 @@ func (ctx *TestContext) requireNewIdentity(isAdmin bool) *Identity {
 		IsAdmin:        isAdmin,
 		IdentityTypeId: identityType.Id,
 	}
-	ctx.NoError(ctx.managers.Identity.Create(identity, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.Identity.Create(identity, change.New()))
 	return identity
 }
 
@@ -178,7 +178,7 @@ func (ctx *TestContext) requireNewService() *Service {
 	service := &Service{
 		Name: eid.New(),
 	}
-	ctx.NoError(ctx.managers.EdgeService.Create(service, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.EdgeService.Create(service, change.New()))
 	return service
 }
 
@@ -186,7 +186,7 @@ func (ctx *TestContext) requireNewEdgeRouter() *EdgeRouter {
 	edgeRouter := &EdgeRouter{
 		Name: eid.New(),
 	}
-	ctx.NoError(ctx.managers.EdgeRouter.Create(edgeRouter, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.EdgeRouter.Create(edgeRouter, change.New()))
 	return edgeRouter
 }
 
@@ -210,7 +210,7 @@ func (ctx *TestContext) requireNewSession(apiSession *ApiSession, serviceId stri
 		ServiceId:    serviceId,
 		Type:         sessionType,
 	}
-	_, err := ctx.managers.Session.Create(entity, change.New().SetSource("test"))
+	_, err := ctx.managers.Session.Create(entity, change.New())
 	ctx.NoError(err)
 	return entity
 }
@@ -223,7 +223,7 @@ func (ctx *TestContext) requireNewServicePolicy(policyType string, identityRoles
 		ServiceRoles:  serviceRoles,
 		PolicyType:    policyType,
 	}
-	ctx.NoError(ctx.managers.ServicePolicy.Create(policy, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.ServicePolicy.Create(policy, change.New()))
 	return policy
 }
 
@@ -234,7 +234,7 @@ func (ctx *TestContext) requireNewEdgeRouterPolicy(identityRoles, edgeRouterRole
 		IdentityRoles:   identityRoles,
 		EdgeRouterRoles: edgeRouterRoles,
 	}
-	ctx.NoError(ctx.managers.EdgeRouterPolicy.Create(policy, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.EdgeRouterPolicy.Create(policy, change.New()))
 	return policy
 }
 
@@ -245,7 +245,7 @@ func (ctx *TestContext) requireNewServiceNewEdgeRouterPolicy(serviceRoles, edgeR
 		ServiceRoles:    serviceRoles,
 		EdgeRouterRoles: edgeRouterRoles,
 	}
-	ctx.NoError(ctx.managers.ServiceEdgeRouterPolicy.Create(policy, change.New().SetSource("test")))
+	ctx.NoError(ctx.managers.ServiceEdgeRouterPolicy.Create(policy, change.New()))
 	return policy
 }
 

controller/persistence/api_session_certificate_store.go

@@ -33,12 +33,12 @@ const (
 
 type ApiSessionCertificate struct {
 	boltz.BaseExtEntity
-	ApiSessionId string
-	Subject      string
-	Fingerprint  string
-	ValidAfter   *time.Time
-	ValidBefore  *time.Time
-	PEM          string
+	ApiSessionId string     `json:"apiSessionId"`
+	Subject      string     `json:"subject"`
+	Fingerprint  string     `json:"fingerprint"`
+	ValidAfter   *time.Time `json:"validAfter"`
+	ValidBefore  *time.Time `json:"validBefore"`
+	PEM          string     `json:"pem"`
 }
 
 func (entity *ApiSessionCertificate) GetEntityType() string {

controller/persistence/api_session_store.go

@@ -46,14 +46,14 @@ const (
 
 type ApiSession struct {
 	boltz.BaseExtEntity
-	IdentityId      string
-	Token           string
-	IPAddress       string
-	ConfigTypes     []string
-	MfaComplete     bool
-	MfaRequired     bool
-	LastActivityAt  time.Time
-	AuthenticatorId string
+	IdentityId      string    `json:"identityId"`
+	Token           string    `json:"token"`
+	IPAddress       string    `json:"ipAddress"`
+	ConfigTypes     []string  `json:"configTypes"`
+	MfaComplete     bool      `json:"mfaComplete"`
+	MfaRequired     bool      `json:"mfaRequired"`
+	LastActivityAt  time.Time `json:"lastActivityAt"`
+	AuthenticatorId string    `json:"authenticatorId"`
 }
 
 func NewApiSession(identityId string) *ApiSession {
@@ -151,7 +151,7 @@ func (store *apiSessionStoreImpl) onEventualDelete(name string, apiSessionId []b
 	}
 
 	for _, id := range idCollector.ids {
-		changeContext := change.New().SetSource("events.emitter").SetChangeAuthorType("controller")
+		changeContext := change.New().SetSourceType("events.emitter").SetChangeAuthorType(change.AuthorTypeController)
 		err = store.stores.DbProvider.GetDb().Update(changeContext.NewMutateContext(), func(ctx boltz.MutateContext) error {
 			if err := store.stores.session.DeleteById(ctx, id); err != nil {
 				if boltz.IsErrNotFoundErr(err) {
@@ -171,7 +171,7 @@ func (store *apiSessionStoreImpl) onEventualDelete(name string, apiSessionId []b
 		}
 	}
 
-	changeContext := change.New().SetSource("events.emitter").SetChangeAuthorType("controller")
+	changeContext := change.New().SetSourceType("events.emitter").SetChangeAuthorType(change.AuthorTypeController)
 	err = store.stores.DbProvider.GetDb().Update(changeContext.NewMutateContext(), func(ctx boltz.MutateContext) error {
 		if bucket := boltz.Path(ctx.Tx(), indexPath...); bucket != nil {
 			if err := bucket.DeleteBucket(apiSessionId); err != nil {

controller/persistence/api_session_store_test.go

@@ -175,7 +175,7 @@ func (ctx *TestContext) testUpdateApiSessions(t *testing.T) {
 	entities := ctx.createApiSessionTestEntities()
 	earlier := time.Now()
 
-	mutateCtx := change.New().SetSource("test").NewMutateContext()
+	mutateCtx := change.New().NewMutateContext()
 	err := ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		tx := mutateCtx.Tx()
 		original, err := ctx.stores.ApiSession.LoadOneById(tx, entities.apiSession1.Id)

controller/persistence/auth_policy_store.go

@@ -49,41 +49,41 @@ const (
 
 type AuthPolicy struct {
 	boltz.BaseExtEntity
-	Name string
+	Name string `json:"name"`
 
-	Primary   AuthPolicyPrimary
-	Secondary AuthPolicySecondary
+	Primary   AuthPolicyPrimary   `json:"primary"`
+	Secondary AuthPolicySecondary `json:"secondary"`
 }
 
 type AuthPolicyPrimary struct {
-	Cert   AuthPolicyCert
-	Updb   AuthPolicyUpdb
-	ExtJwt AuthPolicyExtJwt
+	Cert   AuthPolicyCert   `json:"cert"`
+	Updb   AuthPolicyUpdb   `json:"updb"`
+	ExtJwt AuthPolicyExtJwt `json:"extJwt"`
 }
 
 type AuthPolicySecondary struct {
-	RequireTotp          bool
-	RequiredExtJwtSigner *string
+	RequireTotp          bool    `json:"requireTotp"`
+	RequiredExtJwtSigner *string `json:"requiredExtJwtSigner"`
 }
 
 type AuthPolicyCert struct {
-	Allowed           bool
-	AllowExpiredCerts bool
+	Allowed           bool `json:"allowed"`
+	AllowExpiredCerts bool `json:"allowExpiredCerts"`
 }
 
 type AuthPolicyExtJwt struct {
-	Allowed              bool
-	AllowedExtJwtSigners []string
+	Allowed              bool     `json:"allowed"`
+	AllowedExtJwtSigners []string `json:"allowedExtJwtSigners"`
 }
 
 type AuthPolicyUpdb struct {
-	Allowed                bool
-	MinPasswordLength      int64
-	RequireSpecialChar     bool
-	RequireNumberChar      bool
-	RequireMixedCase       bool
-	MaxAttempts            int64
-	LockoutDurationMinutes int64
+	Allowed                bool  `json:"allowed"`
+	MinPasswordLength      int64 `json:"minPasswordLength"`
+	RequireSpecialChar     bool  `json:"requireSpecialChar"`
+	RequireNumberChar      bool  `json:"requireNumberChar"`
+	RequireMixedCase       bool  `json:"requireMixedCase"`
+	MaxAttempts            int64 `json:"maxAttempts"`
+	LockoutDurationMinutes int64 `json:"lockoutDurationMinutes"`
 }
 
 func (entity *AuthPolicy) GetName() string {

controller/persistence/authenticator_store.go

@@ -52,12 +52,12 @@ type AuthenticatorSubType interface {
 }
 
 type AuthenticatorCert struct {
-	Authenticator
-	Fingerprint string
-	Pem         string
+	Authenticator `json:"-"`
+	Fingerprint   string `json:"fingerprint"`
+	Pem           string `json:"pem"`
 
-	UnverifiedPem         string
-	UnverifiedFingerprint string
+	UnverifiedPem         string `json:"unverifiedPem"`
+	UnverifiedFingerprint string `json:"unverifiedFingerprint"`
 }
 
 func (entity *AuthenticatorCert) Fingerprints() []string {
@@ -65,10 +65,10 @@ func (entity *AuthenticatorCert) Fingerprints() []string {
 }
 
 type AuthenticatorUpdb struct {
-	Authenticator
-	Username string
-	Password string
-	Salt     string
+	Authenticator `json:"-"`
+	Username      string `json:"username"`
+	Password      string `json:"password"`
+	Salt          string `json:"salt"`
 }
 
 func (entity *AuthenticatorUpdb) Fingerprints() []string {
@@ -77,9 +77,9 @@ func (entity *AuthenticatorUpdb) Fingerprints() []string {
 
 type Authenticator struct {
 	boltz.BaseExtEntity
-	Type       string
-	IdentityId string
-	SubType    AuthenticatorSubType
+	Type       string               `json:"type"`
+	IdentityId string               `json:"identityId"`
+	SubType    AuthenticatorSubType `json:"subType"`
 }
 
 func (entity *Authenticator) GetEntityType() string {

controller/persistence/ca_store.go

@@ -56,26 +56,26 @@ const (
 
 type Ca struct {
 	boltz.BaseExtEntity
-	Name                      string
-	Fingerprint               string
-	CertPem                   string
-	IsVerified                bool
-	VerificationToken         string
-	IsAutoCaEnrollmentEnabled bool
-	IsOttCaEnrollmentEnabled  bool
-	IsAuthEnabled             bool
-	IdentityRoles             []string
-	IdentityNameFormat        string
-	ExternalIdClaim           *ExternalIdClaim
+	Name                      string           `json:"name"`
+	Fingerprint               string           `json:"fingerprint"`
+	CertPem                   string           `json:"certPem"`
+	IsVerified                bool             `json:"isVerified"`
+	VerificationToken         string           `json:"verificationToken"`
+	IsAutoCaEnrollmentEnabled bool             `json:"isAutoCaEnrollmentEnabled"`
+	IsOttCaEnrollmentEnabled  bool             `json:"isOttCaEnrollmentEnabled"`
+	IsAuthEnabled             bool             `json:"isAuthEnabled"`
+	IdentityRoles             []string         `json:"identityRoles"`
+	IdentityNameFormat        string           `json:"identityNameFormat"`
+	ExternalIdClaim           *ExternalIdClaim `json:"externalIdClaim"`
 }
 
 type ExternalIdClaim struct {
-	Location        string
-	Matcher         string
-	MatcherCriteria string
-	Parser          string
-	ParserCriteria  string
-	Index           int64
+	Location        string `json:"location"`
+	Matcher         string `json:"matcher"`
+	MatcherCriteria string `json:"matcherCriteria"`
+	Parser          string `json:"parser"`
+	ParserCriteria  string `json:"parserCriteria"`
+	Index           int64  `json:"index"`
 }
 
 func (entity *Ca) GetName() string {

controller/persistence/config_store.go

@@ -42,9 +42,9 @@ func newConfig(name string, configType string, data map[string]interface{}) *Con
 
 type Config struct {
 	boltz.BaseExtEntity
-	Name string
-	Type string
-	Data map[string]interface{}
+	Name string                 `json:"name"`
+	Type string                 `json:"type"`
+	Data map[string]interface{} `json:"data"`
 }
 
 func (entity *Config) GetName() string {

controller/persistence/config_type_store.go

@@ -38,8 +38,8 @@ func newConfigType(name string) *ConfigType {
 
 type ConfigType struct {
 	boltz.BaseExtEntity
-	Name   string
-	Schema map[string]interface{}
+	Name   string                 `json:"name"`
+	Schema map[string]interface{} `json:"schema"`
 }
 
 func (entity *ConfigType) GetName() string {

controller/persistence/edge_router_policy_store.go

@@ -21,10 +21,10 @@ func newEdgeRouterPolicy(name string) *EdgeRouterPolicy {
 
 type EdgeRouterPolicy struct {
 	boltz.BaseExtEntity
-	Name            string
-	Semantic        string
-	IdentityRoles   []string
-	EdgeRouterRoles []string
+	Name            string   `json:"name"`
+	Semantic        string   `json:"semantic"`
+	IdentityRoles   []string `json:"identityRoles"`
+	EdgeRouterRoles []string `json:"edgeRouterRoles"`
 }
 
 func (entity *EdgeRouterPolicy) GetName() string {

controller/persistence/edge_router_store.go

@@ -49,13 +49,13 @@ func newEdgeRouter(name string, roleAttributes ...string) *EdgeRouter {
 
 type EdgeRouter struct {
 	db.Router
-	IsVerified            bool
-	CertPem               *string
-	UnverifiedCertPem     *string
-	UnverifiedFingerprint *string
-	RoleAttributes        []string
-	IsTunnelerEnabled     bool
-	AppData               map[string]interface{}
+	IsVerified            bool                   `json:"isVerified"`
+	CertPem               *string                `json:"certPem"`
+	UnverifiedCertPem     *string                `json:"unverifiedCertPem"`
+	UnverifiedFingerprint *string                `json:"unverifiedFingerprint"`
+	RoleAttributes        []string               `json:"roleAttributes"`
+	IsTunnelerEnabled     bool                   `json:"isTunnelerEnabled"`
+	AppData               map[string]interface{} `json:"appData"`
 }
 
 func (entity *EdgeRouter) GetName() string {

controller/persistence/edge_service_store.go

@@ -33,9 +33,9 @@ const (
 
 type EdgeService struct {
 	db.Service
-	RoleAttributes     []string
-	Configs            []string
-	EncryptionRequired bool
+	RoleAttributes     []string `json:"roleAttributes"`
+	Configs            []string `json:"configs"`
+	EncryptionRequired bool     `json:"encryptionRequired"`
 }
 
 func newEdgeService(name string, roleAttributes ...string) *EdgeService {

controller/persistence/edge_service_store_test.go

@@ -215,7 +215,7 @@ func (ctx *TestContext) testUpdateServices(_ *testing.T) {
 	earlier := time.Now()
 	time.Sleep(time.Millisecond * 50)
 
-	mutateCtx := change.New().SetSource("test").NewMutateContext()
+	mutateCtx := change.New().NewMutateContext()
 	err := ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		tx := mutateCtx.Tx()
 		original, err := ctx.stores.EdgeService.LoadOneById(tx, entities.service1.Id)

controller/persistence/enrollment_store.go

@@ -43,16 +43,16 @@ const (
 
 type Enrollment struct {
 	boltz.BaseExtEntity
-	Token           string
-	Method          string
-	IdentityId      *string
-	TransitRouterId *string
-	EdgeRouterId    *string
-	ExpiresAt       *time.Time
-	IssuedAt        *time.Time
-	CaId            *string
-	Username        *string
-	Jwt             string
+	Token           string     `json:"token"`
+	Method          string     `json:"method"`
+	IdentityId      *string    `json:"identityId"`
+	TransitRouterId *string    `json:"transitRouterId"`
+	EdgeRouterId    *string    `json:"edgeRouterId"`
+	ExpiresAt       *time.Time `json:"expiresAt"`
+	IssuedAt        *time.Time `json:"issuedAt"`
+	CaId            *string    `json:"caId"`
+	Username        *string    `json:"username"`
+	Jwt             string     `json:"jwt"`
 }
 
 func (entity *Enrollment) GetEntityType() string {

controller/persistence/eventual_event_store.go

@@ -28,8 +28,8 @@ const (
 
 type EventualEvent struct {
 	boltz.BaseExtEntity
-	Type string
-	Data []byte
+	Type string `json:"type"`
+	Data []byte `json:"data"`
 }
 
 func (entity *EventualEvent) GetEntityType() string {

controller/persistence/eventual_eventer.go

@@ -348,7 +348,7 @@ func (a *EventualEventerBbolt) AddEventualEventWithCtx(ctx boltz.MutateContext,
 
 	var err error
 	if ctx == nil {
-		ctx = change.New().SetSource("eventual.eventer").SetChangeAuthorType("controller").NewMutateContext()
+		ctx = change.New().SetSourceType("eventual.eventer").SetChangeAuthorType(change.AuthorTypeController).NewMutateContext()
 		err = a.dbProvider.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 			return a.store.Create(ctx, event)
 		})
@@ -438,7 +438,7 @@ func (a *EventualEventerBbolt) Trigger() (<-chan struct{}, error) {
 
 // deleteEventualEvent removes an eventual event by id from the bbolt backend store.
 func (a *EventualEventerBbolt) deleteEventualEvent(id string) error {
-	ctx := change.New().SetSource("eventual.eventer").SetChangeAuthorType("controller").NewMutateContext()
+	ctx := change.New().SetSourceType("eventual.eventer").SetChangeAuthorType(change.AuthorTypeController).NewMutateContext()
 	err := a.dbProvider.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		return a.store.DeleteById(ctx, id)
 	})

controller/persistence/external_jwt_signer_store.go

@@ -47,20 +47,20 @@ const (
 
 type ExternalJwtSigner struct {
 	boltz.BaseExtEntity
-	Name            string
-	Fingerprint     *string
-	Kid             *string
-	CertPem         *string
-	JwksEndpoint    *string
-	CommonName      string
-	NotAfter        *time.Time
-	NotBefore       *time.Time
-	Enabled         bool
-	ExternalAuthUrl *string
-	ClaimsProperty  *string
-	UseExternalId   bool
-	Issuer          *string
-	Audience        *string
+	Name            string     `json:"name"`
+	Fingerprint     *string    `json:"fingerprint"`
+	Kid             *string    `json:"kid"`
+	CertPem         *string    `json:"certPem"`
+	JwksEndpoint    *string    `json:"jwksEndpoint"`
+	CommonName      string     `json:"commonName"`
+	NotAfter        *time.Time `json:"notAfter"`
+	NotBefore       *time.Time `json:"notBefore"`
+	Enabled         bool       `json:"enabled"`
+	ExternalAuthUrl *string    `json:"externalAuthUrl"`
+	ClaimsProperty  *string    `json:"claimsProperty"`
+	UseExternalId   bool       `json:"useExternalId"`
+	Issuer          *string    `json:"issuer"`
+	Audience        *string    `json:"audience"`
 }
 
 func (entity *ExternalJwtSigner) GetName() string {

controller/persistence/identity_store.go

@@ -72,42 +72,42 @@ func newIdentity(name string, identityTypeId string, roleAttributes ...string) *
 }
 
 type EnvInfo struct {
-	Arch      string
-	Os        string
-	OsRelease string
-	OsVersion string
+	Arch      string `json:"arch"`
+	Os        string `json:"os"`
+	OsRelease string `json:"osRelease"`
+	OsVersion string `json:"osVersion"`
 }
 
 type SdkInfo struct {
-	Branch     string
-	Revision   string
-	Type       string
-	Version    string
-	AppId      string
-	AppVersion string
+	Branch     string `json:"branch"`
+	Revision   string `json:"revision"`
+	Type       string `json:"type"`
+	Version    string `json:"version"`
+	AppId      string `json:"appId"`
+	AppVersion string `json:"appVersion"`
 }
 
 type Identity struct {
 	boltz.BaseExtEntity
-	Name                      string
-	IdentityTypeId            string
-	IsDefaultAdmin            bool
-	IsAdmin                   bool
-	Enrollments               []string
-	Authenticators            []string
-	RoleAttributes            []string
-	SdkInfo                   *SdkInfo
-	EnvInfo                   *EnvInfo
-	DefaultHostingPrecedence  ziti.Precedence
-	DefaultHostingCost        uint16
-	ServiceHostingPrecedences map[string]ziti.Precedence
-	ServiceHostingCosts       map[string]uint16
-	AppData                   map[string]interface{}
-	AuthPolicyId              string
-	ExternalId                *string
-	DisabledAt                *time.Time
-	DisabledUntil             *time.Time
-	Disabled                  bool
+	Name                      string                     `json:"name"`
+	IdentityTypeId            string                     `json:"identityTypeId"`
+	IsDefaultAdmin            bool                       `json:"isDefaultAdmin"`
+	IsAdmin                   bool                       `json:"isAdmin"`
+	Enrollments               []string                   `json:"enrollments"`
+	Authenticators            []string                   `json:"authenticators"`
+	RoleAttributes            []string                   `json:"roleAttributes"`
+	SdkInfo                   *SdkInfo                   `json:"sdkInfo"`
+	EnvInfo                   *EnvInfo                   `json:"envInfo"`
+	DefaultHostingPrecedence  ziti.Precedence            `json:"defaultHostingPrecedence"`
+	DefaultHostingCost        uint16                     `json:"defaultHostingCost"`
+	ServiceHostingPrecedences map[string]ziti.Precedence `json:"serviceHostingPrecedences"`
+	ServiceHostingCosts       map[string]uint16          `json:"serviceHostingCosts"`
+	AppData                   map[string]interface{}     `json:"appData"`
+	AuthPolicyId              string                     `json:"authPolicyId"`
+	ExternalId                *string                    `json:"externalId"`
+	DisabledAt                *time.Time                 `json:"disabledAt"`
+	DisabledUntil             *time.Time                 `json:"disabledUntil"`
+	Disabled                  bool                       `json:"disabled"`
 }
 
 func (entity *Identity) GetEntityType() string {

controller/persistence/identity_store_test.go

@@ -55,7 +55,7 @@ func (ctx *TestContext) testIdentityServiceConfigs(_ *testing.T) {
 	})
 	boltztest.RequireCreate(ctx, config3)
 
-	mutateCtx := change.New().SetSource("test").NewMutateContext()
+	mutateCtx := change.New().NewMutateContext()
 	err = ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		err := ctx.stores.Identity.AssignServiceConfigs(mutateCtx.Tx(), identity.Id,
 			ServiceConfig{ServiceId: service.Id, ConfigId: config.Id},
@@ -65,7 +65,7 @@ func (ctx *TestContext) testIdentityServiceConfigs(_ *testing.T) {
 	})
 	ctx.NoError(err)
 
-	mutateCtx = change.New().SetSource("test").NewMutateContext()
+	mutateCtx = change.New().NewMutateContext()
 	err = ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		tx := mutateCtx.Tx()
 		err := ctx.stores.Identity.AssignServiceConfigs(tx, identity.Id, ServiceConfig{ServiceId: service.Id, ConfigId: config.Id})
@@ -88,7 +88,7 @@ func (ctx *TestContext) testIdentityServiceConfigs(_ *testing.T) {
 	})
 	ctx.NoError(err)
 
-	mutateCtx = change.New().SetSource("test").NewMutateContext()
+	mutateCtx = change.New().NewMutateContext()
 	err = ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		tx := mutateCtx.Tx()
 		err := ctx.stores.Identity.RemoveServiceConfigs(tx, identity.Id, ServiceConfig{ServiceId: service.Id, ConfigId: config.Id})
@@ -113,7 +113,7 @@ func (ctx *TestContext) testIdentityServiceConfigs(_ *testing.T) {
 
 	boltztest.RequireCreate(ctx, config)
 
-	mutateCtx = change.New().SetSource("test").NewMutateContext()
+	mutateCtx = change.New().NewMutateContext()
 	err = ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		tx := mutateCtx.Tx()
 		err := ctx.stores.Identity.AssignServiceConfigs(tx, identity.Id,

controller/persistence/identity_type_store.go

@@ -26,7 +26,7 @@ const (
 
 type IdentityType struct {
 	boltz.BaseExtEntity
-	Name string
+	Name string `json:"name"`
 }
 
 func (entity *IdentityType) GetName() string {

controller/persistence/mfa_store.go

@@ -32,11 +32,11 @@ const (
 
 type Mfa struct {
 	boltz.BaseExtEntity
-	IdentityId    string
-	IsVerified    bool
-	Secret        string
-	Salt          string
-	RecoveryCodes []string
+	IdentityId    string   `json:"identityId"`
+	IsVerified    bool     `json:"isVerified"`
+	Secret        string   `json:"secret"`
+	Salt          string   `json:"salt"`
+	RecoveryCodes []string `json:"recoveryCodes"`
 }
 
 func NewMfa(identityId string) *Mfa {

controller/persistence/policy_common.go

@@ -118,7 +118,7 @@ func (store *baseStore[E]) updateServicePolicyRelatedRoles(ctx *roleAttributeCha
 		}
 		policyType := PolicyTypeDial
 		if fieldType, policyTypeValue := policyTypeSymbol.Eval(ctx.tx, policyId); fieldType == boltz.TypeInt32 {
-			policyType = PolicyType(*boltz.BytesToInt32(policyTypeValue))
+			policyType = GetPolicyTypeForId(*boltz.BytesToInt32(policyTypeValue))
 		}
 		if policyType == PolicyTypeDial {
 			if isServices {

controller/persistence/posture_check_mac.go

@@ -33,7 +33,7 @@ func newPostureCheckMacAddresses() PostureCheckSubType {
 }
 
 type PostureCheckMacAddresses struct {
-	MacAddresses []string
+	MacAddresses []string `json:"macAddresses"`
 }
 
 func (entity *PostureCheckMacAddresses) LoadValues(bucket *boltz.TypedBucket) {

controller/persistence/posture_check_mfa.go

@@ -28,10 +28,10 @@ const (
 )
 
 type PostureCheckMfa struct {
-	TimeoutSeconds        int64
-	PromptOnWake          bool
-	PromptOnUnlock        bool
-	IgnoreLegacyEndpoints bool
+	TimeoutSeconds        int64 `json:"timeoutSeconds"`
+	PromptOnWake          bool  `json:"promptOnWake"`
+	PromptOnUnlock        bool  `json:"promptOnUnlock"`
+	IgnoreLegacyEndpoints bool  `json:"ignoreLegacyEndpoints"`
 }
 
 func newPostureCheckMfa() PostureCheckSubType {

controller/persistence/posture_check_os.go

@@ -27,12 +27,12 @@ const (
 )
 
 type PostureCheckOperatingSystem struct {
-	OperatingSystems []OperatingSystem
+	OperatingSystems []OperatingSystem `json:"operatingSystems"`
 }
 
 type OperatingSystem struct {
-	OsType     string
-	OsVersions []string
+	OsType     string   `json:"osType"`
+	OsVersions []string `json:"osVersions"`
 }
 
 func newPostureCheckOperatingSystem() PostureCheckSubType {

controller/persistence/posture_check_process.go

@@ -29,10 +29,10 @@ const (
 )
 
 type PostureCheckProcess struct {
-	OperatingSystem string
-	Path            string
-	Hashes          []string
-	Fingerprint     string
+	OperatingSystem string   `json:"operatingSystem"`
+	Path            string   `json:"path"`
+	Hashes          []string `json:"hashes"`
+	Fingerprint     string   `json:"fingerprint"`
 }
 
 func newPostureCheckProcess() PostureCheckSubType {

controller/persistence/posture_check_process_multi.go

@@ -30,15 +30,15 @@ const (
 )
 
 type PostureCheckProcessMulti struct {
-	Semantic  string
-	Processes []*ProcessMulti
+	Semantic  string          `json:"semantic"`
+	Processes []*ProcessMulti `json:"processes"`
 }
 
 type ProcessMulti struct {
-	OsType             string
-	Path               string
-	Hashes             []string
-	SignerFingerprints []string
+	OsType             string   `json:"osType"`
+	Path               string   `json:"path"`
+	Hashes             []string `json:"hashes"`
+	SignerFingerprints []string `json:"signerFingerprints"`
 }
 
 func newPostureCheckProcessMulti() PostureCheckSubType {

controller/persistence/posture_check_store.go

@@ -66,11 +66,11 @@ func newPostureCheck(typeId string) PostureCheckSubType {
 
 type PostureCheck struct {
 	boltz.BaseExtEntity
-	Name           string
-	TypeId         string
-	Version        int64
-	RoleAttributes []string
-	SubType        PostureCheckSubType
+	Name           string              `json:"name"`
+	TypeId         string              `json:"typeId"`
+	Version        int64               `json:"version"`
+	RoleAttributes []string            `json:"roleAttributes"`
+	SubType        PostureCheckSubType `json:"subType"`
 }
 
 func (entity *PostureCheck) GetName() string {

controller/persistence/posture_check_type_store.go

@@ -26,8 +26,8 @@ const (
 
 type PostureCheckType struct {
 	boltz.BaseExtEntity
-	Name             string
-	OperatingSystems []OperatingSystem
+	Name             string            `json:"name"`
+	OperatingSystems []OperatingSystem `json:"operatingSystems"`
 }
 
 func (entity *PostureCheckType) GetName() string {

controller/persistence/posture_check_windows_domain.go

@@ -25,7 +25,7 @@ const (
 )
 
 type PostureCheckWindowsDomains struct {
-	Domains []string
+	Domains []string `json:"domains"`
 }
 
 func newPostureCheckWindowsDomain() PostureCheckSubType {

controller/persistence/service_edge_router_policy_store.go

@@ -21,10 +21,10 @@ func newServiceEdgeRouterPolicy(name string) *ServiceEdgeRouterPolicy {
 
 type ServiceEdgeRouterPolicy struct {
 	boltz.BaseExtEntity
-	Name            string
-	Semantic        string
-	ServiceRoles    []string
-	EdgeRouterRoles []string
+	Name            string   `json:"name"`
+	Semantic        string   `json:"semantic"`
+	ServiceRoles    []string `json:"serviceRoles"`
+	EdgeRouterRoles []string `json:"edgeRouterRoles"`
 }
 
 func (entity *ServiceEdgeRouterPolicy) GetName() string {

controller/persistence/service_policy_store.go

@@ -2,28 +2,38 @@ package persistence
 
 import (
 	"fmt"
-	"github.com/openziti/edge/eid"
 	"github.com/openziti/fabric/controller/db"
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/foundation/v2/stringz"
 	"github.com/openziti/storage/ast"
 	"github.com/openziti/storage/boltz"
-	"math/rand"
 	"sort"
 )
 
-type PolicyType int32
+type PolicyType string
 
 func (self PolicyType) String() string {
+	return string(self)
+}
+
+func (self PolicyType) Id() int32 {
 	if self == PolicyTypeDial {
-		return PolicyTypeDialName
+		return 1
 	}
-
 	if self == PolicyTypeBind {
-		return PolicyTypeBindName
+		return 2
 	}
+	return 0
+}
 
-	return PolicyTypeInvalidName
+func GetPolicyTypeForId(policyTypeId int32) PolicyType {
+	policyType := PolicyTypeInvalid
+	if policyTypeId == PolicyTypeDial.Id() {
+		policyType = PolicyTypeDial
+	} else if policyTypeId == PolicyTypeBind.Id() {
+		policyType = PolicyTypeBind
+	}
+	return policyType
 }
 
 const (
@@ -33,33 +43,19 @@ const (
 	PolicyTypeDialName    = "Dial"
 	PolicyTypeBindName    = "Bind"
 
-	PolicyTypeInvalid PolicyType = 0
-	PolicyTypeDial    PolicyType = 1
-	PolicyTypeBind    PolicyType = 2
+	PolicyTypeInvalid PolicyType = PolicyTypeInvalidName
+	PolicyTypeDial    PolicyType = PolicyTypeDialName
+	PolicyTypeBind    PolicyType = PolicyTypeBindName
 )
 
-func newServicePolicy(name string) *ServicePolicy {
-	policyType := PolicyTypeDial
-	/* #nosec */
-	if rand.Int()%2 == 0 {
-		policyType = PolicyTypeBind
-	}
-	return &ServicePolicy{
-		BaseExtEntity: boltz.BaseExtEntity{Id: eid.New()},
-		Name:          name,
-		PolicyType:    policyType,
-		Semantic:      SemanticAllOf,
-	}
-}
-
 type ServicePolicy struct {
 	boltz.BaseExtEntity
-	PolicyType        PolicyType
-	Name              string
-	Semantic          string
-	IdentityRoles     []string
-	ServiceRoles      []string
-	PostureCheckRoles []string
+	PolicyType        PolicyType `json:"policyType"`
+	Name              string     `json:"name"`
+	Semantic          string     `json:"semantic"`
+	IdentityRoles     []string   `json:"identityRoles"`
+	ServiceRoles      []string   `json:"serviceRoles"`
+	PostureCheckRoles []string   `json:"postureCheckRoles"`
 }
 
 func (entity *ServicePolicy) GetName() string {
@@ -74,10 +70,6 @@ func (entity *ServicePolicy) GetEntityType() string {
 	return EntityTypeServicePolicies
 }
 
-func (entity *ServicePolicy) GetPolicyTypeName() string {
-	return entity.PolicyType.String()
-}
-
 var _ ServicePolicyStore = (*servicePolicyStoreImpl)(nil)
 
 type ServicePolicyStore interface {
@@ -145,7 +137,7 @@ func (store *servicePolicyStoreImpl) initializeLinked() {
 func (store *servicePolicyStoreImpl) FillEntity(entity *ServicePolicy, bucket *boltz.TypedBucket) {
 	entity.LoadBaseValues(bucket)
 	entity.Name = bucket.GetStringOrError(FieldName)
-	entity.PolicyType = PolicyType(bucket.GetInt32WithDefault(FieldServicePolicyType, int32(PolicyTypeDial)))
+	entity.PolicyType = GetPolicyTypeForId(bucket.GetInt32WithDefault(FieldServicePolicyType, PolicyTypeDial.Id()))
 	entity.Semantic = bucket.GetStringWithDefault(FieldSemantic, SemanticAllOf)
 	entity.IdentityRoles = bucket.GetStringList(FieldIdentityRoles)
 	entity.ServiceRoles = bucket.GetStringList(FieldServiceRoles)
@@ -161,7 +153,7 @@ func (store *servicePolicyStoreImpl) PersistEntity(entity *ServicePolicy, ctx *b
 	} else {
 		// PolicyType needs to be correct in the entity as we use it later
 		// TODO: Add test for this
-		entity.PolicyType = PolicyType(ctx.Bucket.GetInt32WithDefault(FieldServicePolicyType, int32(PolicyTypeDial)))
+		entity.PolicyType = GetPolicyTypeForId(ctx.Bucket.GetInt32WithDefault(FieldServicePolicyType, PolicyTypeDial.Id()))
 	}
 
 	if err := validateRolesAndIds(FieldIdentityRoles, entity.IdentityRoles); err != nil {
@@ -183,7 +175,7 @@ func (store *servicePolicyStoreImpl) PersistEntity(entity *ServicePolicy, ctx *b
 
 	entity.SetBaseValues(ctx)
 	ctx.SetRequiredString(FieldName, entity.Name)
-	ctx.SetInt32(FieldServicePolicyType, int32(entity.PolicyType))
+	ctx.SetInt32(FieldServicePolicyType, entity.PolicyType.Id())
 	ctx.SetRequiredString(FieldSemantic, entity.Semantic)
 	servicePolicyStore := ctx.Store.(*servicePolicyStoreImpl)
 
@@ -313,7 +305,7 @@ func (store *servicePolicyStoreImpl) CheckIntegrity(mutateCtx boltz.MutateContex
 		policyFilter: func(policyId []byte) bool {
 			policyType := PolicyTypeInvalid
 			if result := boltz.FieldToInt32(store.symbolPolicyType.Eval(mutateCtx.Tx(), policyId)); result != nil {
-				policyType = PolicyType(*result)
+				policyType = GetPolicyTypeForId(*result)
 			}
 			return policyType == PolicyTypeBind
 		},
@@ -336,7 +328,7 @@ func (store *servicePolicyStoreImpl) CheckIntegrity(mutateCtx boltz.MutateContex
 		policyFilter: func(policyId []byte) bool {
 			policyType := PolicyTypeInvalid
 			if result := boltz.FieldToInt32(store.symbolPolicyType.Eval(mutateCtx.Tx(), policyId)); result != nil {
-				policyType = PolicyType(*result)
+				policyType = GetPolicyTypeForId(*result)
 			}
 			return policyType == PolicyTypeDial
 		},

controller/persistence/service_policy_store_test.go

@@ -6,8 +6,10 @@ import (
 	"github.com/openziti/fabric/controller/db"
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/foundation/v2/stringz"
+	"github.com/openziti/storage/boltz"
 	"github.com/openziti/storage/boltztest"
 	"go.etcd.io/bbolt"
+	"math/rand"
 	"sort"
 	"testing"
 )
@@ -23,6 +25,20 @@ func Test_ServicePolicyStore(t *testing.T) {
 	t.Run("test update/delete referenced entities", ctx.testServicePolicyUpdateDeleteRefs)
 }
 
+func newServicePolicy(name string) *ServicePolicy {
+	policyType := PolicyTypeDial
+	/* #nosec */
+	if rand.Int()%2 == 0 {
+		policyType = PolicyTypeBind
+	}
+	return &ServicePolicy{
+		BaseExtEntity: boltz.BaseExtEntity{Id: eid.New()},
+		Name:          name,
+		PolicyType:    policyType,
+		Semantic:      SemanticAllOf,
+	}
+}
+
 func (ctx *TestContext) testCreateServicePolicy(_ *testing.T) {
 	ctx.CleanupAll()
 

controller/persistence/session_store.go

@@ -42,13 +42,13 @@ var validSessionTypes = []string{SessionTypeDial, SessionTypeBind}
 
 type Session struct {
 	boltz.BaseExtEntity
-	Token           string
-	IdentityId      string
-	ApiSessionId    string
-	ServiceId       string
-	Type            string
-	ApiSession      *ApiSession
-	ServicePolicies []string
+	Token           string      `json:"token"`
+	IdentityId      string      `json:"identityId"`
+	ApiSessionId    string      `json:"apiSessionId"`
+	ServiceId       string      `json:"serviceId"`
+	Type            string      `json:"type"`
+	ApiSession      *ApiSession `json:"-"`
+	ServicePolicies []string    `json:"servicePolicies"`
 }
 
 func (entity *Session) GetEntityType() string {

controller/persistence/session_store_test.go

@@ -234,7 +234,7 @@ func (ctx *TestContext) testUpdateSessions(_ *testing.T) {
 	earlier := time.Now()
 	time.Sleep(time.Millisecond * 50)
 
-	mutateCtx := change.New().SetSource("test").NewMutateContext()
+	mutateCtx := change.New().NewMutateContext()
 	err := ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
 		tx := mutateCtx.Tx()
 		original, err := ctx.stores.Session.LoadOneById(tx, entities.session1.Id)

controller/persistence/stores.go

@@ -133,6 +133,14 @@ func (stores *Stores) GetStoreForEntity(entity boltz.Entity) boltz.Store {
 	return stores.storeMap[reflect.TypeOf(entity)]
 }
 
+func (stores *Stores) GetStores() []boltz.Store {
+	var result []boltz.Store
+	for _, store := range stores.storeMap {
+		result = append(result, store)
+	}
+	return result
+}
+
 type stores struct {
 	DbProvider      DbProvider
 	EventualEventer EventualEventer
@@ -255,7 +263,7 @@ func NewBoltStores(dbProvider DbProvider) (*Stores, error) {
 	externalStores.buildStoreMap()
 	storeList := externalStores.getStoresForInit()
 
-	mutateCtx := change.New().SetSource("system.initialization").SetChangeAuthorType("controller").NewMutateContext()
+	mutateCtx := change.New().SetSourceType("system.initialization").SetChangeAuthorType(change.AuthorTypeController).NewMutateContext()
 	err := dbProvider.GetDb().Update(mutateCtx, func(ctx boltz.MutateContext) error {
 		for _, store := range storeList {
 			store.initializeLocal()

controller/persistence/testing.go

@@ -134,7 +134,7 @@ func NewTestContext(t *testing.T) *TestContext {
 }
 
 func (ctx *TestContext) newViewTestCtx(tx *bbolt.Tx) boltz.MutateContext {
-	return boltz.NewTxMutateContext(change.New().SetSource("test").GetContext(), tx)
+	return boltz.NewTxMutateContext(change.New().SetChangeAuthorType("test").GetContext(), tx)
 }
 
 func (ctx *TestContext) GetNetwork() *network.Network {
@@ -248,8 +248,7 @@ func (ctx *TestContext) CleanupAll() {
 		ctx.stores.ServiceEdgeRouterPolicy,
 	}
 
-	mutateCtx := change.New().SetSource("test.cleanup").NewMutateContext()
-	_ = ctx.GetDb().Update(mutateCtx, func(mutateCtx boltz.MutateContext) error {
+	_ = ctx.GetDb().Update(change.New().NewMutateContext(), func(mutateCtx boltz.MutateContext) error {
 		for _, store := range stores {
 			if err := store.DeleteWhere(mutateCtx, `true limit none`); err != nil {
 				pfxlog.Logger().WithError(err).Errorf("failure while cleaning up %v", store.GetEntityType())

controller/persistence/transit_router_store.go

@@ -30,11 +30,11 @@ const (
 
 type TransitRouter struct {
 	db.Router
-	IsVerified            bool
-	Enrollments           []string
-	IsBase                bool
-	UnverifiedCertPem     *string
-	UnverifiedFingerprint *string
+	IsVerified            bool     `json:"isVerified"`
+	Enrollments           []string `json:"enrollments"`
+	IsBase                bool     `json:"-"`
+	UnverifiedCertPem     *string  `json:"unverifiedCertPem"`
+	UnverifiedFingerprint *string  `json:"unverifiedFingerprint"`
 }
 
 func (entity *TransitRouter) GetName() string {

controller/response/context.go

@@ -18,7 +18,6 @@ package response
 
 import (
 	"errors"
-	"fmt"
 	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/fabric/controller/change"
 	"net/http"
@@ -96,11 +95,18 @@ func (rc *RequestContext) GetEntitySubId() (string, error) {
 }
 
 func (rc *RequestContext) NewChangeContext() *change.Context {
-	src := fmt.Sprintf("rest[auth=edge/host=%v/method=%v/remote=%v]", rc.GetRequest().Host, rc.GetRequest().Method, rc.GetRequest().RemoteAddr)
-	changeCtx := change.New().SetSource(src)
+	changeCtx := change.New().SetSourceType(change.SourceTypeRest).
+		SetSourceAuth("edge").
+		SetSourceMethod(rc.GetRequest().Method).
+		SetSourceLocal(rc.GetRequest().Host).
+		SetSourceRemote(rc.GetRequest().RemoteAddr)
 
 	if rc.Identity != nil {
-		changeCtx.SetChangeAuthorId(rc.Identity.Id).SetChangeAuthorName(rc.Identity.Name)
+		changeCtx.SetChangeAuthorType(change.AuthorTypeIdentity).
+			SetChangeAuthorId(rc.Identity.Id).
+			SetChangeAuthorName(rc.Identity.Name)
+	} else {
+		changeCtx.SetChangeAuthorType(change.AuthorTypeUnattributed)
 	}
 
 	if rc.Request.Form.Has("traceId") {

events/dispatcher.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/fabric/event"
 	"github.com/openziti/fabric/events"
 	"github.com/openziti/foundation/v2/concurrenz"
+	"github.com/openziti/storage/boltz"
 	"io"
 )
 
@@ -71,4 +72,15 @@ func (self *Dispatcher) InitializeEvents() {
 	self.initSessionEvents(self.stores)
 	self.initEntityEvents()
 
+	fabricStores := map[boltz.Store]struct{}{}
+
+	for _, store := range self.network.GetStores().GetStoreList() {
+		fabricStores[store] = struct{}{}
+	}
+
+	for _, store := range self.stores.GetStores() {
+		if _, found := fabricStores[store]; !found {
+			self.fabricDispatcher.AddEntityChangeSource(store)
+		}
+	}
 }

go.mod

@@ -30,7 +30,7 @@ require (
 	github.com/netfoundry/secretstream v0.1.5
 	github.com/openziti/channel/v2 v2.0.62
 	github.com/openziti/edge-api v0.25.11
-	github.com/openziti/fabric v0.23.0
+	github.com/openziti/fabric v0.23.1
 	github.com/openziti/foundation/v2 v2.0.21
 	github.com/openziti/identity v1.0.47
 	github.com/openziti/jwks v1.0.3

go.sum

@@ -457,8 +457,8 @@ github.com/openziti/channel/v2 v2.0.62 h1:WmNYAugoyQ2HFu2VEhOH4WExzXsX6+dzSQDzNf
 github.com/openziti/channel/v2 v2.0.62/go.mod h1:TS2FJs1GuCZXUfSFfptrNWKeTuQRO7YJ9K7C2jWMznA=
 github.com/openziti/edge-api v0.25.11 h1:HHjDgoybPZGRZ+tM2udehI+U5Xv991iGED8E6CtDb9w=
 github.com/openziti/edge-api v0.25.11/go.mod h1:PBFMYELgr7JUuaCqHobq1U+WESsutzgEDoELU/9qFOg=
-github.com/openziti/fabric v0.23.0 h1:JXaHBb31+4hEsv04IUNxs11+s3nupQtzckR+cEIySuE=
-github.com/openziti/fabric v0.23.0/go.mod h1:p5EI0s0LvNi6HipLR+PWDon89C3dhfyX/jac/3cwmpA=
+github.com/openziti/fabric v0.23.1 h1:9RFRmApJ9EGUNNwIP4OSZcgFmiBdVLTvLfYsYRID8ws=
+github.com/openziti/fabric v0.23.1/go.mod h1:p5EI0s0LvNi6HipLR+PWDon89C3dhfyX/jac/3cwmpA=
 github.com/openziti/foundation/v2 v2.0.21 h1:3EDDmSunsbd2DlULuY/vqj12LHRZOknH/m3lf6Ws5Nw=
 github.com/openziti/foundation/v2 v2.0.21/go.mod h1:02GW3jFSSlfLwYwuTIldP/S4w7eCKqlzL6ajFSGHNPA=
 github.com/openziti/identity v1.0.47 h1:Zc1wL4yMq6hcmbgNR6d3gSkGCiK3IJYd9i4obBNBMPw=

tests/auth_cert_test.go

@@ -97,7 +97,7 @@ func (test *authCertTests) testAuthenticateCertStoresAndFillsFullCert(t *testing
 
 		certAuth.Pem = ""
 
-		err = test.ctx.EdgeController.AppEnv.Managers.Authenticator.Update(authenticator, false, nil, change.New().SetSource("test"))
+		err = test.ctx.EdgeController.AppEnv.Managers.Authenticator.Update(authenticator, false, nil, change.New())
 		r.NoError(err)
 
 		authenticator, err = test.ctx.EdgeController.AppEnv.Managers.Authenticator.ReadByFingerprint(test.certAuthenticator.Fingerprint())

tests/enrollment_router_test.go

@@ -1,5 +1,4 @@
 //go:build apitests
-// +build apitests
 
 /*
 	Copyright NetFoundry Inc.
@@ -502,6 +501,7 @@ func Test_RouterEnrollment(t *testing.T) {
 						_, _ = extensionBodyContainer.Set(extensionServerCsrPem, "serverCertCsr")
 						_, _ = extensionBodyContainer.Set(extensionClientCsrPem, "certCsr")
 
+						time.Sleep(time.Second) // make sure the new certs will have different times
 						resp, err := ctx.newRequestWithClientCert(cert, privateKey).SetBody(extensionBodyContainer.String()).Post("/enroll/extend/router")
 						ctx.Req.NoError(err)
 
@@ -524,22 +524,24 @@ func Test_RouterEnrollment(t *testing.T) {
 
 						t.Run("the new client cert has its NotAfter date increased", func(t *testing.T) {
 							ctx.testContextChanged(t)
-							extensionClientCerts[0].NotAfter.After(cert.NotAfter)
+							ctx.Req.NotEqual(extensionClientCerts[0].NotAfter, cert.NotAfter)
+							ctx.Req.True(extensionClientCerts[0].NotAfter.After(cert.NotAfter))
 						})
 
 						t.Run("the new client cert has its NotBefore date before now", func(t *testing.T) {
 							ctx.testContextChanged(t)
-							extensionClientCerts[0].NotBefore.Before(time.Now())
+							ctx.Req.True(extensionClientCerts[0].NotBefore.Before(time.Now()))
 						})
 
 						t.Run("the new server cert has its NotAfter date increased", func(t *testing.T) {
 							ctx.testContextChanged(t)
-							extensionServerCert[0].NotAfter.After(serverCerts[0].NotAfter)
+							ctx.Req.NotEqual(extensionServerCert[0].NotAfter, serverCerts[0].NotAfter)
+							ctx.Req.True(extensionServerCert[0].NotAfter.After(serverCerts[0].NotAfter))
 						})
 
 						t.Run("the new server cert has its NotBefore date before now", func(t *testing.T) {
 							ctx.testContextChanged(t)
-							extensionServerCert[0].NotBefore.Before(time.Now())
+							ctx.Req.True(extensionServerCert[0].NotBefore.Before(time.Now()))
 						})
 
 						t.Run("connecting to the control channel with the old client cert fails", func(t *testing.T) {

tests/transit_router_test.go

@@ -116,7 +116,7 @@ func Test_TransitRouters(t *testing.T) {
 			Name:        "uMvqq",
 			Fingerprint: &fp,
 		}
-		err := ctx.fabricController.GetNetwork().Routers.Create(fabTxRouter, change.New().SetSource("test"))
+		err := ctx.fabricController.GetNetwork().Routers.Create(fabTxRouter, change.New())
 		ctx.Req.NoError(err, "could not create router at fabric level")
 
 		body := ctx.AdminManagementSession.requireQuery("transit-routers")