Merge pull request #1429 from openziti/storage-refactor

storage refactor

.github/workflows/main.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v3
         with:
-          go-version: '1.19.x'
+          go-version: '1.20.x'
 
       - name: Install Ziti CI
         uses: netfoundry/ziti-ci@v1

.golangci.yml

@@ -2,3 +2,10 @@ run:
   deadline: 8m
   skip-dirs:
     - controller/zitiql
+
+# golangci gives false positives for implementations of methods using generics in generic interfaces
+issues:
+  exclude-rules:
+    - path: 'controller/model/.*.go'
+      linters:
+        - unused

controller/env/appenv.go

@@ -331,7 +331,7 @@ func processSecondaryJwtSigner(ae *AppEnv, rc *response.RequestContext) bool {
 		extJwtAuthVal := ae.GetAuthRegistry().GetByMethod(model.AuthMethodExtJwt)
 		extJwtAuth := extJwtAuthVal.(*model.AuthModuleExtJwt)
 		if extJwtAuth != nil {
-			authResult, err := extJwtAuth.ProcessSecondary(model.NewAuthContextHttp(rc.Request, model.AuthMethodExtJwt, nil))
+			authResult, err := extJwtAuth.ProcessSecondary(model.NewAuthContextHttp(rc.Request, model.AuthMethodExtJwt, nil, rc.NewChangeContext()))
 
 			if err != nil {
 				return false
@@ -467,13 +467,7 @@ func (ae *AppEnv) InitPersistence() error {
 	ae.EventDispatcher = events.NewDispatcher(ae.GetHostController().GetNetwork(), ae.GetDbProvider(), ae.BoltStores, ae.GetHostController().GetCloseNotifyChannel())
 
 	persistence.ServiceEvents.AddServiceEventHandler(ae.HandleServiceEvent)
-	ae.BoltStores.Identity.AddListener(boltz.EventDelete, func(i ...interface{}) {
-		for _, val := range i {
-			if identity, ok := val.(*persistence.Identity); ok {
-				ae.IdentityRefreshMap.Remove(identity.Id)
-			}
-		}
-	})
+	ae.BoltStores.Identity.AddEntityIdListener(ae.IdentityRefreshMap.Remove, boltz.EntityDeletedAsync)
 
 	return err
 }

controller/env/broker.go

@@ -62,11 +62,11 @@ func NewBroker(ae *AppEnv, synchronizer RouterSyncStrategy) *Broker {
 		routerMsgBufferSize: 100,
 	}
 
-	broker.ae.GetStores().Session.AddListener(boltz.EventDelete, broker.sessionDeleted)
-	broker.ae.GetStores().ApiSession.AddListener(persistence.EventFullyAuthenticated, broker.apiSessionFullyAuthenticated)
-	broker.ae.GetStores().ApiSession.AddListener(boltz.EventDelete, broker.apiSessionDeleted)
-	broker.ae.GetStores().ApiSessionCertificate.AddListener(boltz.EventCreate, broker.apiSessionCertificateCreated)
-	broker.ae.GetStores().ApiSessionCertificate.AddListener(boltz.EventDelete, broker.apiSessionCertificateDeleted)
+	broker.ae.GetStores().Session.AddEntityEventListenerF(broker.routerSyncStrategy.SessionDeleted, boltz.EntityDeletedAsync)
+	broker.ae.GetStores().ApiSession.AddEntityEventListenerF(broker.routerSyncStrategy.ApiSessionDeleted, boltz.EntityDeletedAsync)
+	broker.ae.GetStores().ApiSession.GetEventsEmitter().AddListener(persistence.EventFullyAuthenticated, broker.apiSessionFullyAuthenticated)
+	broker.ae.GetStores().ApiSessionCertificate.AddEntityEventListenerF(broker.apiSessionCertificateCreated, boltz.EntityCreatedAsync)
+	broker.ae.GetStores().ApiSessionCertificate.AddEntityEventListenerF(broker.apiSessionCertificateDeleted, boltz.EntityDeletedAsync)
 
 	ae.HostController.GetNetwork().AddRouterPresenceHandler(broker)
 
@@ -124,52 +124,15 @@ func (broker *Broker) apiSessionFullyAuthenticated(args ...interface{}) {
 	go broker.routerSyncStrategy.ApiSessionAdded(apiSession)
 }
 
-func (broker *Broker) apiSessionDeleted(args ...interface{}) {
-	var apiSession *persistence.ApiSession
-	if len(args) == 1 {
-		apiSession, _ = args[0].(*persistence.ApiSession)
-	}
-
-	if apiSession == nil {
-		pfxlog.Logger().Error("during broker apiSessionDeleted could not cast arg[0] to *persistence.ApiSession")
-		return
-	}
-
-	go broker.routerSyncStrategy.ApiSessionDeleted(apiSession)
+func (broker *Broker) apiSessionCertificateCreated(entity *persistence.ApiSessionCertificate) {
+	go broker.apiSessionCertificateHandler(false, entity)
 }
 
-func (broker *Broker) sessionDeleted(args ...interface{}) {
-	var session *persistence.Session
-	if len(args) == 1 {
-		session, _ = args[0].(*persistence.Session)
-	}
-
-	if session == nil {
-		pfxlog.Logger().Error("during broker sessionDeleted could not cast arg[0] to *persistence.Session")
-		return
-	}
-
-	go broker.routerSyncStrategy.SessionDeleted(session)
+func (broker *Broker) apiSessionCertificateDeleted(entity *persistence.ApiSessionCertificate) {
+	go broker.apiSessionCertificateHandler(true, entity)
 }
 
-func (broker *Broker) apiSessionCertificateCreated(args ...interface{}) {
-	go broker.apiSessionCertificateHandler(false, args...)
-}
-
-func (broker *Broker) apiSessionCertificateDeleted(args ...interface{}) {
-	go broker.apiSessionCertificateHandler(true, args...)
-}
-
-func (broker *Broker) apiSessionCertificateHandler(delete bool, args ...interface{}) {
-	var apiSessionCert *persistence.ApiSessionCertificate
-	if len(args) == 1 {
-		apiSessionCert, _ = args[0].(*persistence.ApiSessionCertificate)
-	}
-
-	if apiSessionCert == nil {
-		pfxlog.Logger().Error("during broker apiSessionCertificateEvent could not cast arg[0] to *persistence.ApiSessionCertificate")
-		return
-	}
+func (broker *Broker) apiSessionCertificateHandler(delete bool, apiSessionCert *persistence.ApiSessionCertificate) {
 	var apiSession *persistence.ApiSession
 	var err error
 	err = broker.ae.GetDbProvider().GetDb().View(func(tx *bbolt.Tx) error {

controller/handler_edge_ctrl/common.go

@@ -2,6 +2,7 @@ package handler_edge_ctrl
 
 import (
 	"fmt"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/fields"
 	"math"
 	"time"
@@ -107,11 +108,36 @@ type baseSessionRequestContext struct {
 	err          controllerError
 	sourceRouter *network.Router
 	session      *model.Session
+	apiSession   *model.ApiSession
 	service      *model.Service
 	newSession   bool
 	logContext   logcontext.Context
 }
 
+func (self *baseSessionRequestContext) newChangeContext() *change.Context {
+	result := change.New().SetSource(fmt.Sprintf("ctrl[edge/%v]", self.handler.getChannel().Underlay().GetRemoteAddr().String()))
+	if self.session != nil {
+		result.
+			SetChangeAuthorId(self.session.IdentityId).
+			SetChangeAuthorName(self.apiSession.Identity.Name).
+			SetChangeAuthorType("identity")
+	} else if self.sourceRouter != nil {
+		result.
+			SetChangeAuthorId(self.sourceRouter.Id).
+			SetChangeAuthorName(self.sourceRouter.Name).
+			SetChangeAuthorType("router")
+	}
+	return result
+}
+
+func (self *baseSessionRequestContext) newTunnelChangeContext() *change.Context {
+	return change.New().
+		SetChangeAuthorId(self.sourceRouter.Id).
+		SetChangeAuthorName(self.sourceRouter.Name).
+		SetChangeAuthorType("router").
+		SetSource(fmt.Sprintf("ctrl[edge:tunnel/%v]", self.handler.getChannel().Underlay().GetRemoteAddr().String()))
+}
+
 func (self *baseSessionRequestContext) GetMessage() *channel.Message {
 	return self.msg
 }
@@ -165,6 +191,7 @@ func (self *baseSessionRequestContext) loadSession(token string) {
 				WithError(self.err).Errorf("invalid api-session")
 			return
 		}
+		self.apiSession = apiSession
 
 		self.logContext = logcontext.NewContext()
 		traceSpec := self.handler.getAppEnv().TraceManager.GetIdentityTrace(apiSession.IdentityId)
@@ -331,7 +358,7 @@ func (self *baseSessionRequestContext) verifyTerminator(terminatorId string, bin
 	return nil
 }
 
-func (self *baseSessionRequestContext) updateTerminator(terminator *network.Terminator, request UpdateTerminatorRequest) {
+func (self *baseSessionRequestContext) updateTerminator(terminator *network.Terminator, request UpdateTerminatorRequest, ctx *change.Context) {
 	if self.err == nil {
 		checker := fields.UpdatedFieldsMap{}
 
@@ -359,7 +386,7 @@ func (self *baseSessionRequestContext) updateTerminator(terminator *network.Term
 			checker[db.FieldTerminatorPrecedence] = struct{}{}
 		}
 
-		self.err = internalError(self.handler.getNetwork().Terminators.Update(terminator, checker))
+		self.err = internalError(self.handler.getNetwork().Terminators.Update(terminator, checker, ctx))
 	}
 }
 

controller/handler_edge_ctrl/common_tunnel.go

@@ -12,7 +12,6 @@ import (
 	"github.com/openziti/foundation/v2/concurrenz"
 	"github.com/openziti/storage/boltz"
 	"github.com/sirupsen/logrus"
-	"go.etcd.io/bbolt"
 	"sync"
 	"time"
 )
@@ -152,9 +151,7 @@ func (self *baseTunnelRequestContext) ensureApiSessionLocking(configTypes []stri
 			IPAddress:      self.handler.getChannel().Underlay().GetRemoteAddr().String(),
 		}
 
-		err := self.handler.getAppEnv().GetDbProvider().GetDb().Update(func(tx *bbolt.Tx) error {
-			ctx := boltz.NewMutateContext(tx)
-
+		err := self.handler.getAppEnv().GetDbProvider().GetDb().Update(self.newTunnelChangeContext().NewMutateContext(), func(ctx boltz.MutateContext) error {
 			var err error
 			apiSession.Id, err = self.handler.getAppEnv().GetManagers().ApiSession.Create(ctx, apiSession, nil)
 			if err != nil {
@@ -272,7 +269,7 @@ func (self *baseTunnelRequestContext) ensureSessionForService(sessionId, session
 			Type:         sessionType,
 		}
 
-		id, err := self.handler.getAppEnv().Managers.Session.Create(session)
+		id, err := self.handler.getAppEnv().Managers.Session.Create(session, self.newTunnelChangeContext())
 		if err != nil {
 			self.err = internalError(err)
 			return
@@ -362,7 +359,7 @@ func (self *baseTunnelRequestContext) updateIdentityInfo(envInfo *edge_ctrl_pb.E
 		}
 
 		if envInfo != nil || sdkInfo != nil {
-			self.err = internalError(self.handler.getAppEnv().GetManagers().Identity.PatchInfo(self.identity))
+			self.err = internalError(self.handler.getAppEnv().GetManagers().Identity.PatchInfo(self.identity, self.newTunnelChangeContext()))
 		}
 	}
 }

controller/handler_edge_ctrl/create_terminator.go

@@ -115,7 +115,11 @@ func (self *createTerminatorHandler) CreateTerminator(ctx *CreateTerminatorReque
 		HostId:         ctx.session.IdentityId,
 	}
 
-	cmd := &model.CreateEdgeTerminatorCmd{Env: self.appEnv, Entity: terminator}
+	cmd := &model.CreateEdgeTerminatorCmd{
+		Env:     self.appEnv,
+		Entity:  terminator,
+		Context: ctx.newChangeContext(),
+	}
 	err = self.appEnv.GetHostController().GetNetwork().Managers.Command.Dispatch(cmd)
 	if err != nil {
 		self.returnError(ctx, internalError(err))

controller/handler_edge_ctrl/create_tunnel_terminator.go

@@ -125,7 +125,7 @@ func (self *createTunnelTerminatorHandler) CreateTerminator(ctx *CreateTunnelTer
 		}
 
 		n := self.appEnv.GetHostController().GetNetwork()
-		err := n.Terminators.Create(terminator)
+		err := n.Terminators.Create(terminator, ctx.newTunnelChangeContext())
 		if err != nil {
 			// terminator might have been created while we were trying to create.
 			terminator, _ = self.getNetwork().Terminators.Read(ctx.req.Address)

controller/handler_edge_ctrl/extend_enrollment.go

@@ -17,15 +17,29 @@
 package handler_edge_ctrl
 
 import (
+	"fmt"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/channel/v2"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/internal/cert"
 	"github.com/openziti/edge/pb/edge_ctrl_pb"
+	"github.com/openziti/fabric/controller/change"
+	"github.com/openziti/fabric/controller/models"
 	"google.golang.org/protobuf/proto"
 )
 
+func newRouterChangeContext(router interface {
+	models.Named
+	GetId() string
+}, ch channel.Channel) *change.Context {
+	return change.New().
+		SetChangeAuthorId(router.GetId()).
+		SetChangeAuthorName(router.GetName()).
+		SetChangeAuthorType("router").
+		SetSource(fmt.Sprintf("ctrl[edge/%v]", ch.Underlay().GetRemoteAddr().String()))
+}
+
 type extendEnrollmentHandler struct {
 	appEnv *env.AppEnv
 }
@@ -68,6 +82,7 @@ func (h *extendEnrollmentHandler) HandleReceive(msg *channel.Message, ch channel
 			var newCerts *model.ExtendedCerts
 
 			if router, _ := h.appEnv.Managers.EdgeRouter.ReadOneByFingerprint(fingerprint); router != nil {
+				changeCtx := newRouterChangeContext(router, ch)
 
 				log = log.WithFields(map[string]interface{}{
 					"routerId":   router.Id,
@@ -75,9 +90,9 @@ func (h *extendEnrollmentHandler) HandleReceive(msg *channel.Message, ch channel
 				})
 
 				if req.RequireVerification {
-					newCerts, err = h.appEnv.Managers.EdgeRouter.ExtendEnrollmentWithVerify(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr))
+					newCerts, err = h.appEnv.Managers.EdgeRouter.ExtendEnrollmentWithVerify(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr), changeCtx)
 				} else {
-					newCerts, err = h.appEnv.Managers.EdgeRouter.ExtendEnrollment(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr))
+					newCerts, err = h.appEnv.Managers.EdgeRouter.ExtendEnrollment(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr), changeCtx)
 				}
 
 				if err != nil {
@@ -86,11 +101,12 @@ func (h *extendEnrollmentHandler) HandleReceive(msg *channel.Message, ch channel
 				}
 
 			} else if router, _ := h.appEnv.Managers.TransitRouter.ReadOneByFingerprint(fingerprint); router != nil {
+				changeCtx := newRouterChangeContext(router, ch)
 
 				if req.RequireVerification {
-					newCerts, err = h.appEnv.Managers.TransitRouter.ExtendEnrollmentWithVerify(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr))
+					newCerts, err = h.appEnv.Managers.TransitRouter.ExtendEnrollmentWithVerify(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr), changeCtx)
 				} else {
-					newCerts, err = h.appEnv.Managers.TransitRouter.ExtendEnrollment(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr))
+					newCerts, err = h.appEnv.Managers.TransitRouter.ExtendEnrollment(router, []byte(req.ClientCertCsr), []byte(req.ServerCertCsr), changeCtx)
 				}
 
 				if err != nil {

controller/handler_edge_ctrl/extend_enrollment_verify.go

@@ -90,7 +90,8 @@ func (h *extendEnrollmentVerifyHandler) HandleReceive(msg *channel.Message, ch c
 				return
 			}
 
-			err := h.appEnv.Managers.EdgeRouter.ExtendEnrollmentVerify(edgeRouter)
+			changeCtx := newRouterChangeContext(edgeRouter, ch)
+			err := h.appEnv.Managers.EdgeRouter.ExtendEnrollmentVerify(edgeRouter, changeCtx)
 			if err != nil {
 				h.respond(&edge_ctrl_pb.Error{
 					Code:    "VERIFY_ERROR",
@@ -122,7 +123,8 @@ func (h *extendEnrollmentVerifyHandler) HandleReceive(msg *channel.Message, ch c
 				return
 			}
 
-			err := h.appEnv.Managers.TransitRouter.ExtendEnrollmentVerify(router)
+			changeCtx := newRouterChangeContext(router, ch)
+			err := h.appEnv.Managers.TransitRouter.ExtendEnrollmentVerify(router, changeCtx)
 			if err != nil {
 				h.respond(&edge_ctrl_pb.Error{
 					Code:    "VERIFY_ERROR",

controller/handler_edge_ctrl/remove_terminator.go

@@ -104,7 +104,7 @@ func (self *removeTerminatorHandler) RemoveTerminator(ctx *RemoveTerminatorReque
 		return
 	}
 
-	err := self.getNetwork().Terminators.Delete(ctx.req.TerminatorId)
+	err := self.getNetwork().Terminators.Delete(ctx.req.TerminatorId, ctx.newChangeContext())
 	if err != nil {
 		self.returnError(ctx, internalError(err))
 		return

controller/handler_edge_ctrl/remove_tunnel_terminator.go

@@ -69,7 +69,7 @@ func (self *removeTunnelTerminatorHandler) RemoveTerminator(ctx *RemoveTunnelTer
 
 	logger = logger.WithField("serviceId", t.Service)
 
-	err := self.getNetwork().Terminators.Delete(ctx.terminatorId)
+	err := self.getNetwork().Terminators.Delete(ctx.terminatorId, ctx.newTunnelChangeContext())
 	if err != nil {
 		self.returnError(ctx, internalError(err))
 		return

controller/handler_edge_ctrl/update_terminator.go

@@ -83,7 +83,8 @@ func (self *updateTerminatorHandler) UpdateTerminator(ctx *UpdateTerminatorReque
 	ctx.checkSessionType(persistence.SessionTypeBind)
 	ctx.checkSessionFingerprints(ctx.req.Fingerprints)
 	terminator := ctx.verifyTerminator(ctx.req.TerminatorId, edge_common.EdgeBinding)
-	ctx.updateTerminator(terminator, ctx.req)
+
+	ctx.updateTerminator(terminator, ctx.req, ctx.newChangeContext())
 
 	if ctx.err != nil {
 		self.returnError(ctx, ctx.err)

controller/handler_edge_ctrl/update_tunnel_terminator.go

@@ -77,7 +77,7 @@ func (self *updateTunnelTerminatorHandler) UpdateTerminator(ctx *UpdateTunnelTer
 	logrus.Debug("update request received")
 
 	terminator := ctx.verifyTerminator(ctx.req.TerminatorId, edge_common.TunnelBinding)
-	ctx.updateTerminator(terminator, ctx.req)
+	ctx.updateTerminator(terminator, ctx.req, ctx.newTunnelChangeContext())
 	if ctx.err != nil {
 		self.returnError(ctx, ctx.err)
 		return

controller/internal/policy/api_session_enforcer.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/runner"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/sirupsen/logrus"
 	"time"
 )
@@ -97,11 +98,12 @@ func (s *ApiSessionEnforcer) Run() error {
 
 		logrus.Debugf("found %v expired api-sessions to remove", len(ids))
 
-		if err = s.appEnv.GetManagers().ApiSession.DeleteBatch(ids); err != nil {
+		ctx := change.New().SetSource("api-session.enforcer").SetChangeAuthorType("controller")
+		if err = s.appEnv.GetManagers().ApiSession.DeleteBatch(ids, ctx); err != nil {
 			logrus.WithError(err).Error("failure while batch deleting expired api sessions")
 
 			for _, id := range ids {
-				if err = s.appEnv.GetManagers().ApiSession.Delete(id); err != nil {
+				if err = s.appEnv.GetManagers().ApiSession.Delete(id, ctx); err != nil {
 					logrus.WithError(err).Errorf("failure while deleting expired api session: %v", id)
 				}
 			}

controller/internal/policy/service_policy_enforcer.go

@@ -19,6 +19,7 @@ package policy
 import (
 	"fmt"
 	"github.com/michaelquigley/pfxlog"
+	"github.com/openziti/fabric/controller/change"
 	"time"
 
 	"github.com/openziti/edge/controller/env"
@@ -77,10 +78,8 @@ func (enforcer *ServicePolicyEnforcer) handleServiceEvent(event *persistence.Ser
 	var sessionsToDelete []string
 
 	err := enforcer.appEnv.GetDbProvider().GetDb().View(func(tx *bbolt.Tx) error {
-		var err error
-		identity := &persistence.Identity{}
-
-		if _, err := enforcer.appEnv.GetStores().Identity.BaseLoadOneById(tx, event.IdentityId, identity); err != nil {
+		identity, err := enforcer.appEnv.GetStores().Identity.LoadOneById(tx, event.IdentityId)
+		if err != nil {
 			return err
 		}
 
@@ -103,8 +102,9 @@ func (enforcer *ServicePolicyEnforcer) handleServiceEvent(event *persistence.Ser
 		}
 	}
 
+	ctx := change.New().SetSource("service-policy.enforcer").SetChangeAuthorType("controller")
 	for _, sessionId := range sessionsToDelete {
-		_ = enforcer.appEnv.GetManagers().Session.Delete(sessionId)
+		_ = enforcer.appEnv.GetManagers().Session.Delete(sessionId, ctx)
 		log.Debugf("session %v deleted", sessionId)
 	}
 
@@ -134,16 +134,12 @@ func (enforcer *ServicePolicyEnforcer) Run() error {
 	var sessionsToRemove []string
 	err = enforcer.appEnv.GetDbProvider().GetDb().View(func(tx *bbolt.Tx) error {
 		for _, session := range result.Sessions {
-			apiSession := &persistence.ApiSession{}
-			_, err := enforcer.appEnv.GetStores().ApiSession.BaseLoadOneById(tx, session.ApiSessionId, apiSession)
-
+			apiSession, err := enforcer.appEnv.GetStores().ApiSession.LoadOneById(tx, session.ApiSessionId)
 			if err != nil {
 				return err
 			}
 
-			identity := &persistence.Identity{}
-			_, err = enforcer.appEnv.GetStores().Identity.BaseLoadOneById(tx, apiSession.IdentityId, identity)
-
+			identity, err := enforcer.appEnv.GetStores().Identity.LoadOneById(tx, apiSession.IdentityId)
 			if err != nil {
 				return err
 			}
@@ -172,8 +168,9 @@ func (enforcer *ServicePolicyEnforcer) Run() error {
 		return err
 	}
 
+	ctx := change.New().SetSource("service-policy.enforcer").SetChangeAuthorType("controller")
 	for _, sessionId := range sessionsToRemove {
-		_ = enforcer.appEnv.GetManagers().Session.Delete(sessionId)
+		_ = enforcer.appEnv.GetManagers().Session.Delete(sessionId, ctx)
 	}
 
 	enforcer.appEnv.GetMetricsRegistry().Meter(SessionPolicyEnforcerRunDeletes).Mark(int64(len(sessionsToRemove)))

controller/internal/policy/session_enforcer_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/eid"
 	"github.com/openziti/storage/boltz"
+	"github.com/openziti/storage/boltztest"
 	"github.com/sirupsen/logrus"
 	"testing"
 	"time"
@@ -49,25 +50,25 @@ func (ctx *enforcerTestContext) testSessionsCleanup() {
 
 	identity := ctx.RequireNewIdentity("Jojo", false)
 	apiSession := persistence.NewApiSession(identity.Id)
-	ctx.RequireCreate(apiSession)
+	boltztest.RequireCreate(ctx, apiSession)
 	service := ctx.RequireNewService("test-service")
 	session := NewSession(apiSession.Id, service.Id)
-	ctx.RequireCreate(session)
-	ctx.ValidateBaseline(session, compareOpts)
+	boltztest.RequireCreate(ctx, session)
+	boltztest.ValidateBaseline(ctx, session, compareOpts)
 
 	session2 := NewSession(apiSession.Id, service.Id)
 	session2.Type = persistence.PolicyTypeBindName
-	ctx.RequireCreate(session2)
-	ctx.ValidateBaseline(session2, compareOpts)
+	boltztest.RequireCreate(ctx, session2)
+	boltztest.ValidateBaseline(ctx, session2, compareOpts)
 
 	service2 := ctx.RequireNewService("test-service-2")
 	session3 := NewSession(apiSession.Id, service2.Id)
 	session3.Tags = ctx.CreateTags()
-	ctx.RequireCreate(session3)
-	ctx.ValidateBaseline(session3, compareOpts)
+	boltztest.RequireCreate(ctx, session3)
+	boltztest.ValidateBaseline(ctx, session3, compareOpts)
 
-	ctx.RequireReload(session)
-	ctx.RequireReload(session2)
+	boltztest.RequireReload(ctx, session)
+	boltztest.RequireReload(ctx, session2)
 
 	enforcer := &ApiSessionEnforcer{
 		appEnv:         ctx,
@@ -85,10 +86,10 @@ func (ctx *enforcerTestContext) testSessionsCleanup() {
 		ctx.Fail("did not receive done notification from eventual eventer")
 	}
 
-	ctx.ValidateDeleted(apiSession.Id)
-	ctx.ValidateDeleted(session.Id)
-	ctx.ValidateDeleted(session2.Id)
-	ctx.ValidateDeleted(session3.Id)
+	boltztest.ValidateDeleted(ctx, apiSession.Id)
+	boltztest.ValidateDeleted(ctx, session.Id)
+	boltztest.ValidateDeleted(ctx, session2.Id)
+	boltztest.ValidateDeleted(ctx, session3.Id)
 }
 
 func NewSession(apiSessionId, serviceId string) *persistence.Session {

controller/internal/routes/api_session_api_model.go

@@ -17,9 +17,7 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/go-openapi/strfmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -58,25 +56,8 @@ func (factory *ApiSessionLinkFactoryImpl) Links(entity models.Entity) rest_model
 	}
 }
 
-func MapApiSessionToRestInterface(ae *env.AppEnv, _ *response.RequestContext, apiSessionEntity models.Entity) (interface{}, error) {
-	apiSession, ok := apiSessionEntity.(*model.ApiSession)
-
-	if !ok {
-		err := fmt.Errorf("entity is not an ApiSession \"%s\"", apiSessionEntity.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapApiSessionToRestModel(ae, apiSession)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", apiSessionEntity.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapApiSessionToRestInterface(ae *env.AppEnv, _ *response.RequestContext, apiSession *model.ApiSession) (interface{}, error) {
+	return MapApiSessionToRestModel(ae, apiSession)
 }
 
 func MapApiSessionToRestModel(ae *env.AppEnv, apiSession *model.ApiSession) (*rest_model.APISessionDetail, error) {

controller/internal/routes/api_session_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/api_session"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 )
 
@@ -54,11 +55,11 @@ func (ir *ApiSessionHandler) Register(ae *env.AppEnv) {
 }
 
 func (ir *ApiSessionHandler) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.ApiSession, MapApiSessionToRestInterface)
+	ListWithHandler[*model.ApiSession](ae, rc, ae.Managers.ApiSession, MapApiSessionToRestInterface)
 }
 
 func (ir *ApiSessionHandler) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.ApiSession, MapApiSessionToRestInterface)
+	DetailWithHandler[*model.ApiSession](ae, rc, ae.Managers.ApiSession, MapApiSessionToRestInterface)
 }
 
 func (ir *ApiSessionHandler) Delete(ae *env.AppEnv, rc *response.RequestContext) {

controller/internal/routes/auth_policy_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -31,26 +29,8 @@ const EntityNameAuthPolicy = "auth-policies"
 
 var AuthPolicyLinkFactory = NewBasicLinkFactory(EntityNameAuthPolicy)
 
-func MapAuthPolicyToRestEntity(_ *env.AppEnv, _ *response.RequestContext, entity models.Entity) (interface{}, error) {
-	authPolicyModel, ok := entity.(*model.AuthPolicy)
-
-	if !ok {
-		err := fmt.Errorf("could not convert to %T to %T: \"%s\"", entity, authPolicyModel, entity.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapAuthPolicyToRestModel(authPolicyModel)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to %T to %T: \"%s\": %s", authPolicyModel, restModel, entity.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	return restModel, err
+func MapAuthPolicyToRestEntity(_ *env.AppEnv, _ *response.RequestContext, authPolicyModel *model.AuthPolicy) (interface{}, error) {
+	return MapAuthPolicyToRestModel(authPolicyModel)
 }
 
 func MapAuthPolicyToRestModel(model *model.AuthPolicy) (*rest_model.AuthPolicyDetail, error) {

controller/internal/routes/auth_policy_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/auth_policy"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -67,16 +68,16 @@ func (r *AuthPolicyRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *AuthPolicyRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.AuthPolicy, MapAuthPolicyToRestEntity)
+	ListWithHandler[*model.AuthPolicy](ae, rc, ae.Managers.AuthPolicy, MapAuthPolicyToRestEntity)
 }
 
 func (r *AuthPolicyRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.AuthPolicy, MapAuthPolicyToRestEntity)
+	DetailWithHandler[*model.AuthPolicy](ae, rc, ae.Managers.AuthPolicy, MapAuthPolicyToRestEntity)
 }
 
 func (r *AuthPolicyRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params auth_policy.CreateAuthPolicyParams) {
 	Create(rc, rc, AuthPolicyLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.AuthPolicy.Create, MapCreateAuthPolicyToModel(params.AuthPolicy))
+		return MapCreate(ae.Managers.AuthPolicy.Create, MapCreateAuthPolicyToModel(params.AuthPolicy), rc)
 	})
 }
 
@@ -86,12 +87,12 @@ func (r *AuthPolicyRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *AuthPolicyRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params auth_policy.UpdateAuthPolicyParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.AuthPolicy.Update(MapUpdateAuthPolicyToModel(params.ID, params.AuthPolicy), nil)
+		return ae.Managers.AuthPolicy.Update(MapUpdateAuthPolicyToModel(params.ID, params.AuthPolicy), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *AuthPolicyRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params auth_policy.PatchAuthPolicyParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.AuthPolicy.Update(MapPatchAuthPolicyToModel(params.ID, params.AuthPolicy), fields.FilterMaps("tags"))
+		return ae.Managers.AuthPolicy.Update(MapPatchAuthPolicyToModel(params.ID, params.AuthPolicy), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }

controller/internal/routes/authenticate_router.go

@@ -76,10 +76,12 @@ func (ro *AuthRouter) Register(ae *env.AppEnv) {
 func (ro *AuthRouter) authHandler(ae *env.AppEnv, rc *response.RequestContext, httpRequest *http.Request, method string, auth *rest_model.Authenticate) {
 	start := time.Now()
 	logger := pfxlog.Logger()
-	authContext := model.NewAuthContextHttp(httpRequest, method, auth)
+	authContext := model.NewAuthContextHttp(httpRequest, method, auth, rc.NewChangeContext())
 
 	authResult, err := ae.Managers.Authenticator.Authorize(authContext)
 
+	changeCtx := rc.NewChangeContext()
+
 	if err != nil {
 		rc.RespondWithError(err)
 		return
@@ -124,7 +126,7 @@ func (ro *AuthRouter) authHandler(ae *env.AppEnv, rc *response.RequestContext, h
 		}
 
 		if shouldUpdate {
-			if err := ae.GetManagers().Identity.PatchInfo(identity); err != nil {
+			if err := ae.GetManagers().Identity.PatchInfo(identity, changeCtx); err != nil {
 				logger.WithError(err).Errorf("failed to update sdk/env info on identity [%s] auth", identity.Id)
 			}
 		}
@@ -170,7 +172,7 @@ func (ro *AuthRouter) authHandler(ae *env.AppEnv, rc *response.RequestContext, h
 		sessionCerts = append(sessionCerts, sessionCert)
 	}
 
-	sessionId, err := ae.Managers.ApiSession.Create(nil, newApiSession, sessionCerts)
+	sessionId, err := ae.Managers.ApiSession.Create(changeCtx.NewMutateContext(), newApiSession, sessionCerts)
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -215,14 +217,14 @@ func (ro *AuthRouter) authMfa(ae *env.AppEnv, rc *response.RequestContext, mfaCo
 		return
 	}
 
-	ok, _ := ae.Managers.Mfa.Verify(mfa, *mfaCode.Code)
+	ok, _ := ae.Managers.Mfa.Verify(mfa, *mfaCode.Code, rc.NewChangeContext())
 
 	if !ok {
 		rc.RespondWithError(apierror.NewInvalidMfaTokenError())
 		return
 	}
 
-	if err := ae.Managers.ApiSession.MfaCompleted(rc.ApiSession); err != nil {
+	if err := ae.Managers.ApiSession.MfaCompleted(rc.ApiSession, rc.NewChangeContext()); err != nil {
 		rc.RespondWithError(err)
 		return
 	}

controller/internal/routes/authenticator_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -142,25 +140,8 @@ func MapPatchAuthenticatorToModel(id string, in *rest_model.AuthenticatorPatch)
 	return result
 }
 
-func MapAuthenticatorToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	i, ok := e.(*model.Authenticator)
-
-	if !ok {
-		err := fmt.Errorf("entity is not an authenticator \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	al, err := MapAuthenticatorToRestModel(ae, i)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return al, nil
+func MapAuthenticatorToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e *model.Authenticator) (interface{}, error) {
+	return MapAuthenticatorToRestModel(ae, e)
 }
 
 func MapAuthenticatorToRestModel(ae *env.AppEnv, i *model.Authenticator) (*rest_model.AuthenticatorDetail, error) {
@@ -191,7 +172,7 @@ func MapAuthenticatorToRestModel(ae *env.AppEnv, i *model.Authenticator) (*rest_
 	return result, nil
 }
 
-func MapAuthenticatorsToRestEntities(ae *env.AppEnv, rc *response.RequestContext, es []*model.Authenticator) ([]*rest_model.AuthenticatorDetail, error) {
+func MapAuthenticatorsToRestEntities(ae *env.AppEnv, _ *response.RequestContext, es []*model.Authenticator) ([]*rest_model.AuthenticatorDetail, error) {
 	apiEntities := make([]*rest_model.AuthenticatorDetail, 0)
 
 	for _, e := range es {

controller/internal/routes/authenticator_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/authenticator"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/foundation/v2/errorz"
@@ -76,11 +77,11 @@ func (r *AuthenticatorRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *AuthenticatorRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.Authenticator, MapAuthenticatorToRestEntity)
+	ListWithHandler[*model.Authenticator](ae, rc, ae.Managers.Authenticator, MapAuthenticatorToRestEntity)
 }
 
 func (r *AuthenticatorRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.Authenticator, MapAuthenticatorToRestEntity)
+	DetailWithHandler[*model.Authenticator](ae, rc, ae.Managers.Authenticator, MapAuthenticatorToRestEntity)
 }
 
 func (r *AuthenticatorRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params authenticator.CreateAuthenticatorParams) {
@@ -91,7 +92,7 @@ func (r *AuthenticatorRouter) Create(ae *env.AppEnv, rc *response.RequestContext
 			return "", err
 		}
 
-		return MapCreate(ae.Managers.Authenticator.Create, authenticator)
+		return MapCreate(ae.Managers.Authenticator.Create, authenticator, rc)
 	})
 }
 
@@ -101,7 +102,7 @@ func (r *AuthenticatorRouter) Delete(ae *env.AppEnv, rc *response.RequestContext
 
 func (r *AuthenticatorRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params authenticator.UpdateAuthenticatorParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.Authenticator.Update(MapUpdateAuthenticatorToModel(params.ID, params.Authenticator), false, nil)
+		return ae.Managers.Authenticator.Update(MapUpdateAuthenticatorToModel(params.ID, params.Authenticator), false, nil, rc.NewChangeContext())
 	})
 }
 
@@ -113,7 +114,7 @@ func (r *AuthenticatorRouter) Patch(ae *env.AppEnv, rc *response.RequestContext,
 			fields.AddField("salt")
 		}
 
-		return ae.Managers.Authenticator.Update(model, false, fields.FilterMaps("tags"))
+		return ae.Managers.Authenticator.Update(model, false, fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
@@ -130,7 +131,7 @@ func (r *AuthenticatorRouter) ReEnroll(ae *env.AppEnv, rc *response.RequestConte
 		return
 	}
 
-	if id, err := ae.Managers.Authenticator.ReEnroll(id, time.Time(*params.ReEnroll.ExpiresAt)); err == nil {
+	if id, err := ae.Managers.Authenticator.ReEnroll(id, time.Time(*params.ReEnroll.ExpiresAt), rc.NewChangeContext()); err == nil {
 		rc.RespondWithCreatedId(id, EnrollmentLinkFactory.SelfLinkFromId(id))
 	} else {
 		if fe, ok := err.(*errorz.FieldError); ok {

controller/internal/routes/base_router.go

@@ -22,15 +22,19 @@ import (
 	"github.com/openziti/edge-api/rest_model"
 	edgeApiError "github.com/openziti/edge/controller/apierror"
 	"github.com/openziti/edge/controller/env"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/api"
 	"github.com/openziti/fabric/controller/apierror"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/storage/ast"
 	"github.com/openziti/storage/boltz"
+	"github.com/pkg/errors"
+	"go.etcd.io/bbolt"
 	"net/http"
 	"reflect"
 	"strings"
@@ -40,13 +44,19 @@ const (
 	EntityNameSelf = "self"
 )
 
-func modelToApi(ae *env.AppEnv, rc *response.RequestContext, mapper ModelToApiMapper, es []models.Entity) ([]interface{}, error) {
+func modelToApi[E models.Entity](ae *env.AppEnv, rc *response.RequestContext, mapper func(*env.AppEnv, *response.RequestContext, E) (interface{}, error), es []E) ([]interface{}, error) {
 	apiEntities := make([]interface{}, 0)
 
 	for _, e := range es {
 		al, err := mapper(ae, rc, e)
 
 		if err != nil {
+			pfxlog.Logger().
+				WithError(err).
+				WithField("entityId", e.GetId()).
+				WithField("entityType", reflect.TypeOf(e).String()).
+				Error("could not convert to API entity")
+			err = errors.Wrapf(err, "could not convert %T with id [%v] to API entity", e, e.GetId())
 			return nil, err
 		}
 
@@ -56,13 +66,16 @@ func modelToApi(ae *env.AppEnv, rc *response.RequestContext, mapper ModelToApiMa
 	return apiEntities, nil
 }
 
-func ListWithHandler(ae *env.AppEnv, rc *response.RequestContext, lister models.EntityRetriever[models.Entity], mapper ModelToApiMapper) {
+func ListWithHandler[E models.Entity](ae *env.AppEnv, rc *response.RequestContext, lister models.EntityRetriever[E],
+	mapper func(*env.AppEnv, *response.RequestContext, E) (interface{}, error)) {
 	ListWithQueryF(ae, rc, lister, mapper, lister.BasePreparedList)
 }
 
-type queryF func(query ast.Query) (*models.EntityListResult[models.Entity], error)
-
-func ListWithQueryF(ae *env.AppEnv, rc *response.RequestContext, lister models.EntityRetriever[models.Entity], mapper ModelToApiMapper, qf queryF) {
+func ListWithQueryF[E models.Entity](ae *env.AppEnv,
+	rc *response.RequestContext,
+	lister models.EntityRetriever[E],
+	mapper func(*env.AppEnv, *response.RequestContext, E) (interface{}, error),
+	qf func(query ast.Query) (*models.EntityListResult[E], error)) {
 	ListWithQueryFAndCollector(ae, rc, lister, mapper, defaultToListEnvelope, qf)
 }
 
@@ -76,11 +89,16 @@ func defaultToListEnvelope(data []interface{}, meta *rest_model.Meta) interface{
 type ApiListEnvelopeFactory func(data []interface{}, meta *rest_model.Meta) interface{}
 type ApiEntityEnvelopeFactory func(data interface{}, meta *rest_model.Meta) interface{}
 
-func ListWithQueryFAndCollector(ae *env.AppEnv, rc *response.RequestContext, lister models.EntityRetriever[models.Entity], mapper ModelToApiMapper, toEnvelope ApiListEnvelopeFactory, qf queryF) {
+func ListWithQueryFAndCollector[E models.Entity](ae *env.AppEnv,
+	rc *response.RequestContext,
+	lister models.EntityRetriever[E],
+	mapper func(*env.AppEnv, *response.RequestContext, E) (interface{}, error),
+	toEnvelope ApiListEnvelopeFactory,
+	qf func(query ast.Query) (*models.EntityListResult[E], error)) {
 	ListWithEnvelopeFactory(rc, toEnvelope, func(rc *response.RequestContext, queryOptions *PublicQueryOptions) (*QueryResult, error) {
 		// validate that the submitted query is only using public symbols. The query options may contain an final
 		// query which has been modified with additional filters
-		query, err := queryOptions.getFullQuery(lister.GetStore())
+		query, err := queryOptions.getFullQuery(lister.GetListStore())
 		if err != nil {
 			return nil, err
 		}
@@ -196,7 +214,8 @@ func CreateWithResponder(rc *response.RequestContext, rsp response.Responder, li
 	rsp.RespondWithCreatedId(id, linkFactory.SelfLinkFromId(id))
 }
 
-func DetailWithHandler(ae *env.AppEnv, rc *response.RequestContext, loader models.EntityRetriever[models.Entity], mapper ModelToApiMapper) {
+func DetailWithHandler[E models.Entity](ae *env.AppEnv, rc *response.RequestContext, loader models.EntityRetriever[E],
+	mapper func(*env.AppEnv, *response.RequestContext, E) (interface{}, error)) {
 	Detail(rc, func(rc *response.RequestContext, id string) (interface{}, error) {
 		entity, err := loader.BaseLoad(id)
 		if err != nil {
@@ -236,12 +255,12 @@ func Detail(rc *response.RequestContext, f ModelDetailF) {
 type ModelDeleteF func(rc *response.RequestContext, id string) error
 
 type DeleteHandler interface {
-	Delete(id string) error
+	Delete(id string, ctx *change.Context) error
 }
 
 func DeleteWithHandler(rc *response.RequestContext, deleteHandler DeleteHandler) {
 	Delete(rc, func(rc *response.RequestContext, id string) error {
-		return deleteHandler.Delete(id)
+		return deleteHandler.Delete(id, rc.NewChangeContext())
 	})
 }
 
@@ -397,9 +416,19 @@ func listWithId(rc *response.RequestContext, f func(id string) ([]interface{}, e
 // type ListAssocF func(string, func(models.Entity)) error
 type listAssocF func(rc *response.RequestContext, id string, queryOptions *PublicQueryOptions) (*QueryResult, error)
 
-func ListAssociationsWithFilter(ae *env.AppEnv, rc *response.RequestContext, filterTemplate string, entityController models.EntityRetriever[models.Entity], mapper ModelToApiMapper) {
+type AssociationLister[E models.Entity] interface {
+	GetListStore() boltz.Store
+	BasePreparedList(query ast.Query) (*models.EntityListResult[E], error)
+	BaseLoadInTx(tx *bbolt.Tx, id string) (E, error)
+}
+
+func ListAssociationsWithFilter[E models.Entity](ae *env.AppEnv,
+	rc *response.RequestContext,
+	filterTemplate string,
+	entityController AssociationLister[E],
+	mapper func(*env.AppEnv, *response.RequestContext, E) (interface{}, error)) {
 	ListAssociations(rc, func(rc *response.RequestContext, id string, queryOptions *PublicQueryOptions) (*QueryResult, error) {
-		query, err := queryOptions.getFullQuery(entityController.GetStore())
+		query, err := queryOptions.getFullQuery(entityController.GetListStore())
 		if err != nil {
 			return nil, err
 		}
@@ -409,7 +438,7 @@ func ListAssociationsWithFilter(ae *env.AppEnv, rc *response.RequestContext, fil
 			filter = fmt.Sprintf(filterTemplate, id)
 		}
 
-		filterQuery, err := ast.Parse(entityController.GetStore(), filter)
+		filterQuery, err := ast.Parse(entityController.GetListStore(), filter)
 		if err != nil {
 			return nil, err
 		}
@@ -430,19 +459,23 @@ func ListAssociationsWithFilter(ae *env.AppEnv, rc *response.RequestContext, fil
 	})
 }
 
-func ListAssociationWithHandler(ae *env.AppEnv, rc *response.RequestContext, lister models.EntityRetriever[models.Entity], associationLoader models.EntityRetriever[models.Entity], mapper ModelToApiMapper) {
+func ListAssociationWithHandler[E models.Entity, A models.Entity](ae *env.AppEnv,
+	rc *response.RequestContext,
+	lister models.EntityRetriever[E],
+	associationLoader AssociationLister[A],
+	mapper func(*env.AppEnv, *response.RequestContext, A) (interface{}, error)) {
 	ListAssociations(rc, func(rc *response.RequestContext, id string, queryOptions *PublicQueryOptions) (*QueryResult, error) {
 		// validate that the submitted query is only using public symbols. The query options may contain an final
 		// query which has been modified with additional filters
-		query, err := queryOptions.getFullQuery(associationLoader.GetStore())
+		query, err := queryOptions.getFullQuery(associationLoader.GetListStore())
 		if err != nil {
 			return nil, err
 		}
 
-		result := models.EntityListResult[models.Entity]{
+		result := models.EntityListResult[A]{
 			Loader: associationLoader,
 		}
-		err = lister.PreparedListAssociatedWithHandler(id, associationLoader.GetStore().GetEntityType(), query, result.Collect)
+		err = lister.PreparedListAssociatedWithHandler(id, associationLoader.GetListStore().GetEntityType(), query, result.Collect)
 		if err != nil {
 			return nil, err
 		}
@@ -457,9 +490,9 @@ func ListAssociationWithHandler(ae *env.AppEnv, rc *response.RequestContext, lis
 }
 
 func ListTerminatorAssociations(ae *env.AppEnv, rc *response.RequestContext,
-	lister models.EntityRetriever[models.Entity],
+	lister models.EntityRetriever[*model.Service],
 	associationLoader *network.TerminatorManager,
-	mapper ModelToApiMapper) {
+	mapper func(ae *env.AppEnv, _ *response.RequestContext, terminator *network.Terminator) (interface{}, error)) {
 	ListAssociations(rc, func(rc *response.RequestContext, id string, queryOptions *PublicQueryOptions) (*QueryResult, error) {
 		// validate that the submitted query is only using public symbols. The query options may contain an final
 		// query which has been modified with additional filters
@@ -539,8 +572,8 @@ func ListAssociations(rc *response.RequestContext, listF listAssocF) {
 	rc.RespondWithOk(result.Result, meta)
 }
 
-func MapCreate[T models.Entity](f func(T) error, entity T) (string, error) {
-	err := f(entity)
+func MapCreate[T models.Entity](f func(T, *change.Context) error, entity T, rc *response.RequestContext) (string, error) {
+	err := f(entity, rc.NewChangeContext())
 	if err != nil {
 		return "", err
 	}

controller/internal/routes/ca_api_model.go

@@ -17,10 +17,8 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/go-openapi/strfmt"
 	"github.com/google/uuid"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -144,25 +142,8 @@ func MapPatchCaToModel(id string, ca *rest_model.CaPatch) *model.Ca {
 	return ret
 }
 
-func MapCaToRestEntity(_ *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	i, ok := e.(*model.Ca)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a CA \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	al, err := MapCaToRestModel(i)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return al, nil
+func MapCaToRestEntity(_ *env.AppEnv, _ *response.RequestContext, e *model.Ca) (interface{}, error) {
+	return MapCaToRestModel(e)
 }
 
 func MapCaToRestModel(i *model.Ca) (*rest_model.CaDetail, error) {

controller/internal/routes/ca_router.go

@@ -27,6 +27,7 @@ import (
 	"github.com/openziti/edge/controller/apierror"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/sdk-golang/ziti/config"
@@ -90,16 +91,16 @@ func (r *CaRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *CaRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.Ca, MapCaToRestEntity)
+	ListWithHandler[*model.Ca](ae, rc, ae.Managers.Ca, MapCaToRestEntity)
 }
 
 func (r *CaRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.Ca, MapCaToRestEntity)
+	DetailWithHandler[*model.Ca](ae, rc, ae.Managers.Ca, MapCaToRestEntity)
 }
 
 func (r *CaRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params certificate_authority.CreateCaParams) {
 	Create(rc, rc, CaLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.Ca.Create, MapCreateCaToModel(params.Ca))
+		return MapCreate(ae.Managers.Ca.Create, MapCreateCaToModel(params.Ca), rc)
 	})
 }
 
@@ -109,13 +110,13 @@ func (r *CaRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *CaRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params certificate_authority.UpdateCaParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.Ca.Update(MapUpdateCaToModel(params.ID, params.Ca), nil)
+		return ae.Managers.Ca.Update(MapUpdateCaToModel(params.ID, params.Ca), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *CaRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params certificate_authority.PatchCaParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.Ca.Update(MapPatchCaToModel(params.ID, params.Ca), fields.FilterMaps("tags"))
+		return ae.Managers.Ca.Update(MapPatchCaToModel(params.ID, params.Ca), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
@@ -219,7 +220,7 @@ func (r *CaRouter) VerifyCert(ae *env.AppEnv, rc *response.RequestContext, param
 		return
 	}
 
-	err = ae.Managers.Ca.Verified(ca)
+	err = ae.Managers.Ca.Verified(ca, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)

controller/internal/routes/config_api_model.go

@@ -18,7 +18,6 @@ package routes
 
 import (
 	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -98,25 +97,8 @@ func MapPatchConfigToModel(id string, config *rest_model.ConfigPatch) (*model.Co
 	return ret, nil
 }
 
-func MapConfigToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	config, ok := e.(*model.Config)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Config \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	al, err := MapConfigToRestModel(ae, config)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return al, nil
+func MapConfigToRestEntity(ae *env.AppEnv, _ *response.RequestContext, config *model.Config) (interface{}, error) {
+	return MapConfigToRestModel(ae, config)
 }
 
 func MapConfigToRestModel(ae *env.AppEnv, config *model.Config) (*rest_model.ConfigDetail, error) {

controller/internal/routes/config_router.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/config"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -68,11 +69,11 @@ func (r *ConfigRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *ConfigRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.Config, MapConfigToRestEntity)
+	ListWithHandler[*model.Config](ae, rc, ae.Managers.Config, MapConfigToRestEntity)
 }
 
 func (r *ConfigRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.Config, MapConfigToRestEntity)
+	DetailWithHandler[*model.Config](ae, rc, ae.Managers.Config, MapConfigToRestEntity)
 }
 
 func (r *ConfigRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params config.CreateConfigParams) {
@@ -86,7 +87,7 @@ func (r *ConfigRouter) Create(ae *env.AppEnv, rc *response.RequestContext, param
 		if err != nil {
 			return "", err
 		}
-		return MapCreate(ae.Managers.Config.Create, entity)
+		return MapCreate(ae.Managers.Config.Create, entity, rc)
 	})
 }
 
@@ -107,7 +108,7 @@ func (r *ConfigRouter) Update(ae *env.AppEnv, rc *response.RequestContext, param
 			return err
 		}
 
-		return ae.Managers.Config.Update(model, nil)
+		return ae.Managers.Config.Update(model, nil, rc.NewChangeContext())
 	})
 }
 
@@ -118,6 +119,6 @@ func (r *ConfigRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params
 		if err != nil {
 			return err
 		}
-		return ae.Managers.Config.Update(model, fields.FilterMaps("tags", "data"))
+		return ae.Managers.Config.Update(model, fields.FilterMaps("tags", "data"), rc.NewChangeContext())
 	})
 }

controller/internal/routes/config_type_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -78,25 +76,8 @@ func MapPatchConfigTypeToModel(id string, configType *rest_model.ConfigTypePatch
 	return ret
 }
 
-func MapConfigTypeToRestEntity(_ *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	configType, ok := e.(*model.ConfigType)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a ConfigType \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapConfigTypeToRestModel(configType)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapConfigTypeToRestEntity(_ *env.AppEnv, _ *response.RequestContext, configType *model.ConfigType) (interface{}, error) {
+	return MapConfigTypeToRestModel(configType)
 }
 
 func MapConfigTypeToRestModel(configType *model.ConfigType) (*rest_model.ConfigTypeDetail, error) {

controller/internal/routes/config_type_router.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/config"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -72,11 +73,11 @@ func (r *ConfigTypeRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *ConfigTypeRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.ConfigType, MapConfigTypeToRestEntity)
+	ListWithHandler[*model.ConfigType](ae, rc, ae.Managers.ConfigType, MapConfigTypeToRestEntity)
 }
 
 func (r *ConfigTypeRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.ConfigType, MapConfigTypeToRestEntity)
+	DetailWithHandler[*model.ConfigType](ae, rc, ae.Managers.ConfigType, MapConfigTypeToRestEntity)
 }
 
 func (r *ConfigTypeRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params config.CreateConfigTypeParams) {
@@ -88,7 +89,7 @@ func (r *ConfigTypeRouter) Create(ae *env.AppEnv, rc *response.RequestContext, p
 	}
 
 	Create(rc, rc, ConfigTypeLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.ConfigType.Create, MapCreateConfigTypeToModel(params.ConfigType))
+		return MapCreate(ae.Managers.ConfigType.Create, MapCreateConfigTypeToModel(params.ConfigType), rc)
 	})
 }
 
@@ -105,7 +106,7 @@ func (r *ConfigTypeRouter) Update(ae *env.AppEnv, rc *response.RequestContext, p
 	}
 
 	Update(rc, func(id string) error {
-		return ae.Managers.ConfigType.Update(MapUpdateConfigTypeToModel(params.ID, params.ConfigType), nil)
+		return ae.Managers.ConfigType.Update(MapUpdateConfigTypeToModel(params.ID, params.ConfigType), nil, rc.NewChangeContext())
 	})
 }
 
@@ -120,10 +121,10 @@ func (r *ConfigTypeRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, pa
 	}
 
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.ConfigType.Update(MapPatchConfigTypeToModel(params.ID, params.ConfigType), fields.FilterMaps("tags", "schema"))
+		return ae.Managers.ConfigType.Update(MapPatchConfigTypeToModel(params.ID, params.ConfigType), fields.FilterMaps("tags", "schema"), rc.NewChangeContext())
 	})
 }
 
 func (r *ConfigTypeRouter) ListConfigs(ae *env.AppEnv, rc *response.RequestContext, params config.ListConfigsForConfigTypeParams) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.ConfigType, ae.Managers.Config, MapConfigToRestEntity)
+	ListAssociationWithHandler[*model.ConfigType, *model.Config](ae, rc, ae.Managers.ConfigType, ae.Managers.Config, MapConfigToRestEntity)
 }

controller/internal/routes/current_api_session_api_model.go

@@ -17,7 +17,6 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/go-openapi/strfmt"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
@@ -79,25 +78,8 @@ func MapToCurrentApiSessionRestModel(ae *env.AppEnv, apiSession *model.ApiSessio
 	return ret
 }
 
-func MapApiSessionCertificateToRestEntity(appEnv *env.AppEnv, context *response.RequestContext, e models.Entity) (interface{}, error) {
-	i, ok := e.(*model.ApiSessionCertificate)
-
-	if !ok {
-		err := fmt.Errorf("entity is not an API Session Certificate \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	al, err := MapApiSessionCertificateToRestModel(i)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return al, nil
+func MapApiSessionCertificateToRestEntity(appEnv *env.AppEnv, context *response.RequestContext, i *model.ApiSessionCertificate) (interface{}, error) {
+	return MapApiSessionCertificateToRestModel(i)
 }
 
 func MapApiSessionCertificateToRestModel(apiSessionCert *model.ApiSessionCertificate) (*rest_model.CurrentAPISessionCertificateDetail, error) {

controller/internal/routes/current_api_session_router.go

@@ -108,7 +108,7 @@ func (router *CurrentSessionRouter) Detail(ae *env.AppEnv, rc *response.RequestC
 }
 
 func (router *CurrentSessionRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
-	err := ae.GetManagers().ApiSession.Delete(rc.ApiSession.Id)
+	err := ae.GetManagers().ApiSession.Delete(rc.ApiSession.Id, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -142,7 +142,7 @@ func (router *CurrentSessionRouter) ListCertificates(ae *env.AppEnv, rc *respons
 func (router *CurrentSessionRouter) CreateCertificate(ae *env.AppEnv, rc *response.RequestContext, params clientCurrentApiSession.CreateCurrentAPISessionCertificateParams) {
 	responder := &ApiSessionCertificateCreateResponder{ae: ae, Responder: rc}
 	CreateWithResponder(rc, responder, CurrentApiSessionCertificateLinkFactory, func() (string, error) {
-		return ae.GetManagers().ApiSessionCertificate.CreateFromCSR(rc.ApiSession.Id, 12*time.Hour, []byte(*params.SessionCertificate.Csr))
+		return ae.GetManagers().ApiSessionCertificate.CreateFromCSR(rc.ApiSession.Id, 12*time.Hour, []byte(*params.SessionCertificate.Csr), rc.NewChangeContext())
 	})
 }
 
@@ -184,7 +184,7 @@ func (router *CurrentSessionRouter) DeleteCertificate(ae *env.AppEnv, rc *respon
 		return
 	}
 
-	if err := ae.GetManagers().ApiSessionCertificate.Delete(certId); err != nil {
+	if err := ae.GetManagers().ApiSessionCertificate.Delete(certId, rc.NewChangeContext()); err != nil {
 		rc.RespondWithError(err)
 		return
 	}

controller/internal/routes/current_identity_api_model.go

@@ -139,25 +139,8 @@ func MapMfaToRestModel(ae *env.AppEnv, mfa *model.Mfa) (*rest_model.DetailMfa, e
 	return result, nil
 }
 
-func MapCurrentIdentityEdgeRouterToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	router, ok := e.(*model.EdgeRouter)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a EdgeRouter \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapCurrentIdentityEdgeRouterToRestModel(ae, router)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapCurrentIdentityEdgeRouterToRestEntity(ae *env.AppEnv, _ *response.RequestContext, router *model.EdgeRouter) (interface{}, error) {
+	return MapCurrentIdentityEdgeRouterToRestModel(ae, router)
 }
 
 func MapCurrentIdentityEdgeRouterToRestModel(ae *env.AppEnv, router *model.EdgeRouter) (*rest_model.CurrentIdentityEdgeRouterDetail, error) {

controller/internal/routes/current_identity_authenticator_router.go

@@ -113,12 +113,12 @@ func (r *CurrentIdentityAuthenticatorRouter) List(ae *env.AppEnv, rc *response.R
 			return nil, err
 		}
 
-		apiAuthenticators, err := MapAuthenticatorsToRestEntities(ae, rc, result.Authenticators)
+		apiAuthenticators, err := MapAuthenticatorsToRestEntities(ae, rc, result.Entities)
 		if err != nil {
 			return nil, err
 		}
 		for i, authenticator := range apiAuthenticators {
-			authenticator.Links = CurrentIdentityAuthenticatorLinkFactory.Links(result.Authenticators[i])
+			authenticator.Links = CurrentIdentityAuthenticatorLinkFactory.Links(result.Entities[i])
 		}
 
 		return NewQueryResult(apiAuthenticators, result.GetMetaData()), nil
@@ -150,13 +150,13 @@ func (r *CurrentIdentityAuthenticatorRouter) Detail(ae *env.AppEnv, rc *response
 
 func (r *CurrentIdentityAuthenticatorRouter) Update(ae *env.AppEnv, rc *response.RequestContext, authenticator *rest_model.AuthenticatorUpdateWithCurrent) {
 	Update(rc, func(id string) error {
-		return ae.Managers.Authenticator.UpdateSelf(MapUpdateAuthenticatorWithCurrentToModel(id, rc.Identity.Id, authenticator))
+		return ae.Managers.Authenticator.UpdateSelf(MapUpdateAuthenticatorWithCurrentToModel(id, rc.Identity.Id, authenticator), rc.NewChangeContext())
 	})
 }
 
 func (r *CurrentIdentityAuthenticatorRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, authenticator *rest_model.AuthenticatorPatchWithCurrent) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.Authenticator.PatchSelf(MapPatchAuthenticatorWithCurrentToModel(id, rc.Identity.Id, authenticator), fields.FilterMaps("tags"))
+		return ae.Managers.Authenticator.PatchSelf(MapPatchAuthenticatorWithCurrentToModel(id, rc.Identity.Id, authenticator), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
@@ -206,7 +206,7 @@ func (r *CurrentIdentityAuthenticatorRouter) Extend(ae *env.AppEnv, rc *response
 		return
 	}
 
-	certPem, err := ae.Managers.Authenticator.ExtendCertForIdentity(rc.Identity.Id, authId, peerCerts, *extend.ClientCertCsr)
+	certPem, err := ae.Managers.Authenticator.ExtendCertForIdentity(rc.Identity.Id, authId, peerCerts, *extend.ClientCertCsr, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -226,7 +226,7 @@ func (r *CurrentIdentityAuthenticatorRouter) ExtendVerify(ae *env.AppEnv, rc *re
 		return
 	}
 
-	err = ae.Managers.Authenticator.VerifyExtendCertForIdentity(rc.ApiSession.Id, rc.Identity.Id, authId, *extend.ClientCert)
+	err = ae.Managers.Authenticator.VerifyExtendCertForIdentity(rc.ApiSession.Id, rc.Identity.Id, authId, *extend.ClientCert, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)

controller/internal/routes/current_identity_router.go

@@ -25,6 +25,7 @@ import (
 	"github.com/openziti/edge/controller/apierror"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/foundation/v2/errorz"
@@ -164,8 +165,9 @@ func (r *CurrentIdentityRouter) verifyMfa(ae *env.AppEnv, rc *response.RequestCo
 	}
 
 	if ok {
+		changeCtx := rc.NewChangeContext()
 		mfa.IsVerified = true
-		if err := ae.Managers.Mfa.Update(mfa, nil); err != nil {
+		if err := ae.Managers.Mfa.Update(mfa, nil, changeCtx); err != nil {
 			pfxlog.Logger().Errorf("could not update MFA with new MFA status: %v", err)
 			rc.RespondWithApiError(errorz.NewUnhandled(errors.New("could not update MFA status")))
 			return
@@ -174,7 +176,7 @@ func (r *CurrentIdentityRouter) verifyMfa(ae *env.AppEnv, rc *response.RequestCo
 		rc.ApiSession.MfaComplete = true
 		rc.ApiSession.MfaRequired = true
 
-		if err := ae.Managers.ApiSession.UpdateWithFieldChecker(rc.ApiSession, boltz.MapFieldChecker{persistence.FieldApiSessionMfaComplete: struct{}{}, persistence.FieldApiSessionMfaRequired: struct{}{}}); err != nil {
+		if err := ae.Managers.ApiSession.UpdateWithFieldChecker(rc.ApiSession, boltz.MapFieldChecker{persistence.FieldApiSessionMfaComplete: struct{}{}, persistence.FieldApiSessionMfaRequired: struct{}{}}, changeCtx); err != nil {
 			pfxlog.Logger().Errorf("could not update API Session with new MFA status: %v", err)
 		}
 
@@ -189,7 +191,7 @@ func (r *CurrentIdentityRouter) verifyMfa(ae *env.AppEnv, rc *response.RequestCo
 }
 
 func (r *CurrentIdentityRouter) createMfa(ae *env.AppEnv, rc *response.RequestContext) {
-	id, err := ae.Managers.Mfa.CreateForIdentity(rc.Identity)
+	id, err := ae.Managers.Mfa.CreateForIdentity(rc.Identity, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -227,7 +229,7 @@ func (r *CurrentIdentityRouter) removeMfa(ae *env.AppEnv, rc *response.RequestCo
 		code = *mfaCodeHeader
 	}
 
-	err := ae.Managers.Mfa.DeleteForIdentity(rc.Identity, code)
+	err := ae.Managers.Mfa.DeleteForIdentity(rc.Identity, code, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -287,14 +289,15 @@ func (r *CurrentIdentityRouter) createMfaRecoveryCodes(ae *env.AppEnv, rc *respo
 		return
 	}
 
-	ok, _ := ae.Managers.Mfa.Verify(mfa, *body.Code)
+	changeCtx := rc.NewChangeContext()
+	ok, _ := ae.Managers.Mfa.Verify(mfa, *body.Code, changeCtx)
 
 	if !ok {
 		rc.RespondWithError(apierror.NewInvalidMfaTokenError())
 		return
 	}
 
-	if err := ae.Managers.Mfa.RecreateRecoveryCodes(mfa); err != nil {
+	if err := ae.Managers.Mfa.RecreateRecoveryCodes(mfa, changeCtx); err != nil {
 		rc.RespondWithError(err)
 		return
 	}
@@ -352,11 +355,11 @@ func (r *CurrentIdentityRouter) listEdgeRouters(ae *env.AppEnv, rc *response.Req
 	if rc.Identity.IsAdmin {
 		filterTemplate := `isVerified = true`
 		rc.SetEntityId(rc.Identity.Id)
-		ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapCurrentIdentityEdgeRouterToRestEntity)
+		ListAssociationsWithFilter[*model.EdgeRouter](ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapCurrentIdentityEdgeRouterToRestEntity)
 	} else {
 		filterTemplate := `isVerified = true and not isEmpty(from edgeRouterPolicies where anyOf(identities) = "%v")`
 		rc.SetEntityId(rc.Identity.Id)
-		ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapCurrentIdentityEdgeRouterToRestEntity)
+		ListAssociationsWithFilter[*model.EdgeRouter](ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapCurrentIdentityEdgeRouterToRestEntity)
 	}
 }
 

controller/internal/routes/database_router.go

@@ -91,7 +91,7 @@ func (r *DatabaseRouter) CreateSnapshot(ae *env.AppEnv, rc *response.RequestCont
 func (r *DatabaseRouter) CheckDatastoreIntegrity(ae *env.AppEnv, rc *response.RequestContext, fixErrors bool) {
 	if r.integrityCheck.running.CompareAndSwap(false, true) {
 		r.integrityCheck.fixingErrors = fixErrors
-		go r.runDataIntegrityCheck(ae, fixErrors)
+		go r.runDataIntegrityCheck(ae, rc, fixErrors)
 		rc.Respond(&rest_model.Empty{Data: map[string]interface{}{}, Meta: &rest_model.Meta{}}, http.StatusAccepted)
 	} else {
 		rc.RespondWithApiError(apierror.NewRateLimited())
@@ -139,7 +139,7 @@ func (r *DatabaseRouter) GetCheckProgress(rc *response.RequestContext) {
 	rc.Respond(result, http.StatusOK)
 }
 
-func (r *DatabaseRouter) runDataIntegrityCheck(ae *env.AppEnv, fixErrors bool) {
+func (r *DatabaseRouter) runDataIntegrityCheck(ae *env.AppEnv, rc *response.RequestContext, fixErrors bool) {
 	defer func() {
 		r.integrityCheck.lock.Lock()
 		now := time.Now()
@@ -176,5 +176,5 @@ func (r *DatabaseRouter) runDataIntegrityCheck(ae *env.AppEnv, fixErrors bool) {
 		}
 	}
 
-	r.integrityCheck.err = ae.GetDbProvider().GetStores().CheckIntegrity(ae.GetDbProvider().GetDb(), fixErrors, errorHandler)
+	r.integrityCheck.err = ae.GetDbProvider().GetStores().CheckIntegrity(ae.GetDbProvider().GetDb(), rc.NewChangeContext().GetContext(), fixErrors, errorHandler)
 }

controller/internal/routes/edge_router_api_model.go

@@ -17,7 +17,6 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/openziti/foundation/v2/versions"
 
 	"strings"
@@ -107,25 +106,8 @@ func MapPatchEdgeRouterToModel(id string, router *rest_model.EdgeRouterPatch) *m
 	return ret
 }
 
-func MapEdgeRouterToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	router, ok := e.(*model.EdgeRouter)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a EdgeRouter \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapEdgeRouterToRestModel(ae, router)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapEdgeRouterToRestEntity(ae *env.AppEnv, _ *response.RequestContext, router *model.EdgeRouter) (interface{}, error) {
+	return MapEdgeRouterToRestModel(ae, router)
 }
 
 func MapVersionInfoToRestModel(versionInfo versions.VersionInfo) *rest_model.VersionInfo {

controller/internal/routes/edge_router_policy_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -102,25 +100,8 @@ func MapPatchEdgeRouterPolicyToModel(id string, policy *rest_model.EdgeRouterPol
 	return ret
 }
 
-func MapEdgeRouterPolicyToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	policy, ok := e.(*model.EdgeRouterPolicy)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a EdgeRouterPolicy \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapEdgeRouterPolicyToRestModel(ae, policy)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapEdgeRouterPolicyToRestEntity(ae *env.AppEnv, _ *response.RequestContext, policy *model.EdgeRouterPolicy) (interface{}, error) {
+	return MapEdgeRouterPolicyToRestModel(ae, policy)
 }
 
 func MapEdgeRouterPolicyToRestModel(ae *env.AppEnv, policy *model.EdgeRouterPolicy) (*rest_model.EdgeRouterPolicyDetail, error) {

controller/internal/routes/edge_router_policy_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/edge_router_policy"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -77,16 +78,16 @@ func (r *EdgeRouterPolicyRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *EdgeRouterPolicyRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
+	ListWithHandler[*model.EdgeRouterPolicy](ae, rc, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
 }
 
 func (r *EdgeRouterPolicyRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
+	DetailWithHandler[*model.EdgeRouterPolicy](ae, rc, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
 }
 
 func (r *EdgeRouterPolicyRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params edge_router_policy.CreateEdgeRouterPolicyParams) {
 	Create(rc, rc, EdgeRouterPolicyLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.EdgeRouterPolicy.Create, MapCreateEdgeRouterPolicyToModel(params.Policy))
+		return MapCreate(ae.Managers.EdgeRouterPolicy.Create, MapCreateEdgeRouterPolicyToModel(params.Policy), rc)
 	})
 }
 
@@ -96,20 +97,20 @@ func (r *EdgeRouterPolicyRouter) Delete(ae *env.AppEnv, rc *response.RequestCont
 
 func (r *EdgeRouterPolicyRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params edge_router_policy.UpdateEdgeRouterPolicyParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.EdgeRouterPolicy.Update(MapUpdateEdgeRouterPolicyToModel(params.ID, params.Policy), nil)
+		return ae.Managers.EdgeRouterPolicy.Update(MapUpdateEdgeRouterPolicyToModel(params.ID, params.Policy), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *EdgeRouterPolicyRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params edge_router_policy.PatchEdgeRouterPolicyParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.EdgeRouterPolicy.Update(MapPatchEdgeRouterPolicyToModel(params.ID, params.Policy), fields.FilterMaps("tags"))
+		return ae.Managers.EdgeRouterPolicy.Update(MapPatchEdgeRouterPolicyToModel(params.ID, params.Policy), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
 func (r *EdgeRouterPolicyRouter) ListEdgeRouters(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.EdgeRouterPolicy, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
+	ListAssociationWithHandler[*model.EdgeRouterPolicy, *model.EdgeRouter](ae, rc, ae.Managers.EdgeRouterPolicy, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
 }
 
 func (r *EdgeRouterPolicyRouter) ListIdentities(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.EdgeRouterPolicy, ae.Managers.Identity, MapIdentityToRestEntity)
+	ListAssociationWithHandler[*model.EdgeRouterPolicy, *model.Identity](ae, rc, ae.Managers.EdgeRouterPolicy, ae.Managers.Identity, MapIdentityToRestEntity)
 }

controller/internal/routes/edge_router_router.go

@@ -98,7 +98,7 @@ func (r *EdgeRouterRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
 	roleSemantic := rc.Request.URL.Query().Get("roleSemantic")
 
 	if len(roleFilters) > 0 {
-		ListWithQueryF(ae, rc, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity, func(query ast.Query) (*models.EntityListResult[models.Entity], error) {
+		ListWithQueryF[*model.EdgeRouter](ae, rc, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity, func(query ast.Query) (*models.EntityListResult[*model.EdgeRouter], error) {
 			cursorProvider, err := ae.GetStores().EdgeRouter.GetRoleAttributesCursorProvider(roleFilters, roleSemantic)
 			if err != nil {
 				return nil, err
@@ -106,17 +106,17 @@ func (r *EdgeRouterRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
 			return ae.Managers.EdgeRouter.BasePreparedListIndexed(cursorProvider, query)
 		})
 	} else {
-		ListWithHandler(ae, rc, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
+		ListWithHandler[*model.EdgeRouter](ae, rc, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
 	}
 }
 
 func (r *EdgeRouterRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
+	DetailWithHandler[*model.EdgeRouter](ae, rc, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
 }
 
 func (r *EdgeRouterRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params edge_router.CreateEdgeRouterParams) {
 	Create(rc, rc, EdgeRouterLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.EdgeRouter.Create, MapCreateEdgeRouterToModel(params.EdgeRouter))
+		return MapCreate(ae.Managers.EdgeRouter.Create, MapCreateEdgeRouterToModel(params.EdgeRouter), rc)
 	})
 }
 
@@ -126,32 +126,32 @@ func (r *EdgeRouterRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *EdgeRouterRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params edge_router.UpdateEdgeRouterParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.EdgeRouter.Update(MapUpdateEdgeRouterToModel(params.ID, params.EdgeRouter), false, nil)
+		return ae.Managers.EdgeRouter.Update(MapUpdateEdgeRouterToModel(params.ID, params.EdgeRouter), false, nil, rc.NewChangeContext())
 	})
 }
 
 func (r *EdgeRouterRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params edge_router.PatchEdgeRouterParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.EdgeRouter.Update(MapPatchEdgeRouterToModel(params.ID, params.EdgeRouter), false, fields.FilterMaps("tags"))
+		return ae.Managers.EdgeRouter.Update(MapPatchEdgeRouterToModel(params.ID, params.EdgeRouter), false, fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
 func (r *EdgeRouterRouter) listServiceEdgeRouterPolicies(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.EdgeRouter, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
+	ListAssociationWithHandler[*model.EdgeRouter, *model.ServiceEdgeRouterPolicy](ae, rc, ae.Managers.EdgeRouter, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
 }
 
 func (r *EdgeRouterRouter) listEdgeRouterPolicies(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.EdgeRouter, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
+	ListAssociationWithHandler[*model.EdgeRouter, *model.EdgeRouterPolicy](ae, rc, ae.Managers.EdgeRouter, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
 }
 
 func (r *EdgeRouterRouter) listIdentities(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from edgeRouterPolicies where anyOf(routers) = "%v")`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.Identity, MapIdentityToRestEntity)
+	ListAssociationsWithFilter[*model.Identity](ae, rc, filterTemplate, ae.Managers.Identity, MapIdentityToRestEntity)
 }
 
 func (r *EdgeRouterRouter) listServices(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from serviceEdgeRouterPolicies where anyOf(routers) = "%v")`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.EdgeService, MapServiceToRestEntity)
+	ListAssociationsWithFilter[*model.ServiceDetail](ae, rc, filterTemplate, ae.Managers.EdgeService.GetDetailLister(), MapServiceToRestEntity)
 }
 
 func (r *EdgeRouterRouter) ReEnroll(ae *env.AppEnv, rc *response.RequestContext) {
@@ -170,7 +170,7 @@ func (r *EdgeRouterRouter) ReEnroll(ae *env.AppEnv, rc *response.RequestContext)
 		return
 	}
 
-	if err := ae.GetManagers().EdgeRouter.ReEnroll(router); err != nil {
+	if err := ae.GetManagers().EdgeRouter.ReEnroll(router, rc.NewChangeContext()); err != nil {
 		rc.RespondWithApiError(apierror.NewEdgeRouterFailedReEnrollment(err))
 		return
 	}

controller/internal/routes/enroll_router.go

@@ -131,7 +131,7 @@ func (ro *EnrollRouter) getCaCerts(ae *env.AppEnv, rc *response.RequestContext)
 func (ro *EnrollRouter) enrollHandler(ae *env.AppEnv, rc *response.RequestContext) {
 
 	enrollContext := &model.EnrollmentContextHttp{}
-	err := enrollContext.FillFromHttpRequest(rc.Request)
+	err := enrollContext.FillFromHttpRequest(rc.Request, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -221,8 +221,11 @@ func (ro *EnrollRouter) extendRouterEnrollment(ae *env.AppEnv, rc *response.Requ
 		return
 	}
 
+	certCsr := []byte(*params.RouterExtendEnrollmentRequest.CertCsr)
+	serverCertCsr := []byte(*params.RouterExtendEnrollmentRequest.ServerCertCsr)
+
 	if edgeRouter, _ := ae.Managers.EdgeRouter.ReadOneByFingerprint(fingerprint); edgeRouter != nil {
-		certs, err := ae.Managers.EdgeRouter.ExtendEnrollment(edgeRouter, []byte(*params.RouterExtendEnrollmentRequest.CertCsr), []byte(*params.RouterExtendEnrollmentRequest.ServerCertCsr))
+		certs, err := ae.Managers.EdgeRouter.ExtendEnrollment(edgeRouter, certCsr, serverCertCsr, rc.NewChangeContext())
 
 		if err != nil {
 			rc.RespondWithError(err)
@@ -251,7 +254,7 @@ func (ro *EnrollRouter) extendRouterEnrollment(ae *env.AppEnv, rc *response.Requ
 	}
 
 	if router, _ := ae.Managers.TransitRouter.ReadOneByFingerprint(fingerprint); router != nil {
-		certs, err := ae.Managers.TransitRouter.ExtendEnrollment(router, []byte(*params.RouterExtendEnrollmentRequest.CertCsr), []byte(*params.RouterExtendEnrollmentRequest.ServerCertCsr))
+		certs, err := ae.Managers.TransitRouter.ExtendEnrollment(router, certCsr, serverCertCsr, rc.NewChangeContext())
 
 		if err != nil {
 			rc.RespondWithError(err)

controller/internal/routes/enrollment_api_model.go

@@ -17,14 +17,11 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/go-openapi/strfmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
-	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/foundation/v2/stringz"
 )
 
@@ -32,25 +29,8 @@ const EntityNameEnrollment = "enrollments"
 
 var EnrollmentLinkFactory = NewBasicLinkFactory(EntityNameEnrollment)
 
-func MapEnrollmentToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	enrollment, ok := e.(*model.Enrollment)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Enrollment \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapEnrollmentToRestModel(ae, enrollment)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapEnrollmentToRestEntity(ae *env.AppEnv, _ *response.RequestContext, enrollment *model.Enrollment) (interface{}, error) {
+	return MapEnrollmentToRestModel(ae, enrollment)
 }
 
 func MapEnrollmentToRestModel(ae *env.AppEnv, enrollment *model.Enrollment) (*rest_model.EnrollmentDetail, error) {

controller/internal/routes/enrollment_router.go

@@ -44,7 +44,6 @@ func NewEnrollmentRouter() *EnrollmentRouter {
 }
 
 func (r *EnrollmentRouter) Register(ae *env.AppEnv) {
-
 	ae.ManagementApi.EnrollmentDeleteEnrollmentHandler = enrollment.DeleteEnrollmentHandlerFunc(func(params enrollment.DeleteEnrollmentParams, _ interface{}) middleware.Responder {
 		return ae.IsAllowed(r.Delete, params.HTTPRequest, params.ID, "", permissions.IsAdmin())
 	})
@@ -71,11 +70,11 @@ func (r *EnrollmentRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *EnrollmentRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.Enrollment, MapEnrollmentToRestEntity)
+	ListWithHandler[*model.Enrollment](ae, rc, ae.Managers.Enrollment, MapEnrollmentToRestEntity)
 }
 
 func (r *EnrollmentRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.Enrollment, MapEnrollmentToRestEntity)
+	DetailWithHandler[*model.Enrollment](ae, rc, ae.Managers.Enrollment, MapEnrollmentToRestEntity)
 }
 
 func (r *EnrollmentRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
@@ -95,7 +94,7 @@ func (r *EnrollmentRouter) Refresh(ae *env.AppEnv, rc *response.RequestContext,
 		return
 	}
 
-	if err := ae.Managers.Enrollment.RefreshJwt(id, time.Time(*params.Refresh.ExpiresAt)); err != nil {
+	if err := ae.Managers.Enrollment.RefreshJwt(id, time.Time(*params.Refresh.ExpiresAt), rc.NewChangeContext()); err != nil {
 		if fe, ok := err.(*errorz.FieldError); ok {
 			rc.RespondWithFieldError(fe)
 			return
@@ -109,7 +108,7 @@ func (r *EnrollmentRouter) Refresh(ae *env.AppEnv, rc *response.RequestContext,
 
 func (r *EnrollmentRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params enrollment.CreateEnrollmentParams) {
 	Create(rc, rc, EnrollmentLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.Enrollment.Create, MapCreateEnrollmentToModel(params.Enrollment))
+		return MapCreate(ae.Managers.Enrollment.Create, MapCreateEnrollmentToModel(params.Enrollment), rc)
 	})
 
 }

controller/internal/routes/external_jwt_signer_api_model.go

@@ -17,9 +17,7 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/go-openapi/strfmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -32,19 +30,8 @@ const EntityNameExternalJwtSigner = "external-jwt-signers"
 
 var ExternalJwtSignerLinkFactory = NewBasicLinkFactory(EntityNameExternalJwtSigner)
 
-func MapExternalJwtSignerToRestEntity(_ *env.AppEnv, _ *response.RequestContext, ExternalJwtSignerModel models.Entity) (interface{}, error) {
-	externalJwtSigner, ok := ExternalJwtSignerModel.(*model.ExternalJwtSigner)
-
-	if !ok {
-		err := fmt.Errorf("entity is not an identity type \"%s\"", ExternalJwtSignerModel.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel := MapExternalJwtSignerToRestModel(externalJwtSigner)
-
-	return restModel, nil
+func MapExternalJwtSignerToRestEntity(_ *env.AppEnv, _ *response.RequestContext, externalJwtSigner *model.ExternalJwtSigner) (interface{}, error) {
+	return MapExternalJwtSignerToRestModel(externalJwtSigner), nil
 }
 
 func MapClientExtJwtSignersToRestEntity(_ *env.AppEnv, _ *response.RequestContext, signers []*model.ExternalJwtSigner) ([]*rest_model.ClientExternalJWTSignerDetail, error) {

controller/internal/routes/external_jwt_signer_router.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/external_jwt_signer"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
@@ -44,7 +45,6 @@ func NewExternalJwtSignerRouter() *ExternalJwtSignerRouter {
 
 func (r *ExternalJwtSignerRouter) Register(ae *env.AppEnv) {
 	// client
-
 	ae.ManagementApi.ExternalJWTSignerListExternalJWTSignersHandler = external_jwt_signer.ListExternalJWTSignersHandlerFunc(func(params external_jwt_signer.ListExternalJWTSignersParams, _ interface{}) middleware.Responder {
 		return ae.IsAllowed(r.ListClient, params.HTTPRequest, "", "", permissions.Always())
 	})
@@ -76,16 +76,16 @@ func (r *ExternalJwtSignerRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *ExternalJwtSignerRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.ExternalJwtSigner, MapExternalJwtSignerToRestEntity)
+	ListWithHandler[*model.ExternalJwtSigner](ae, rc, ae.Managers.ExternalJwtSigner, MapExternalJwtSignerToRestEntity)
 }
 
 func (r *ExternalJwtSignerRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.ExternalJwtSigner, MapExternalJwtSignerToRestEntity)
+	DetailWithHandler[*model.ExternalJwtSigner](ae, rc, ae.Managers.ExternalJwtSigner, MapExternalJwtSignerToRestEntity)
 }
 
 func (r *ExternalJwtSignerRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params external_jwt_signer.CreateExternalJWTSignerParams) {
 	Create(rc, rc, ExternalJwtSignerLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.ExternalJwtSigner.Create, MapCreateExternalJwtSignerToModel(params.ExternalJWTSigner))
+		return MapCreate(ae.Managers.ExternalJwtSigner.Create, MapCreateExternalJwtSignerToModel(params.ExternalJWTSigner), rc)
 	})
 }
 
@@ -95,7 +95,7 @@ func (r *ExternalJwtSignerRouter) Delete(ae *env.AppEnv, rc *response.RequestCon
 
 func (r *ExternalJwtSignerRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params external_jwt_signer.UpdateExternalJWTSignerParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.ExternalJwtSigner.Update(MapUpdateExternalJwtSignerToModel(params.ID, params.ExternalJWTSigner), nil)
+		return ae.Managers.ExternalJwtSigner.Update(MapUpdateExternalJwtSignerToModel(params.ID, params.ExternalJWTSigner), nil, rc.NewChangeContext())
 	})
 }
 
@@ -109,13 +109,13 @@ func (r *ExternalJwtSignerRouter) Patch(ae *env.AppEnv, rc *response.RequestCont
 			fields.AddField(persistence.FieldExternalJwtSignerFingerprint)
 		}
 
-		return ae.Managers.ExternalJwtSigner.Update(MapPatchExternalJwtSignerToModel(params.ID, params.ExternalJWTSigner), fields.FilterMaps("tags", "data"))
+		externalJwtSigner := MapPatchExternalJwtSignerToModel(params.ID, params.ExternalJWTSigner)
+		return ae.Managers.ExternalJwtSigner.Update(externalJwtSigner, fields.FilterMaps("tags", "data"), rc.NewChangeContext())
 	})
 }
 
 func (r *ExternalJwtSignerRouter) ListClient(ae *env.AppEnv, rc *response.RequestContext) {
 	List(rc, func(rc *response.RequestContext, queryOptions *PublicQueryOptions) (*QueryResult, error) {
-
 		query, err := queryOptions.getFullQuery(ae.Managers.EdgeService.GetStore())
 		if err != nil {
 			return nil, err

controller/internal/routes/identity_api_model.go

@@ -204,25 +204,8 @@ func MapPatchIdentityToModel(id string, identity *rest_model.IdentityPatch, iden
 	return ret
 }
 
-func MapIdentityToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	identity, ok := e.(*model.Identity)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Identity \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapIdentityToRestModel(ae, identity)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapIdentityToRestEntity(ae *env.AppEnv, _ *response.RequestContext, entity *model.Identity) (interface{}, error) {
+	return MapIdentityToRestModel(ae, entity)
 }
 
 func MapIdentityToRestModel(ae *env.AppEnv, identity *model.Identity) (*rest_model.IdentityDetail, error) {

controller/internal/routes/identity_router.go

@@ -174,7 +174,7 @@ func (r *IdentityRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
 	roleSemantic := rc.Request.URL.Query().Get("roleSemantic")
 
 	if len(roleFilters) > 0 {
-		ListWithQueryF(ae, rc, ae.Managers.EdgeRouter, MapIdentityToRestEntity, func(query ast.Query) (*models.EntityListResult[models.Entity], error) {
+		ListWithQueryF[*model.Identity](ae, rc, ae.Managers.Identity, MapIdentityToRestEntity, func(query ast.Query) (*models.EntityListResult[*model.Identity], error) {
 			cursorProvider, err := ae.GetStores().Identity.GetRoleAttributesCursorProvider(roleFilters, roleSemantic)
 			if err != nil {
 				return nil, err
@@ -182,12 +182,12 @@ func (r *IdentityRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
 			return ae.Managers.Identity.BasePreparedListIndexed(cursorProvider, query)
 		})
 	} else {
-		ListWithHandler(ae, rc, ae.Managers.Identity, MapIdentityToRestEntity)
+		ListWithHandler[*model.Identity](ae, rc, ae.Managers.Identity, MapIdentityToRestEntity)
 	}
 }
 
 func (r *IdentityRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.Identity, MapIdentityToRestEntity)
+	DetailWithHandler[*model.Identity](ae, rc, ae.Managers.Identity, MapIdentityToRestEntity)
 }
 
 func getIdentityTypeId(ae *env.AppEnv, identityType rest_model.IdentityType) string {
@@ -203,7 +203,7 @@ func getIdentityTypeId(ae *env.AppEnv, identityType rest_model.IdentityType) str
 func (r *IdentityRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params identity.CreateIdentityParams) {
 	Create(rc, rc, IdentityLinkFactory, func() (string, error) {
 		identityModel, enrollments := MapCreateIdentityToModel(params.Identity, getIdentityTypeId(ae, *params.Identity.Type))
-		err := ae.Managers.Identity.CreateWithEnrollments(identityModel, enrollments)
+		err := ae.Managers.Identity.CreateWithEnrollments(identityModel, enrollments, rc.NewChangeContext())
 		if err != nil {
 			return "", err
 		}
@@ -217,43 +217,43 @@ func (r *IdentityRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *IdentityRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params identity.UpdateIdentityParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.Identity.Update(MapUpdateIdentityToModel(params.ID, params.Identity, getIdentityTypeId(ae, *params.Identity.Type)), nil)
+		return ae.Managers.Identity.Update(MapUpdateIdentityToModel(params.ID, params.Identity, getIdentityTypeId(ae, *params.Identity.Type)), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *IdentityRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params identity.PatchIdentityParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
 		fields = fields.FilterMaps(boltz.FieldTags, persistence.FieldIdentityAppData, persistence.FieldIdentityServiceHostingCosts, persistence.FieldIdentityServiceHostingPrecedences)
-		return ae.Managers.Identity.Update(MapPatchIdentityToModel(params.ID, params.Identity, getIdentityTypeId(ae, params.Identity.Type)), fields)
+		return ae.Managers.Identity.Update(MapPatchIdentityToModel(params.ID, params.Identity, getIdentityTypeId(ae, params.Identity.Type)), fields, rc.NewChangeContext())
 	})
 }
 
 func (r *IdentityRouter) listEdgeRouterPolicies(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.Identity, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
+	ListAssociationWithHandler[*model.Identity, *model.EdgeRouterPolicy](ae, rc, ae.Managers.Identity, ae.Managers.EdgeRouterPolicy, MapEdgeRouterPolicyToRestEntity)
 }
 
 func (r *IdentityRouter) listServicePolicies(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.Identity, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
+	ListAssociationWithHandler[*model.Identity, *model.ServicePolicy](ae, rc, ae.Managers.Identity, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
 }
 
 func (r *IdentityRouter) listServices(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from servicePolicies where anyOf(identities) = "%v")`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.EdgeService, MapServiceToRestEntity)
+	ListAssociationsWithFilter[*model.ServiceDetail](ae, rc, filterTemplate, ae.Managers.EdgeService.GetDetailLister(), MapServiceToRestEntity)
 }
 
 func (r *IdentityRouter) listAuthenticators(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `identity = "%v"`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.Authenticator, MapAuthenticatorToRestEntity)
+	ListAssociationsWithFilter[*model.Authenticator](ae, rc, filterTemplate, ae.Managers.Authenticator, MapAuthenticatorToRestEntity)
 }
 
 func (r *IdentityRouter) listEnrollments(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `identity = "%v"`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.Enrollment, MapEnrollmentToRestEntity)
+	ListAssociationsWithFilter[*model.Enrollment](ae, rc, filterTemplate, ae.Managers.Enrollment, MapEnrollmentToRestEntity)
 }
 
 func (r *IdentityRouter) listEdgeRouters(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from edgeRouterPolicies where anyOf(identities) = "%v")`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
+	ListAssociationsWithFilter[*model.EdgeRouter](ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
 }
 
 func (r *IdentityRouter) listServiceConfigs(ae *env.AppEnv, rc *response.RequestContext) {
@@ -293,7 +293,7 @@ func (r *IdentityRouter) assignServiceConfigs(ae *env.AppEnv, rc *response.Reque
 		for _, serviceConfig := range params.ServiceConfigs {
 			modelServiceConfigs = append(modelServiceConfigs, MapServiceConfigToModel(*serviceConfig))
 		}
-		return ae.Managers.Identity.AssignServiceConfigs(id, modelServiceConfigs)
+		return ae.Managers.Identity.AssignServiceConfigs(id, modelServiceConfigs, rc.NewChangeContext())
 	})
 }
 
@@ -303,7 +303,7 @@ func (r *IdentityRouter) removeServiceConfigs(ae *env.AppEnv, rc *response.Reque
 		for _, serviceConfig := range params.ServiceConfigIDPairs {
 			modelServiceConfigs = append(modelServiceConfigs, MapServiceConfigToModel(*serviceConfig))
 		}
-		return ae.Managers.Identity.RemoveServiceConfigs(id, modelServiceConfigs)
+		return ae.Managers.Identity.RemoveServiceConfigs(id, modelServiceConfigs, rc.NewChangeContext())
 	})
 }
 
@@ -362,7 +362,7 @@ func (r *IdentityRouter) getPostureDataFailedServiceRequests(ae *env.AppEnv, rc
 
 func (r *IdentityRouter) removeMfa(ae *env.AppEnv, rc *response.RequestContext) {
 	id, _ := rc.GetEntityId()
-	err := ae.Managers.Mfa.DeleteAllForIdentity(id)
+	err := ae.Managers.Mfa.DeleteAllForIdentity(id, rc.NewChangeContext())
 
 	if err != nil {
 		rc.RespondWithError(err)
@@ -420,7 +420,7 @@ func (r *IdentityRouter) updateTracing(ae *env.AppEnv, rc *response.RequestConte
 }
 
 func (r *IdentityRouter) Enable(ae *env.AppEnv, rc *response.RequestContext, params identity.EnableIdentityParams) {
-	if err := ae.Managers.Identity.Enable(params.ID); err != nil {
+	if err := ae.Managers.Identity.Enable(params.ID, rc.NewChangeContext()); err != nil {
 		rc.RespondWithError(err)
 		return
 	}
@@ -429,7 +429,7 @@ func (r *IdentityRouter) Enable(ae *env.AppEnv, rc *response.RequestContext, par
 }
 
 func (r *IdentityRouter) Disable(ae *env.AppEnv, rc *response.RequestContext, params identity.DisableIdentityParams) {
-	if err := ae.Managers.Identity.Disable(params.ID, time.Duration(*params.Disable.DurationMinutes)*time.Minute); err != nil {
+	if err := ae.Managers.Identity.Disable(params.ID, time.Duration(*params.Disable.DurationMinutes)*time.Minute, rc.NewChangeContext()); err != nil {
 		rc.RespondWithError(err)
 		return
 	}

controller/internal/routes/identity_type_api_model.go

@@ -17,32 +17,18 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
-	"github.com/openziti/fabric/controller/models"
 )
 
 const EntityNameIdentityType = "identity-types"
 
 var IdentityTypeLinkFactory = NewBasicLinkFactory(EntityNameIdentityType)
 
-func MapIdentityTypeToRestEntity(_ *env.AppEnv, _ *response.RequestContext, identityTypeModel models.Entity) (interface{}, error) {
-	identityType, ok := identityTypeModel.(*model.IdentityType)
-
-	if !ok {
-		err := fmt.Errorf("entity is not an identity type \"%s\"", identityTypeModel.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel := MapIdentityTypeToRestModel(identityType)
-
-	return restModel, nil
+func MapIdentityTypeToRestEntity(_ *env.AppEnv, _ *response.RequestContext, identityType *model.IdentityType) (interface{}, error) {
+	return MapIdentityTypeToRestModel(identityType), nil
 }
 
 func MapIdentityTypeToRestModel(identityType *model.IdentityType) *rest_model.IdentityTypeDetail {

controller/internal/routes/identity_type_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/identity"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 )
 
@@ -51,9 +52,9 @@ func (r *IdentityTypeRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *IdentityTypeRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.IdentityType, MapIdentityTypeToRestEntity)
+	ListWithHandler[*model.IdentityType](ae, rc, ae.Managers.IdentityType, MapIdentityTypeToRestEntity)
 }
 
 func (r *IdentityTypeRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.IdentityType, MapIdentityTypeToRestEntity)
+	DetailWithHandler[*model.IdentityType](ae, rc, ae.Managers.IdentityType, MapIdentityTypeToRestEntity)
 }

controller/internal/routes/posture_check_api_model.go

@@ -17,7 +17,6 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/go-openapi/strfmt"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
@@ -283,25 +282,8 @@ func MapPostureChecksToRestEntity(ae *env.AppEnv, rc *response.RequestContext, e
 	return restModel, nil
 }
 
-func MapPostureCheckToRestEntity(ae *env.AppEnv, rc *response.RequestContext, e models.Entity) (interface{}, error) {
-	i, ok := e.(*model.PostureCheck)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Posture Check \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	al, err := MapPostureCheckToRestModel(ae, rc, i)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return al, nil
+func MapPostureCheckToRestEntity(ae *env.AppEnv, rc *response.RequestContext, i *model.PostureCheck) (interface{}, error) {
+	return MapPostureCheckToRestModel(ae, rc, i)
 }
 
 func MapPostureCheckToRestModel(ae *env.AppEnv, rc *response.RequestContext, i *model.PostureCheck) (rest_model.PostureCheckDetail, error) {

controller/internal/routes/posture_check_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/posture_checks"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
@@ -113,12 +114,12 @@ func (r *PostureCheckRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
 }
 
 func (r *PostureCheckRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.PostureCheck, MapPostureCheckToRestEntity)
+	DetailWithHandler[*model.PostureCheck](ae, rc, ae.Managers.PostureCheck, MapPostureCheckToRestEntity)
 }
 
 func (r *PostureCheckRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params posture_checks.CreatePostureCheckParams) {
 	Create(rc, rc, PostureCheckLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.PostureCheck.Create, MapCreatePostureCheckToModel(params.PostureCheck))
+		return MapCreate(ae.Managers.PostureCheck.Create, MapCreatePostureCheckToModel(params.PostureCheck), rc)
 	})
 }
 
@@ -128,7 +129,7 @@ func (r *PostureCheckRouter) Delete(ae *env.AppEnv, rc *response.RequestContext)
 
 func (r *PostureCheckRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params posture_checks.UpdatePostureCheckParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.PostureCheck.Update(MapUpdatePostureCheckToModel(params.ID, params.PostureCheck), nil)
+		return ae.Managers.PostureCheck.Update(MapUpdatePostureCheckToModel(params.ID, params.PostureCheck), nil, rc.NewChangeContext())
 	})
 }
 
@@ -163,6 +164,6 @@ func (r *PostureCheckRouter) Patch(ae *env.AppEnv, rc *response.RequestContext,
 			fields.AddField(persistence.FieldPostureCheckProcessMultiHashes)
 		}
 
-		return ae.Managers.PostureCheck.Update(check, fields.FilterMaps("tags"))
+		return ae.Managers.PostureCheck.Update(check, fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }

controller/internal/routes/posture_check_type_api_model.go

@@ -17,36 +17,21 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
-	"github.com/openziti/fabric/controller/models"
 )
 
 const EntityNamePostureCheckType = "posture-check-types"
 
 var PostureCheckTypeLinkFactory = NewBasicLinkFactory(EntityNamePostureCheckType)
 
-func MapPostureCheckTypeToRestEntity(_ *env.AppEnv, _ *response.RequestContext, postureCheckTypeModel models.Entity) (interface{}, error) {
-	postureCheckType, ok := postureCheckTypeModel.(*model.PostureCheckType)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a posture check type \"%s\"", postureCheckTypeModel.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel := MapPostureCheckTypeToRestModel(postureCheckType)
-
-	return restModel, nil
+func MapPostureCheckTypeToRestEntity(_ *env.AppEnv, _ *response.RequestContext, postureCheckType *model.PostureCheckType) (interface{}, error) {
+	return MapPostureCheckTypeToRestModel(postureCheckType), nil
 }
 
 func MapPostureCheckTypeToRestModel(postureCheckType *model.PostureCheckType) *rest_model.PostureCheckTypeDetail {
-
 	operatingSystems := []*rest_model.OperatingSystem{}
 
 	for _, os := range postureCheckType.OperatingSystems {

controller/internal/routes/posture_check_type_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/posture_checks"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 )
 
@@ -52,9 +53,9 @@ func (r *PostureCheckTypeRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *PostureCheckTypeRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.PostureCheckType, MapPostureCheckTypeToRestEntity)
+	ListWithHandler[*model.PostureCheckType](ae, rc, ae.Managers.PostureCheckType, MapPostureCheckTypeToRestEntity)
 }
 
 func (r *PostureCheckTypeRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.PostureCheckType, MapPostureCheckTypeToRestEntity)
+	DetailWithHandler[*model.PostureCheckType](ae, rc, ae.Managers.PostureCheckType, MapPostureCheckTypeToRestEntity)
 }

controller/internal/routes/query_options.go

@@ -25,7 +25,7 @@ import (
 )
 
 const (
-	LimitMax      = 500
+	LimitMax = 500
 )
 
 // PublicQueryOptions represents external query options, which limits some query options (i.e. return all vs max limit). PublicQueryOptions
@@ -43,7 +43,7 @@ func (qo *PublicQueryOptions) String() string {
 	return fmt.Sprintf("[QueryOption Predicate: '%v', Sort: '%v', Paging: '%v']", qo.Predicate, qo.Sort, qo.Paging)
 }
 
-func (qo *PublicQueryOptions) getFullQuery(store boltz.ListStore) (ast.Query, error) {
+func (qo *PublicQueryOptions) getFullQuery(store boltz.Store) (ast.Query, error) {
 	if qo.Predicate == "" {
 		qo.Predicate = "true"
 	}

controller/internal/routes/router_api_model.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	"github.com/go-openapi/strfmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -58,25 +57,8 @@ func MapPatchTransitRouterToModel(id string, router *rest_model.RouterPatch) *mo
 	return ret
 }
 
-func MapTransitRouterToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	router, ok := e.(*model.TransitRouter)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a TransitRouter \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapTransitRouterToRestModel(ae, router)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapTransitRouterToRestEntity(ae *env.AppEnv, _ *response.RequestContext, router *model.TransitRouter) (interface{}, error) {
+	return MapTransitRouterToRestModel(ae, router)
 }
 
 func MapTransitRouterToRestModel(ae *env.AppEnv, router *model.TransitRouter) (*rest_model.RouterDetail, error) {

controller/internal/routes/router_router.go

@@ -22,6 +22,7 @@ import (
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -94,16 +95,16 @@ func (r *TransitRouterRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *TransitRouterRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.TransitRouter, MapTransitRouterToRestEntity)
+	ListWithHandler[*model.TransitRouter](ae, rc, ae.Managers.TransitRouter, MapTransitRouterToRestEntity)
 }
 
 func (r *TransitRouterRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.TransitRouter, MapTransitRouterToRestEntity)
+	DetailWithHandler[*model.TransitRouter](ae, rc, ae.Managers.TransitRouter, MapTransitRouterToRestEntity)
 }
 
 func (r *TransitRouterRouter) Create(ae *env.AppEnv, rc *response.RequestContext, router *rest_model.RouterCreate) {
 	Create(rc, rc, TransitRouterLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.TransitRouter.Create, MapCreateRouterToModel(router))
+		return MapCreate(ae.Managers.TransitRouter.Create, MapCreateRouterToModel(router), rc)
 	})
 }
 
@@ -113,12 +114,12 @@ func (r *TransitRouterRouter) Delete(ae *env.AppEnv, rc *response.RequestContext
 
 func (r *TransitRouterRouter) Update(ae *env.AppEnv, rc *response.RequestContext, routerId string, router *rest_model.RouterUpdate) {
 	Update(rc, func(id string) error {
-		return ae.Managers.TransitRouter.Update(MapUpdateTransitRouterToModel(routerId, router), false, nil)
+		return ae.Managers.TransitRouter.Update(MapUpdateTransitRouterToModel(routerId, router), false, nil, rc.NewChangeContext())
 	})
 }
 
 func (r *TransitRouterRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, routerId string, router *rest_model.RouterPatch) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.TransitRouter.Update(MapPatchTransitRouterToModel(routerId, router), false, fields.FilterMaps("tags"))
+		return ae.Managers.TransitRouter.Update(MapPatchTransitRouterToModel(routerId, router), false, fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }

controller/internal/routes/service_api_model.go

@@ -17,7 +17,6 @@
 package routes
 
 import (
-	"fmt"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
@@ -100,25 +99,8 @@ func MapPatchServiceToModel(id string, service *rest_model.ServicePatch) *model.
 	return ret
 }
 
-func MapServiceToRestEntity(ae *env.AppEnv, rc *response.RequestContext, e models.Entity) (interface{}, error) {
-	service, ok := e.(*model.ServiceDetail)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Service \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapServiceToRestModel(ae, rc, service)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapServiceToRestEntity(ae *env.AppEnv, rc *response.RequestContext, service *model.ServiceDetail) (interface{}, error) {
+	return MapServiceToRestModel(ae, rc, service)
 }
 
 func MapServicesToRestEntity(ae *env.AppEnv, rc *response.RequestContext, es []*model.ServiceDetail) ([]interface{}, error) {

controller/internal/routes/service_edge_router_policy_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -102,25 +100,8 @@ func MapPatchServiceEdgeRouterPolicyToModel(id string, policy *rest_model.Servic
 	return ret
 }
 
-func MapServiceEdgeRouterPolicyToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	policy, ok := e.(*model.ServiceEdgeRouterPolicy)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a ServiceEdgeRouterPolicy \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapServiceEdgeRouterPolicyToRestModel(ae, policy)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapServiceEdgeRouterPolicyToRestEntity(ae *env.AppEnv, _ *response.RequestContext, policy *model.ServiceEdgeRouterPolicy) (interface{}, error) {
+	return MapServiceEdgeRouterPolicyToRestModel(ae, policy)
 }
 
 func MapServiceEdgeRouterPolicyToRestModel(ae *env.AppEnv, policy *model.ServiceEdgeRouterPolicy) (*rest_model.ServiceEdgeRouterPolicyDetail, error) {

controller/internal/routes/service_edge_router_policy_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/service_edge_router_policy"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -77,16 +78,16 @@ func (r *ServiceEdgeRouterPolicyRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *ServiceEdgeRouterPolicyRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
+	ListWithHandler[*model.ServiceEdgeRouterPolicy](ae, rc, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
 }
 
 func (r *ServiceEdgeRouterPolicyRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
+	DetailWithHandler[*model.ServiceEdgeRouterPolicy](ae, rc, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
 }
 
 func (r *ServiceEdgeRouterPolicyRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params service_edge_router_policy.CreateServiceEdgeRouterPolicyParams) {
 	Create(rc, rc, ServiceEdgeRouterPolicyLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.ServiceEdgeRouterPolicy.Create, MapCreateServiceEdgeRouterPolicyToModel(params.Policy))
+		return MapCreate(ae.Managers.ServiceEdgeRouterPolicy.Create, MapCreateServiceEdgeRouterPolicyToModel(params.Policy), rc)
 	})
 }
 
@@ -96,20 +97,20 @@ func (r *ServiceEdgeRouterPolicyRouter) Delete(ae *env.AppEnv, rc *response.Requ
 
 func (r *ServiceEdgeRouterPolicyRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params service_edge_router_policy.UpdateServiceEdgeRouterPolicyParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.ServiceEdgeRouterPolicy.Update(MapUpdateServiceEdgeRouterPolicyToModel(params.ID, params.Policy), nil)
+		return ae.Managers.ServiceEdgeRouterPolicy.Update(MapUpdateServiceEdgeRouterPolicyToModel(params.ID, params.Policy), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *ServiceEdgeRouterPolicyRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params service_edge_router_policy.PatchServiceEdgeRouterPolicyParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.ServiceEdgeRouterPolicy.Update(MapPatchServiceEdgeRouterPolicyToModel(params.ID, params.Policy), fields.FilterMaps("tags"))
+		return ae.Managers.ServiceEdgeRouterPolicy.Update(MapPatchServiceEdgeRouterPolicyToModel(params.ID, params.Policy), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
 func (r *ServiceEdgeRouterPolicyRouter) ListEdgeRouters(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.ServiceEdgeRouterPolicy, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
+	ListAssociationWithHandler[*model.ServiceEdgeRouterPolicy, *model.EdgeRouter](ae, rc, ae.Managers.ServiceEdgeRouterPolicy, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
 }
 
 func (r *ServiceEdgeRouterPolicyRouter) ListServices(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.ServiceEdgeRouterPolicy, ae.Managers.EdgeService, MapServiceToRestEntity)
+	ListAssociationWithHandler[*model.ServiceEdgeRouterPolicy, *model.ServiceDetail](ae, rc, ae.Managers.ServiceEdgeRouterPolicy, ae.Managers.EdgeService.GetDetailLister(), MapServiceToRestEntity)
 }

controller/internal/routes/service_policy_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
@@ -110,28 +108,11 @@ func MapPatchServicePolicyToModel(id string, policy *rest_model.ServicePolicyPat
 	return ret
 }
 
-func MapServicePolicyToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	policy, ok := e.(*model.ServicePolicy)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a ServicePolicy \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapServicePolicyToRestModel(ae, policy)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapServicePolicyToRestEntity(ae *env.AppEnv, _ *response.RequestContext, policy *model.ServicePolicy) (interface{}, error) {
+	return MapServicePolicyToRestModel(ae, policy), nil
 }
 
-func MapServicePolicyToRestModel(ae *env.AppEnv, policy *model.ServicePolicy) (*rest_model.ServicePolicyDetail, error) {
+func MapServicePolicyToRestModel(ae *env.AppEnv, policy *model.ServicePolicy) *rest_model.ServicePolicyDetail {
 	semantic := rest_model.Semantic(policy.Semantic)
 	dialBindType := rest_model.DialBind(policy.PolicyType)
 
@@ -148,5 +129,5 @@ func MapServicePolicyToRestModel(ae *env.AppEnv, policy *model.ServicePolicy) (*
 		PostureCheckRolesDisplay: GetNamedPostureCheckRoles(ae.GetManagers().PostureCheck, policy.PostureCheckRoles),
 	}
 
-	return ret, nil
+	return ret
 }

controller/internal/routes/service_policy_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_server/operations/service_policy"
 	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/internal/permissions"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/fabric/controller/fields"
 )
@@ -81,16 +82,16 @@ func (r *ServicePolicyRouter) Register(ae *env.AppEnv) {
 }
 
 func (r *ServicePolicyRouter) List(ae *env.AppEnv, rc *response.RequestContext) {
-	ListWithHandler(ae, rc, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
+	ListWithHandler[*model.ServicePolicy](ae, rc, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
 }
 
 func (r *ServicePolicyRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
-	DetailWithHandler(ae, rc, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
+	DetailWithHandler[*model.ServicePolicy](ae, rc, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
 }
 
 func (r *ServicePolicyRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params service_policy.CreateServicePolicyParams) {
 	Create(rc, rc, ServicePolicyLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.ServicePolicy.Create, MapCreateServicePolicyToModel(params.Policy))
+		return MapCreate(ae.Managers.ServicePolicy.Create, MapCreateServicePolicyToModel(params.Policy), rc)
 	})
 }
 
@@ -100,24 +101,24 @@ func (r *ServicePolicyRouter) Delete(ae *env.AppEnv, rc *response.RequestContext
 
 func (r *ServicePolicyRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params service_policy.UpdateServicePolicyParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.ServicePolicy.Update(MapUpdateServicePolicyToModel(params.ID, params.Policy), nil)
+		return ae.Managers.ServicePolicy.Update(MapUpdateServicePolicyToModel(params.ID, params.Policy), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *ServicePolicyRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params service_policy.PatchServicePolicyParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.ServicePolicy.Update(MapPatchServicePolicyToModel(params.ID, params.Policy), fields.FilterMaps("tags"))
+		return ae.Managers.ServicePolicy.Update(MapPatchServicePolicyToModel(params.ID, params.Policy), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
 func (r *ServicePolicyRouter) ListServices(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.ServicePolicy, ae.Managers.EdgeService, MapServiceToRestEntity)
+	ListAssociationWithHandler[*model.ServicePolicy, *model.ServiceDetail](ae, rc, ae.Managers.ServicePolicy, ae.Managers.EdgeService.GetDetailLister(), MapServiceToRestEntity)
 }
 
 func (r *ServicePolicyRouter) ListIdentities(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.ServicePolicy, ae.Managers.Identity, MapIdentityToRestEntity)
+	ListAssociationWithHandler[*model.ServicePolicy, *model.Identity](ae, rc, ae.Managers.ServicePolicy, ae.Managers.Identity, MapIdentityToRestEntity)
 }
 
 func (r *ServicePolicyRouter) ListPostureChecks(ae *env.AppEnv, rc *response.RequestContext) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.ServicePolicy, ae.Managers.PostureCheck, MapPostureCheckToRestEntity)
+	ListAssociationWithHandler[*model.ServicePolicy, *model.PostureCheck](ae, rc, ae.Managers.ServicePolicy, ae.Managers.PostureCheck, MapPostureCheckToRestEntity)
 }

controller/internal/routes/service_router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/michaelquigley/pfxlog"
 	clientService "github.com/openziti/edge-api/rest_client_api_server/operations/service"
 	managementService "github.com/openziti/edge-api/rest_management_api_server/operations/service"
+	"github.com/openziti/edge/controller/model"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/metrics"
@@ -154,7 +155,7 @@ func (r *ServiceRouter) ListManagementServices(ae *env.AppEnv, rc *response.Requ
 				return nil, err
 			}
 
-			result, err := ae.Managers.EdgeService.BasePreparedListIndexed(cursorProvider, query)
+			result, err := ae.Managers.EdgeService.GetDetailLister().BasePreparedListIndexed(cursorProvider, query)
 
 			if err != nil {
 				return nil, err
@@ -228,7 +229,7 @@ func (r *ServiceRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *ServiceRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params managementService.CreateServiceParams) {
 	Create(rc, rc, ServiceLinkFactory, func() (string, error) {
-		return MapCreate(ae.Managers.EdgeService.Create, MapCreateServiceToModel(params.Service))
+		return MapCreate(ae.Managers.EdgeService.Create, MapCreateServiceToModel(params.Service), rc)
 	})
 }
 
@@ -238,26 +239,26 @@ func (r *ServiceRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *ServiceRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params managementService.UpdateServiceParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.EdgeService.Update(MapUpdateServiceToModel(params.ID, params.Service), nil)
+		return ae.Managers.EdgeService.Update(MapUpdateServiceToModel(params.ID, params.Service), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *ServiceRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params managementService.PatchServiceParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.EdgeService.Update(MapPatchServiceToModel(params.ID, params.Service), fields.FilterMaps("tags"))
+		return ae.Managers.EdgeService.Update(MapPatchServiceToModel(params.ID, params.Service), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }
 
 func (r *ServiceRouter) listServiceEdgeRouterPolicies(ae *env.AppEnv, rc *response.RequestContext) {
-	r.listAssociations(ae, rc, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
+	ListAssociationWithHandler[*model.Service, *model.ServiceEdgeRouterPolicy](ae, rc, ae.Managers.EdgeService, ae.Managers.ServiceEdgeRouterPolicy, MapServiceEdgeRouterPolicyToRestEntity)
 }
 
 func (r *ServiceRouter) listServicePolicies(ae *env.AppEnv, rc *response.RequestContext) {
-	r.listAssociations(ae, rc, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
+	ListAssociationWithHandler[*model.Service, *model.ServicePolicy](ae, rc, ae.Managers.EdgeService, ae.Managers.ServicePolicy, MapServicePolicyToRestEntity)
 }
 
 func (r *ServiceRouter) listConfigs(ae *env.AppEnv, rc *response.RequestContext) {
-	r.listAssociations(ae, rc, ae.Managers.Config, MapConfigToRestEntity)
+	ListAssociationWithHandler[*model.Service, *model.Config](ae, rc, ae.Managers.EdgeService, ae.Managers.Config, MapConfigToRestEntity)
 }
 
 func (r *ServiceRouter) listManagementTerminators(ae *env.AppEnv, rc *response.RequestContext) {
@@ -291,16 +292,12 @@ func (r *ServiceRouter) listClientTerminators(ae *env.AppEnv, rc *response.Reque
 	ListTerminatorAssociations(ae, rc, ae.Managers.EdgeService, ae.Managers.Terminator, MapClientTerminatorToRestEntity)
 }
 
-func (r *ServiceRouter) listAssociations(ae *env.AppEnv, rc *response.RequestContext, associationLoader models.EntityRetriever[models.Entity], mapper ModelToApiMapper) {
-	ListAssociationWithHandler(ae, rc, ae.Managers.EdgeService, associationLoader, mapper)
-}
-
 func (r *ServiceRouter) listIdentities(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from servicePolicies where anyOf(services) = "%v")`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.Identity, MapIdentityToRestEntity)
+	ListAssociationsWithFilter[*model.Identity](ae, rc, filterTemplate, ae.Managers.Identity, MapIdentityToRestEntity)
 }
 
 func (r *ServiceRouter) listEdgeRouters(ae *env.AppEnv, rc *response.RequestContext) {
 	filterTemplate := `not isEmpty(from serviceEdgeRouterPolicies where anyOf(services) = "%v")`
-	ListAssociationsWithFilter(ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
+	ListAssociationsWithFilter[*model.EdgeRouter](ae, rc, filterTemplate, ae.Managers.EdgeRouter, MapEdgeRouterToRestEntity)
 }

controller/internal/routes/session_api_model.go

@@ -17,8 +17,6 @@
 package routes
 
 import (
-	"fmt"
-
 	"github.com/google/uuid"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge-api/rest_model"
@@ -65,25 +63,8 @@ func MapCreateSessionToModel(identityId, apiSessionId string, session *rest_mode
 	return ret
 }
 
-func MapSessionToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	session, ok := e.(*model.Session)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Session \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapSessionToRestModel(ae, session)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapSessionToRestEntity(ae *env.AppEnv, _ *response.RequestContext, session *model.Session) (interface{}, error) {
+	return MapSessionToRestModel(ae, session)
 }
 
 func MapSessionToRestModel(ae *env.AppEnv, sessionModel *model.Session) (*rest_model.SessionManagementDetail, error) {

controller/internal/routes/session_router.go

@@ -117,7 +117,7 @@ func (r *SessionRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *SessionRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 	Delete(rc, func(rc *response.RequestContext, id string) error {
-		return ae.Managers.Session.DeleteForIdentity(id, rc.ApiSession.IdentityId)
+		return ae.Managers.Session.DeleteForIdentity(id, rc.ApiSession.IdentityId, rc.NewChangeContext())
 	})
 }
 
@@ -125,7 +125,7 @@ func (r *SessionRouter) Create(ae *env.AppEnv, rc *response.RequestContext, para
 	start := time.Now()
 	responder := &SessionRequestResponder{ae: ae, Responder: rc}
 	CreateWithResponder(rc, responder, SessionLinkFactory, func() (string, error) {
-		return ae.Managers.Session.Create(MapCreateSessionToModel(rc.Identity.Id, rc.ApiSession.Id, params.Session))
+		return ae.Managers.Session.Create(MapCreateSessionToModel(rc.Identity.Id, rc.ApiSession.Id, params.Session), rc.NewChangeContext())
 	})
 	r.createTimer.UpdateSince(start)
 }

controller/internal/routes/terminator_api_model.go

@@ -108,25 +108,8 @@ func (TerminatorModelMapper) ToApi(n *network.Network, _ api.RequestContext, ter
 	return restModel, nil
 }
 
-func MapTerminatorToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	terminator, ok := e.(*network.Terminator)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Terminator \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapTerminatorToRestModel(ae.GetHostController().GetNetwork(), terminator)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapTerminatorToRestEntity(ae *env.AppEnv, _ *response.RequestContext, terminator *network.Terminator) (interface{}, error) {
+	return MapTerminatorToRestModel(ae.GetHostController().GetNetwork(), terminator)
 }
 
 func MapTerminatorToRestModel(n *network.Network, terminator *network.Terminator) (*rest_model.TerminatorDetail, error) {
@@ -172,25 +155,8 @@ func MapTerminatorToRestModel(n *network.Network, terminator *network.Terminator
 	return ret, nil
 }
 
-func MapClientTerminatorToRestEntity(ae *env.AppEnv, _ *response.RequestContext, e models.Entity) (interface{}, error) {
-	terminator, ok := e.(*network.Terminator)
-
-	if !ok {
-		err := fmt.Errorf("entity is not a Terminator \"%s\"", e.GetId())
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-
-	restModel, err := MapLimitedTerminatorToRestModel(ae, terminator)
-
-	if err != nil {
-		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
-		log := pfxlog.Logger()
-		log.Error(err)
-		return nil, err
-	}
-	return restModel, nil
+func MapClientTerminatorToRestEntity(ae *env.AppEnv, _ *response.RequestContext, terminator *network.Terminator) (interface{}, error) {
+	return MapLimitedTerminatorToRestModel(ae, terminator)
 }
 
 func MapLimitedTerminatorToRestModel(ae *env.AppEnv, terminator *network.Terminator) (*rest_model.TerminatorClientDetail, error) {

controller/internal/routes/terminator_router.go

@@ -79,7 +79,7 @@ func (r *TerminatorRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
 func (r *TerminatorRouter) Create(ae *env.AppEnv, rc *response.RequestContext, params terminator.CreateTerminatorParams) {
 	Create(rc, rc, TerminatorLinkFactory, func() (string, error) {
 		entity := MapCreateTerminatorToModel(params.Terminator)
-		err := ae.Managers.Terminator.Create(entity)
+		err := ae.Managers.Terminator.Create(entity, rc.NewChangeContext())
 		if err != nil {
 			return "", err
 		}
@@ -93,12 +93,12 @@ func (r *TerminatorRouter) Delete(ae *env.AppEnv, rc *response.RequestContext) {
 
 func (r *TerminatorRouter) Update(ae *env.AppEnv, rc *response.RequestContext, params terminator.UpdateTerminatorParams) {
 	Update(rc, func(id string) error {
-		return ae.Managers.Terminator.Update(MapUpdateTerminatorToModel(params.ID, params.Terminator), nil)
+		return ae.Managers.Terminator.Update(MapUpdateTerminatorToModel(params.ID, params.Terminator), nil, rc.NewChangeContext())
 	})
 }
 
 func (r *TerminatorRouter) Patch(ae *env.AppEnv, rc *response.RequestContext, params terminator.PatchTerminatorParams) {
 	Patch(rc, func(id string, fields fields.UpdatedFields) error {
-		return ae.Managers.Terminator.Update(MapPatchTerminatorToModel(params.ID, params.Terminator), fields.FilterMaps("tags"))
+		return ae.Managers.Terminator.Update(MapPatchTerminatorToModel(params.ID, params.Terminator), fields.FilterMaps("tags"), rc.NewChangeContext())
 	})
 }

controller/model/api_session_certificate_manager.go

@@ -20,7 +20,9 @@ import (
 	"crypto/x509"
 	"fmt"
 	"github.com/openziti/edge/controller/apierror"
+	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/models"
 	"go.etcd.io/bbolt"
 	"time"
@@ -28,7 +30,7 @@ import (
 
 func NewApiSessionCertificateManager(env Env) *ApiSessionCertificateManager {
 	manager := &ApiSessionCertificateManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().ApiSessionCertificate),
+		baseEntityManager: newBaseEntityManager[*ApiSessionCertificate, *persistence.ApiSessionCertificate](env, env.GetStores().ApiSessionCertificate),
 	}
 	manager.impl = manager
 
@@ -36,18 +38,18 @@ func NewApiSessionCertificateManager(env Env) *ApiSessionCertificateManager {
 }
 
 type ApiSessionCertificateManager struct {
-	baseEntityManager
+	baseEntityManager[*ApiSessionCertificate, *persistence.ApiSessionCertificate]
 }
 
-func (self *ApiSessionCertificateManager) newModelEntity() edgeEntity {
+func (self *ApiSessionCertificateManager) newModelEntity() *ApiSessionCertificate {
 	return &ApiSessionCertificate{}
 }
 
-func (self *ApiSessionCertificateManager) Create(entity *ApiSessionCertificate) (string, error) {
-	return self.createEntity(entity)
+func (self *ApiSessionCertificateManager) Create(entity *ApiSessionCertificate, ctx *change.Context) (string, error) {
+	return self.createEntity(entity, ctx.NewMutateContext())
 }
 
-func (self *ApiSessionCertificateManager) CreateFromCSR(apiSessionId string, lifespan time.Duration, csrPem []byte) (string, error) {
+func (self *ApiSessionCertificateManager) CreateFromCSR(apiSessionId string, lifespan time.Duration, csrPem []byte, ctx *change.Context) (string, error) {
 	notBefore := time.Now()
 	notAfter := time.Now().Add(lifespan)
 
@@ -88,31 +90,15 @@ func (self *ApiSessionCertificateManager) CreateFromCSR(apiSessionId string, lif
 		PEM:          string(certPem),
 	}
 
-	return self.Create(entity)
-}
-
-func (self *ApiSessionCertificateManager) Read(id string) (*ApiSessionCertificate, error) {
-	modelApiSessionCertificate := &ApiSessionCertificate{}
-	if err := self.readEntity(id, modelApiSessionCertificate); err != nil {
-		return nil, err
-	}
-	return modelApiSessionCertificate, nil
-}
-
-func (self *ApiSessionCertificateManager) readInTx(tx *bbolt.Tx, id string) (*ApiSessionCertificate, error) {
-	modelApiSessionCertificate := &ApiSessionCertificate{}
-	if err := self.readEntityInTx(tx, id, modelApiSessionCertificate); err != nil {
-		return nil, err
-	}
-	return modelApiSessionCertificate, nil
+	return self.Create(entity, ctx)
 }
 
 func (self *ApiSessionCertificateManager) IsUpdated(_ string) bool {
 	return false
 }
 
-func (self *ApiSessionCertificateManager) Delete(id string) error {
-	return self.deleteEntity(id)
+func (self *ApiSessionCertificateManager) Delete(id string, ctx *change.Context) error {
+	return self.deleteEntity(id, ctx)
 }
 
 func (self *ApiSessionCertificateManager) Query(tx *bbolt.Tx, query string) (*ApiSessionCertificateListResult, error) {

controller/model/api_session_certificate_model.go

@@ -23,9 +23,7 @@ import (
 	"github.com/openziti/foundation/v2/errorz"
 	nfpem "github.com/openziti/foundation/v2/pem"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
-	"reflect"
 	"time"
 )
 
@@ -53,8 +51,8 @@ func NewApiSessionCertificate(cert *x509.Certificate) *ApiSessionCertificate {
 	return ret
 }
 
-func (entity *ApiSessionCertificate) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
-	if !manager.GetEnv().GetStores().ApiSession.IsEntityPresent(tx, entity.ApiSessionId) {
+func (entity *ApiSessionCertificate) toBoltEntity(tx *bbolt.Tx, env Env) (*persistence.ApiSessionCertificate, error) {
+	if !env.GetStores().ApiSession.IsEntityPresent(tx, entity.ApiSessionId) {
 		return nil, errorz.NewFieldError("api session not found", "ApiSessionId", entity.ApiSessionId)
 	}
 
@@ -71,20 +69,15 @@ func (entity *ApiSessionCertificate) toBoltEntity(tx *bbolt.Tx, manager EntityMa
 	return boltEntity, nil
 }
 
-func (entity *ApiSessionCertificate) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *ApiSessionCertificate) toBoltEntityForCreate(tx *bbolt.Tx, env Env) (*persistence.ApiSessionCertificate, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *ApiSessionCertificate) toBoltEntityForUpdate(tx *bbolt.Tx, manager EntityManager, checker boltz.FieldChecker) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *ApiSessionCertificate) toBoltEntityForUpdate(tx *bbolt.Tx, env Env, _ boltz.FieldChecker) (*persistence.ApiSessionCertificate, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *ApiSessionCertificate) fillFrom(manager EntityManager, tx *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltApiSessionCertificate, ok := boltEntity.(*persistence.ApiSessionCertificate)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model ApiSessionCertificate", reflect.TypeOf(boltEntity))
-	}
-
+func (entity *ApiSessionCertificate) fillFrom(env Env, tx *bbolt.Tx, boltApiSessionCertificate *persistence.ApiSessionCertificate) error {
 	entity.FillCommon(boltApiSessionCertificate)
 	entity.Subject = boltApiSessionCertificate.Subject
 	entity.Fingerprint = boltApiSessionCertificate.Fingerprint
@@ -93,12 +86,12 @@ func (entity *ApiSessionCertificate) fillFrom(manager EntityManager, tx *bbolt.T
 	entity.PEM = boltApiSessionCertificate.PEM
 	entity.ApiSessionId = boltApiSessionCertificate.ApiSessionId
 
-	boltApiSession, err := manager.GetEnv().GetStores().ApiSession.LoadOneById(tx, boltApiSessionCertificate.ApiSessionId)
+	boltApiSession, err := env.GetStores().ApiSession.LoadOneById(tx, boltApiSessionCertificate.ApiSessionId)
 	if err != nil {
 		return err
 	}
 	modelApiSession := &ApiSession{}
-	if err := modelApiSession.fillFrom(manager, tx, boltApiSession); err != nil {
+	if err := modelApiSession.fillFrom(env, tx, boltApiSession); err != nil {
 		return err
 	}
 	entity.ApiSession = modelApiSession

controller/model/api_session_heartbeats.go

@@ -18,7 +18,6 @@ package model
 
 import (
 	"github.com/michaelquigley/pfxlog"
-	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/storage/boltz"
 	cmap "github.com/orcaman/concurrent-map/v2"
 	"sync/atomic"
@@ -52,7 +51,7 @@ func NewHeartbeatCollector(env Env, batchSize int, updateInterval time.Duration,
 		closeNotify:                 make(chan struct{}),
 	}
 
-	env.GetStores().ApiSession.AddListener(boltz.EventDelete, collector.onApiSessionDelete)
+	env.GetStores().ApiSession.AddEntityIdListener(collector.Remove, boltz.EntityDeleted)
 
 	collector.Start()
 
@@ -142,15 +141,6 @@ func (self *HeartbeatCollector) flush() {
 	}
 }
 
-func (self *HeartbeatCollector) onApiSessionDelete(i ...interface{}) {
-	if len(i) > 0 {
-		apiSession := i[0].(*persistence.ApiSession)
-		if apiSession != nil && apiSession.Id != "" {
-			self.Remove(apiSession.Id)
-		}
-	}
-}
-
 func (self *HeartbeatCollector) Remove(id string) {
 	self.apiSessionLastAccessedAtMap.Remove(id)
 }

controller/model/api_session_manager.go

@@ -21,6 +21,7 @@ import (
 	"github.com/lucsky/cuid"
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge/controller/persistence"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/storage/ast"
 	"github.com/openziti/storage/boltz"
@@ -31,7 +32,7 @@ import (
 
 func NewApiSessionManager(env Env) *ApiSessionManager {
 	manager := &ApiSessionManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().ApiSession),
+		baseEntityManager: newBaseEntityManager[*ApiSession, *persistence.ApiSession](env, env.GetStores().ApiSession),
 	}
 
 	manager.HeartbeatCollector = NewHeartbeatCollector(env, env.GetConfig().Api.ActivityUpdateBatchSize, env.GetConfig().Api.ActivityUpdateInterval, manager.heartbeatFlush)
@@ -42,30 +43,25 @@ func NewApiSessionManager(env Env) *ApiSessionManager {
 }
 
 type ApiSessionManager struct {
-	baseEntityManager
+	baseEntityManager[*ApiSession, *persistence.ApiSession]
 	HeartbeatCollector *HeartbeatCollector
 }
 
-func (self *ApiSessionManager) newModelEntity() edgeEntity {
+func (self *ApiSessionManager) newModelEntity() *ApiSession {
 	return &ApiSession{}
 }
 
 func (self *ApiSessionManager) Create(ctx boltz.MutateContext, entity *ApiSession, sessionCerts []*ApiSessionCertificate) (string, error) {
-	if ctx == nil {
-		var apiSessionId string
-		err := self.env.GetDbProvider().GetDb().Update(func(tx *bbolt.Tx) error {
-			ctx = boltz.NewMutateContext(tx)
-			var err error
-			apiSessionId, err = self.CreateInCtx(ctx, entity, sessionCerts)
-			return err
-		})
-		if err != nil {
-			return "", err
-		}
-		return apiSessionId, nil
+	var apiSessionId string
+	err := self.env.GetDbProvider().GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
+		var err error
+		apiSessionId, err = self.CreateInCtx(ctx, entity, sessionCerts)
+		return err
+	})
+	if err != nil {
+		return "", err
 	}
-
-	return self.CreateInCtx(ctx, entity, sessionCerts)
+	return apiSessionId, nil
 }
 
 func (self *ApiSessionManager) CreateInCtx(ctx boltz.MutateContext, entity *ApiSession, sessionCerts []*ApiSessionCertificate) (string, error) {
@@ -117,25 +113,25 @@ func (self *ApiSessionManager) IsUpdated(_ string) bool {
 	return false
 }
 
-func (self *ApiSessionManager) Update(apiSession *ApiSession) error {
-	return self.updateEntity(apiSession, self)
+func (self *ApiSessionManager) Update(apiSession *ApiSession, ctx *change.Context) error {
+	return self.updateEntity(apiSession, self, ctx.NewMutateContext())
 }
 
-func (self *ApiSessionManager) UpdateWithFieldChecker(apiSession *ApiSession, fieldChecker boltz.FieldChecker) error {
-	return self.updateEntity(apiSession, fieldChecker)
+func (self *ApiSessionManager) UpdateWithFieldChecker(apiSession *ApiSession, fieldChecker boltz.FieldChecker, ctx *change.Context) error {
+	return self.updateEntity(apiSession, fieldChecker, ctx.NewMutateContext())
 }
 
-func (self *ApiSessionManager) MfaCompleted(apiSession *ApiSession) error {
+func (self *ApiSessionManager) MfaCompleted(apiSession *ApiSession, ctx *change.Context) error {
 	apiSession.MfaComplete = true
-	return self.updateEntity(apiSession, &OrFieldChecker{NewFieldChecker(persistence.FieldApiSessionMfaComplete), self})
+	return self.updateEntity(apiSession, &OrFieldChecker{NewFieldChecker(persistence.FieldApiSessionMfaComplete), self}, ctx.NewMutateContext())
 }
 
-func (self *ApiSessionManager) Delete(id string) error {
-	return self.deleteEntity(id)
+func (self *ApiSessionManager) Delete(id string, ctx *change.Context) error {
+	return self.deleteEntity(id, ctx)
 }
 
-func (self *ApiSessionManager) DeleteBatch(id []string) error {
-	return self.deleteEntityBatch(id)
+func (self *ApiSessionManager) DeleteBatch(id []string, ctx *change.Context) error {
+	return self.deleteEntityBatch(id, ctx)
 }
 
 func (self *ApiSessionManager) MarkActivityById(apiSessionId string) {
@@ -173,12 +169,12 @@ func (self *ApiSessionManager) MarkActivityByTokens(tokens ...string) ([]string,
 }
 
 func (self *ApiSessionManager) heartbeatFlush(beats []*Heartbeat) {
-	err := self.GetDb().Batch(func(tx *bbolt.Tx) error {
+	changeCtx := change.New().SetSource("heartbeat.flush").SetChangeAuthorType("controller")
+	err := self.GetDb().Batch(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
 		store := self.Store.(persistence.ApiSessionStore)
-		mutCtx := boltz.NewMutateContext(tx)
 
 		for _, beat := range beats {
-			err := store.Update(mutCtx, &persistence.ApiSession{
+			err := store.Update(ctx, &persistence.ApiSession{
 				BaseExtEntity: boltz.BaseExtEntity{
 					Id: beat.ApiSessionId,
 				},
@@ -279,10 +275,10 @@ func (self *ApiSessionManager) VisitFingerprintsForApiSession(tx *bbolt.Tx, iden
 	return nil
 }
 
-func (self *ApiSessionManager) DeleteByIdentityId(identityId string) error {
-	return self.GetEnv().GetDbProvider().GetDb().Update(func(tx *bbolt.Tx) error {
+func (self *ApiSessionManager) DeleteByIdentityId(identityId string, changeCtx *change.Context) error {
+	return self.GetEnv().GetDbProvider().GetDb().Update(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
 		query := fmt.Sprintf(`%s = "%s"`, persistence.FieldApiSessionIdentity, identityId)
-		return self.Store.DeleteWhere(boltz.NewMutateContext(tx), query)
+		return self.Store.DeleteWhere(ctx, query)
 	})
 }
 

controller/model/api_session_model.go

@@ -22,9 +22,7 @@ import (
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/foundation/v2/stringz"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
-	"reflect"
 	"time"
 )
 
@@ -43,8 +41,8 @@ type ApiSession struct {
 	AuthenticatorId    string
 }
 
-func (entity *ApiSession) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
-	if !manager.GetEnv().GetStores().Identity.IsEntityPresent(tx, entity.IdentityId) {
+func (entity *ApiSession) toBoltEntity(tx *bbolt.Tx, env Env) (*persistence.ApiSession, error) {
+	if !env.GetStores().Identity.IsEntityPresent(tx, entity.IdentityId) {
 		return nil, errorz.NewFieldError("identity not found", "IdentityId", entity.IdentityId)
 	}
 
@@ -63,19 +61,15 @@ func (entity *ApiSession) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (bol
 	return boltEntity, nil
 }
 
-func (entity *ApiSession) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *ApiSession) toBoltEntityForCreate(tx *bbolt.Tx, env Env) (*persistence.ApiSession, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *ApiSession) toBoltEntityForUpdate(tx *bbolt.Tx, manager EntityManager, checker boltz.FieldChecker) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *ApiSession) toBoltEntityForUpdate(tx *bbolt.Tx, env Env, _ boltz.FieldChecker) (*persistence.ApiSession, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *ApiSession) fillFrom(manager EntityManager, tx *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltApiSession, ok := boltEntity.(*persistence.ApiSession)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model ApiSession", reflect.TypeOf(boltEntity))
-	}
+func (entity *ApiSession) fillFrom(env Env, tx *bbolt.Tx, boltApiSession *persistence.ApiSession) error {
 	entity.FillCommon(boltApiSession)
 	entity.Token = boltApiSession.Token
 	entity.IdentityId = boltApiSession.IdentityId
@@ -83,17 +77,17 @@ func (entity *ApiSession) fillFrom(manager EntityManager, tx *bbolt.Tx, boltEnti
 	entity.IPAddress = boltApiSession.IPAddress
 	entity.MfaRequired = boltApiSession.MfaRequired
 	entity.MfaComplete = boltApiSession.MfaComplete
-	entity.ExpiresAt = entity.UpdatedAt.Add(manager.GetEnv().GetConfig().Api.SessionTimeout)
-	entity.ExpirationDuration = manager.GetEnv().GetConfig().Api.SessionTimeout
+	entity.ExpiresAt = entity.UpdatedAt.Add(env.GetConfig().Api.SessionTimeout)
+	entity.ExpirationDuration = env.GetConfig().Api.SessionTimeout
 	entity.LastActivityAt = boltApiSession.LastActivityAt
 	entity.AuthenticatorId = boltApiSession.AuthenticatorId
 
-	boltIdentity, err := manager.GetEnv().GetStores().Identity.LoadOneById(tx, boltApiSession.IdentityId)
+	boltIdentity, err := env.GetStores().Identity.LoadOneById(tx, boltApiSession.IdentityId)
 	if err != nil {
 		return err
 	}
 	modelIdentity := &Identity{}
-	if err := modelIdentity.fillFrom(manager, tx, boltIdentity); err != nil {
+	if err := modelIdentity.fillFrom(env, tx, boltIdentity); err != nil {
 		return err
 	}
 	entity.Identity = modelIdentity

controller/model/auth_policy_manager.go

@@ -18,7 +18,9 @@ package model
 
 import (
 	"fmt"
+	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
@@ -31,7 +33,7 @@ import (
 
 func NewAuthPolicyManager(env Env) *AuthPolicyManager {
 	manager := &AuthPolicyManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().AuthPolicy),
+		baseEntityManager: newBaseEntityManager[*AuthPolicy, *persistence.AuthPolicy](env, env.GetStores().AuthPolicy),
 	}
 	manager.impl = manager
 
@@ -41,14 +43,14 @@ func NewAuthPolicyManager(env Env) *AuthPolicyManager {
 }
 
 type AuthPolicyManager struct {
-	baseEntityManager
+	baseEntityManager[*AuthPolicy, *persistence.AuthPolicy]
 }
 
-func (self *AuthPolicyManager) Create(entity *AuthPolicy) error {
-	return network.DispatchCreate[*AuthPolicy](self, entity)
+func (self *AuthPolicyManager) Create(entity *AuthPolicy, ctx *change.Context) error {
+	return network.DispatchCreate[*AuthPolicy](self, entity, ctx)
 }
 
-func (self *AuthPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*AuthPolicy]) error {
+func (self *AuthPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*AuthPolicy], ctx boltz.MutateContext) error {
 	entity := cmd.Entity
 	if entity.Secondary.RequiredExtJwtSigner != nil {
 		if err := self.verifyExtJwt(*entity.Secondary.RequiredExtJwtSigner, "secondary.requiredExtJwtSigner"); err != nil {
@@ -62,19 +64,19 @@ func (self *AuthPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*Aut
 		}
 	}
 
-	_, err := self.createEntity(cmd.Entity)
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
-func (self *AuthPolicyManager) Update(entity *AuthPolicy, checker fields.UpdatedFields) error {
-	return network.DispatchUpdate[*AuthPolicy](self, entity, checker)
+func (self *AuthPolicyManager) Update(entity *AuthPolicy, checker fields.UpdatedFields, ctx *change.Context) error {
+	return network.DispatchUpdate[*AuthPolicy](self, entity, checker, ctx)
 }
 
-func (self *AuthPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*AuthPolicy]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields)
+func (self *AuthPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*AuthPolicy], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
-func (self *AuthPolicyManager) newModelEntity() edgeEntity {
+func (self *AuthPolicyManager) newModelEntity() *AuthPolicy {
 	return &AuthPolicy{}
 }
 

controller/model/auth_policy_model.go

@@ -20,9 +20,7 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
-	"reflect"
 )
 
 type AuthPolicy struct {
@@ -64,11 +62,7 @@ type AuthPolicyUpdb struct {
 	LockoutDurationMinutes int64
 }
 
-func (entity *AuthPolicy) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltAuthPolicy, ok := boltEntity.(*persistence.AuthPolicy)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model ca", reflect.TypeOf(boltEntity))
-	}
+func (entity *AuthPolicy) fillFrom(_ Env, _ *bbolt.Tx, boltAuthPolicy *persistence.AuthPolicy) error {
 	entity.FillCommon(boltAuthPolicy)
 	entity.Name = boltAuthPolicy.Name
 	entity.Primary = AuthPolicyPrimary{
@@ -98,7 +92,7 @@ func (entity *AuthPolicy) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity bolt
 	return nil
 }
 
-func (entity *AuthPolicy) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz.Entity, error) {
+func (entity *AuthPolicy) toBoltEntityForCreate(*bbolt.Tx, Env) (*persistence.AuthPolicy, error) {
 	boltEntity := &persistence.AuthPolicy{
 		BaseExtEntity: *boltz.NewExtEntity(entity.Id, entity.Tags),
 		Name:          entity.Name,
@@ -130,6 +124,6 @@ func (entity *AuthPolicy) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz
 	return boltEntity, nil
 }
 
-func (entity *AuthPolicy) toBoltEntityForUpdate(tx *bbolt.Tx, manager EntityManager, checker boltz.FieldChecker) (boltz.Entity, error) {
-	return entity.toBoltEntityForCreate(tx, manager)
+func (entity *AuthPolicy) toBoltEntityForUpdate(tx *bbolt.Tx, env Env, _ boltz.FieldChecker) (*persistence.AuthPolicy, error) {
+	return entity.toBoltEntityForCreate(tx, env)
 }

controller/model/authenticator.go

@@ -19,6 +19,7 @@ package model
 import (
 	"crypto/x509"
 	"encoding/json"
+	"github.com/openziti/fabric/controller/change"
 	"net/http"
 )
 
@@ -66,16 +67,18 @@ type AuthContext interface {
 	GetData() map[string]interface{}
 	GetCerts() []*x509.Certificate
 	GetHeaders() map[string]interface{}
+	GetChangeContext() *change.Context
 }
 
 type AuthContextHttp struct {
-	Method  string
-	Data    map[string]interface{}
-	Certs   []*x509.Certificate
-	Headers map[string]interface{}
+	Method        string
+	Data          map[string]interface{}
+	Certs         []*x509.Certificate
+	Headers       map[string]interface{}
+	ChangeContext *change.Context
 }
 
-func NewAuthContextHttp(request *http.Request, method string, data interface{}) AuthContext {
+func NewAuthContextHttp(request *http.Request, method string, data interface{}, ctx *change.Context) AuthContext {
 	//TODO: this is a giant hack to not deal w/ removing the AuthContext layer
 	sigh, _ := json.Marshal(data)
 	mapData := map[string]interface{}{}
@@ -87,10 +90,11 @@ func NewAuthContextHttp(request *http.Request, method string, data interface{})
 	}
 
 	return &AuthContextHttp{
-		Method:  method,
-		Data:    mapData,
-		Certs:   request.TLS.PeerCertificates,
-		Headers: headers,
+		Method:        method,
+		Data:          mapData,
+		Certs:         request.TLS.PeerCertificates,
+		Headers:       headers,
+		ChangeContext: ctx,
 	}
 }
 
@@ -110,6 +114,10 @@ func (context *AuthContextHttp) GetCerts() []*x509.Certificate {
 	return context.Certs
 }
 
+func (context *AuthContextHttp) GetChangeContext() *change.Context {
+	return context.ChangeContext
+}
+
 var _ AuthResult = &AuthResultBase{}
 
 type AuthResultBase struct {

controller/model/authenticator_manager.go

@@ -28,6 +28,7 @@ import (
 	"github.com/openziti/edge/eid"
 	edgeCert "github.com/openziti/edge/internal/cert"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
@@ -47,13 +48,13 @@ import (
 const updateUnrestricted = 1
 
 type AuthenticatorManager struct {
-	baseEntityManager
+	baseEntityManager[*Authenticator, *persistence.Authenticator]
 	authStore persistence.AuthenticatorStore
 }
 
 func NewAuthenticatorManager(env Env) *AuthenticatorManager {
 	manager := &AuthenticatorManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().Authenticator),
+		baseEntityManager: newBaseEntityManager[*Authenticator, *persistence.Authenticator](env, env.GetStores().Authenticator),
 		authStore:         env.GetStores().Authenticator,
 	}
 
@@ -64,7 +65,7 @@ func NewAuthenticatorManager(env Env) *AuthenticatorManager {
 	return manager
 }
 
-func (self *AuthenticatorManager) newModelEntity() edgeEntity {
+func (self *AuthenticatorManager) newModelEntity() *Authenticator {
 	return &Authenticator{}
 }
 
@@ -106,11 +107,11 @@ func (self *AuthenticatorManager) Read(id string) (*Authenticator, error) {
 	return modelEntity, nil
 }
 
-func (self *AuthenticatorManager) Create(entity *Authenticator) error {
-	return network.DispatchCreate[*Authenticator](self, entity)
+func (self *AuthenticatorManager) Create(entity *Authenticator, ctx *change.Context) error {
+	return network.DispatchCreate[*Authenticator](self, entity, ctx)
 }
 
-func (self *AuthenticatorManager) ApplyCreate(cmd *command.CreateEntityCommand[*Authenticator]) error {
+func (self *AuthenticatorManager) ApplyCreate(cmd *command.CreateEntityCommand[*Authenticator], ctx boltz.MutateContext) error {
 	authenticator := cmd.Entity
 	if authenticator.Method != persistence.MethodAuthenticatorUpdb && authenticator.Method != persistence.MethodAuthenticatorCert {
 		return errorz.NewFieldError("method must be updb or cert", "method", authenticator.Method)
@@ -165,12 +166,13 @@ func (self *AuthenticatorManager) ApplyCreate(cmd *command.CreateEntityCommand[*
 		}
 	}
 
-	_, err = self.createEntity(authenticator)
+	_, err = self.createEntity(authenticator, ctx)
 	return err
 }
 
-func (self *AuthenticatorManager) Update(entity *Authenticator, unrestricted bool, checker fields.UpdatedFields) error {
+func (self *AuthenticatorManager) Update(entity *Authenticator, unrestricted bool, checker fields.UpdatedFields, ctx *change.Context) error {
 	cmd := &command.UpdateEntityCommand[*Authenticator]{
+		Context:       ctx,
 		Updater:       self,
 		Entity:        entity,
 		UpdatedFields: checker,
@@ -181,7 +183,7 @@ func (self *AuthenticatorManager) Update(entity *Authenticator, unrestricted boo
 	return self.Dispatch(cmd)
 }
 
-func (self *AuthenticatorManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Authenticator]) error {
+func (self *AuthenticatorManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Authenticator], ctx boltz.MutateContext) error {
 	authenticator := cmd.Entity
 	if updb := authenticator.ToUpdb(); updb != nil {
 		if cmd.UpdatedFields == nil || cmd.UpdatedFields.IsUpdated("password") {
@@ -207,7 +209,7 @@ func (self *AuthenticatorManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*
 			checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 		}
 	}
-	return self.updateEntity(cmd.Entity, checker)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *AuthenticatorManager) getRootPool() *x509.CertPool {
@@ -216,16 +218,15 @@ func (self *AuthenticatorManager) getRootPool() *x509.CertPool {
 	roots.AppendCertsFromPEM(self.env.GetConfig().CaPems())
 
 	err := self.env.GetManagers().Ca.Stream("isVerified = true", func(ca *Ca, err error) error {
-		if ca == nil && err == nil {
-			return nil
-		}
-
 		if err != nil {
 			//continue on err
 			pfxlog.Logger().Errorf("error streaming cas for authentication: %vs", err)
 			return nil
 		}
-		roots.AppendCertsFromPEM([]byte(ca.CertPem))
+
+		if ca != nil {
+			roots.AppendCertsFromPEM([]byte(ca.CertPem))
+		}
 
 		return nil
 	})
@@ -281,7 +282,7 @@ func (self *AuthenticatorManager) ReadByFingerprint(fingerprint string) (*Authen
 	return authenticator, nil
 }
 
-func (self *AuthenticatorManager) UpdateSelf(authenticatorSelf *AuthenticatorSelf) error {
+func (self *AuthenticatorManager) UpdateSelf(authenticatorSelf *AuthenticatorSelf, ctx *change.Context) error {
 	authenticator, err := self.ReadForIdentity(authenticatorSelf.IdentityId, authenticatorSelf.Id)
 
 	if err != nil {
@@ -315,10 +316,10 @@ func (self *AuthenticatorManager) UpdateSelf(authenticatorSelf *AuthenticatorSel
 	updbAuth.Salt = ""
 	authenticator.SubType = updbAuth
 
-	return self.Update(authenticator, false, nil)
+	return self.Update(authenticator, false, nil, ctx)
 }
 
-func (self *AuthenticatorManager) PatchSelf(authenticatorSelf *AuthenticatorSelf, checker fields.UpdatedFields) error {
+func (self *AuthenticatorManager) PatchSelf(authenticatorSelf *AuthenticatorSelf, checker fields.UpdatedFields, ctx *change.Context) error {
 	if checker.IsUpdated("password") {
 		checker.AddField("salt")
 	}
@@ -356,7 +357,7 @@ func (self *AuthenticatorManager) PatchSelf(authenticatorSelf *AuthenticatorSelf
 	updbAuth.Salt = ""
 	authenticator.SubType = updbAuth
 
-	return self.Update(authenticator, false, checker)
+	return self.Update(authenticator, false, checker, ctx)
 }
 
 func (self *AuthenticatorManager) HashPassword(password string) *HashedPassword {
@@ -383,31 +384,14 @@ func (self *AuthenticatorManager) ReHashPassword(password string, salt []byte) *
 	}
 }
 
-func (self *AuthenticatorManager) ListForIdentity(identityId string, query ast.Query) (*AuthenticatorListQueryResult, error) {
+func (self *AuthenticatorManager) ListForIdentity(identityId string, query ast.Query) (*models.EntityListResult[*Authenticator], error) {
 	filterString := fmt.Sprintf(`identity = "%s"`, identityId)
 	filter, err := ast.Parse(self.Store, filterString)
 	if err != nil {
 		return nil, err
 	}
 	query.SetPredicate(ast.NewAndExprNode(query.GetPredicate(), filter))
-	result, err := self.BasePreparedList(query)
-
-	if err != nil {
-		return nil, err
-	}
-
-	var authenticators []*Authenticator
-
-	for _, entity := range result.GetEntities() {
-		if auth, ok := entity.(*Authenticator); ok {
-			authenticators = append(authenticators, auth)
-		}
-	}
-
-	return &AuthenticatorListQueryResult{
-		EntityListResult: result,
-		Authenticators:   authenticators,
-	}, nil
+	return self.BasePreparedList(query)
 }
 
 func (self *AuthenticatorManager) ReadForIdentity(identityId string, authenticatorId string) (*Authenticator, error) {
@@ -424,7 +408,7 @@ func (self *AuthenticatorManager) ReadForIdentity(identityId string, authenticat
 	return nil, nil
 }
 
-func (self *AuthenticatorManager) ExtendCertForIdentity(identityId string, authenticatorId string, peerCerts []*x509.Certificate, csrPem string) ([]byte, error) {
+func (self *AuthenticatorManager) ExtendCertForIdentity(identityId string, authenticatorId string, peerCerts []*x509.Certificate, csrPem string, ctx *change.Context) ([]byte, error) {
 	authenticator, _ := self.Read(authenticatorId)
 
 	if authenticator == nil {
@@ -527,7 +511,7 @@ func (self *AuthenticatorManager) ExtendCertForIdentity(identityId string, authe
 	err = self.env.GetManagers().Authenticator.Update(authenticatorCert.Authenticator, false, fields.UpdatedFieldsMap{
 		persistence.FieldAuthenticatorUnverifiedCertPem:         struct{}{},
 		persistence.FieldAuthenticatorUnverifiedCertFingerprint: struct{}{},
-	})
+	}, ctx)
 
 	if err != nil {
 		return nil, err
@@ -536,7 +520,7 @@ func (self *AuthenticatorManager) ExtendCertForIdentity(identityId string, authe
 	return newPemCert, nil
 }
 
-func (self *AuthenticatorManager) VerifyExtendCertForIdentity(apiSessionId, identityId, authenticatorId string, verifyCertPem string) error {
+func (self *AuthenticatorManager) VerifyExtendCertForIdentity(apiSessionId, identityId, authenticatorId string, verifyCertPem string, ctx *change.Context) error {
 	authenticator, _ := self.Read(authenticatorId)
 
 	if authenticator == nil {
@@ -590,7 +574,7 @@ func (self *AuthenticatorManager) VerifyExtendCertForIdentity(apiSessionId, iden
 
 		persistence.FieldAuthenticatorCertPem:         struct{}{},
 		persistence.FieldAuthenticatorCertFingerprint: struct{}{},
-	})
+	}, ctx)
 
 	if err != nil {
 		return err
@@ -608,30 +592,28 @@ func (self *AuthenticatorManager) VerifyExtendCertForIdentity(apiSessionId, iden
 		PEM:          verifyCertPem,
 	}
 
-	return self.env.GetDbProvider().GetDb().Update(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
-		err = self.env.GetStores().ApiSessionCertificate.Create(ctx, sessionCert)
-
-		if err != nil {
+	return self.env.GetDbProvider().GetDb().Update(ctx.NewMutateContext(), func(mutateCtx boltz.MutateContext) error {
+		if err = self.env.GetStores().ApiSessionCertificate.Create(mutateCtx, sessionCert); err != nil {
 			return err
 		}
-
-		err = self.env.GetStores().ApiSessionCertificate.DeleteWhere(ctx, fmt.Sprintf("%s=\"%s\"", persistence.FieldApiSessionCertificateFingerprint, oldFingerprint))
-
-		return err
+		return self.env.GetStores().ApiSessionCertificate.DeleteWhere(mutateCtx, fmt.Sprintf("%s=\"%s\"", persistence.FieldApiSessionCertificateFingerprint, oldFingerprint))
 	})
 }
 
 // ReEnroll converts the given authenticator `id` back to an enrollment of the same type with the same
 // constraints that expires at the time specified by `expiresAt`. The result is a string id of the new enrollment
 // or an error.
-func (self *AuthenticatorManager) ReEnroll(id string, expiresAt time.Time) (string, error) {
+func (self *AuthenticatorManager) ReEnroll(id string, expiresAt time.Time, ctx *change.Context) (string, error) {
 	authenticator, err := self.Read(id)
 	if err != nil {
 		return "", err
 	}
 
+	enrollmentId := eid.New()
 	enrollment := &Enrollment{
+		BaseEntity: models.BaseEntity{
+			Id: enrollmentId,
+		},
 		IdentityId: &authenticator.IdentityId,
 		Token:      uuid.NewString(),
 	}
@@ -660,14 +642,12 @@ func (self *AuthenticatorManager) ReEnroll(id string, expiresAt time.Time) (stri
 		return "", err
 	}
 
-	enrollmentId, err := self.env.GetManagers().Enrollment.createEntity(enrollment)
-
-	if err != nil {
+	if err = self.env.GetManagers().Enrollment.Create(enrollment, ctx); err != nil {
 		return "", err
 	}
 
-	if err = self.Delete(id); err != nil {
-		_ = self.env.GetManagers().Enrollment.Delete(enrollmentId)
+	if err = self.Delete(id, ctx); err != nil {
+		_ = self.env.GetManagers().Enrollment.Delete(enrollmentId, ctx)
 		return "", err
 	}
 
@@ -817,6 +797,6 @@ type HashedPassword struct {
 }
 
 type AuthenticatorListQueryResult struct {
-	*models.EntityListResult[models.Entity]
+	*models.EntityListResult[*Authenticator]
 	Authenticators []*Authenticator
 }

controller/model/authenticator_mod_cert.go

@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/edge/controller/apierror"
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/foundation/v2/errorz"
 	nfpem "github.com/openziti/foundation/v2/pem"
@@ -220,7 +221,7 @@ func (module *AuthModuleCert) Process(context AuthContext) (AuthResult, error) {
 	}
 
 	if authenticator.Method == persistence.MethodAuthenticatorCert {
-		module.ensureAuthenticatorCertPem(authenticator, clientCert)
+		module.ensureAuthenticatorCertPem(authenticator, clientCert, context.GetChangeContext())
 	}
 
 	return &AuthResultBase{
@@ -322,7 +323,7 @@ func (module *AuthModuleCert) getClientCerts(ctx AuthContext) ([]*x509.Certifica
 
 // ensureAuthenticatorCertPem ensures that a client's certificate is stored in `cert` authenticators. Older versions
 // of Ziti did not store this information on enrollment.
-func (module *AuthModuleCert) ensureAuthenticatorCertPem(authenticator *Authenticator, clientCert *x509.Certificate) {
+func (module *AuthModuleCert) ensureAuthenticatorCertPem(authenticator *Authenticator, clientCert *x509.Certificate, ctx *change.Context) {
 	if authCert, ok := authenticator.SubType.(*AuthenticatorCert); ok {
 		if authCert.Pem == "" {
 			certPem := pem.EncodeToMemory(&pem.Block{
@@ -331,7 +332,7 @@ func (module *AuthModuleCert) ensureAuthenticatorCertPem(authenticator *Authenti
 			})
 
 			authCert.Pem = string(certPem)
-			if err := module.env.GetManagers().Authenticator.Update(authenticator, false, nil); err != nil {
+			if err := module.env.GetManagers().Authenticator.Update(authenticator, false, nil, ctx); err != nil {
 				pfxlog.Logger().WithError(err).Errorf("error during cert auth attempting to update PEM")
 			}
 		}

controller/model/authenticator_mod_ext_jwt.go

@@ -56,9 +56,9 @@ func NewAuthModuleExtJwt(env Env) *AuthModuleExtJwt {
 		signers: cmap.New[*signerRecord](),
 	}
 
-	env.GetStores().ExternalJwtSigner.AddListener(boltz.EventCreate, ret.onExternalSignerCreate)
-	env.GetStores().ExternalJwtSigner.AddListener(boltz.EventUpdate, ret.onExternalSignerUpdate)
-	env.GetStores().ExternalJwtSigner.AddListener(boltz.EventDelete, ret.onExternalSignerDelete)
+	env.GetStores().ExternalJwtSigner.AddEntityEventListenerF(ret.addSigner, boltz.EntityCreatedAsync)
+	env.GetStores().ExternalJwtSigner.AddEntityEventListenerF(ret.onExternalSignerUpdate, boltz.EntityUpdatedAsync)
+	env.GetStores().ExternalJwtSigner.AddEntityEventListenerF(ret.onExternalSignerDelete, boltz.EntityDeletedAsync)
 
 	ret.loadExistingSigners()
 
@@ -496,19 +496,11 @@ func (a *AuthModuleExtJwt) onExternalSignerCreate(args ...interface{}) {
 	a.addSigner(signer)
 }
 
-func (a *AuthModuleExtJwt) onExternalSignerUpdate(args ...interface{}) {
-	signer, ok := args[0].(*persistence.ExternalJwtSigner)
-
-	if !ok {
-		pfxlog.Logger().Errorf("error on external signature update for authentication module %T: expected %T got %T", a, signer, args[0])
-		return
-	}
-
+func (a *AuthModuleExtJwt) onExternalSignerUpdate(signer *persistence.ExternalJwtSigner) {
 	//read on update because patches can pass partial data
 	err := a.env.GetDbProvider().GetDb().View(func(tx *bbolt.Tx) error {
 		var err error
-		signer, err = a.env.GetStores().ExternalJwtSigner.LoadOneById(tx, signer.Id)
-
+		signer, _, err = a.env.GetStores().ExternalJwtSigner.FindById(tx, signer.Id)
 		return err
 	})
 
@@ -546,14 +538,7 @@ func (a *AuthModuleExtJwt) addSigner(signer *persistence.ExternalJwtSigner) {
 
 }
 
-func (a *AuthModuleExtJwt) onExternalSignerDelete(args ...interface{}) {
-	signer, ok := args[0].(*persistence.ExternalJwtSigner)
-
-	if !ok {
-		pfxlog.Logger().Errorf("error on external signature update for authentication module %T: expected %T got %T", a, signer, args[0])
-		return
-	}
-
+func (a *AuthModuleExtJwt) onExternalSignerDelete(signer *persistence.ExternalJwtSigner) {
 	logger := pfxlog.Logger().WithFields(map[string]interface{}{
 		"id":           signer.Id,
 		"name":         signer.Name,

controller/model/authenticator_mod_updb.go

@@ -123,7 +123,8 @@ func (module *AuthModuleUpdb) Process(context AuthContext) (AuthResult, error) {
 	if authPolicy.Primary.Updb.MaxAttempts != persistence.UpdbUnlimitedAttemptsLimit && attempts > authPolicy.Primary.Updb.MaxAttempts {
 		logger.WithField("attempts", attempts).WithField("maxAttempts", authPolicy.Primary.Updb.MaxAttempts).Error("updb auth failed, max attempts exceeded")
 
-		if err = module.env.GetManagers().Identity.Disable(authenticator.IdentityId, time.Duration(authPolicy.Primary.Updb.LockoutDurationMinutes)*time.Minute); err != nil {
+		duration := time.Duration(authPolicy.Primary.Updb.LockoutDurationMinutes) * time.Minute
+		if err = module.env.GetManagers().Identity.Disable(authenticator.IdentityId, duration, context.GetChangeContext()); err != nil {
 			logger.WithError(err).Error("could not lock identity, unhandled error")
 		}
 

controller/model/authenticator_model.go

@@ -22,7 +22,6 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
 	"reflect"
 )
@@ -52,11 +51,7 @@ func (entity *Authenticator) Fingerprints() []string {
 	}
 }
 
-func (entity *Authenticator) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltAuthenticator, ok := boltEntity.(*persistence.Authenticator)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model authenticator", reflect.TypeOf(boltEntity))
-	}
+func (entity *Authenticator) fillFrom(_ Env, _ *bbolt.Tx, boltAuthenticator *persistence.Authenticator) error {
 	entity.FillCommon(boltAuthenticator)
 	entity.Method = boltAuthenticator.Type
 	entity.IdentityId = boltAuthenticator.IdentityId
@@ -87,7 +82,7 @@ func (entity *Authenticator) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity b
 	return nil
 }
 
-func (entity *Authenticator) toBoltEntity() (boltz.Entity, error) {
+func (entity *Authenticator) toBoltEntity() (*persistence.Authenticator, error) {
 	boltEntity := &persistence.Authenticator{
 		BaseExtEntity: *boltz.NewExtEntity(entity.Id, entity.Tags),
 		Type:          entity.Method,
@@ -134,11 +129,11 @@ func (entity *Authenticator) toBoltEntity() (boltz.Entity, error) {
 	return boltEntity, nil
 }
 
-func (entity *Authenticator) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz.Entity, error) {
+func (entity *Authenticator) toBoltEntityForCreate(*bbolt.Tx, Env) (*persistence.Authenticator, error) {
 	return entity.toBoltEntity()
 }
 
-func (entity *Authenticator) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.FieldChecker) (boltz.Entity, error) {
+func (entity *Authenticator) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*persistence.Authenticator, error) {
 	return entity.toBoltEntity()
 }
 

controller/model/base_manager.go

@@ -18,129 +18,127 @@ package model
 
 import (
 	"github.com/michaelquigley/pfxlog"
-	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/eid"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/models"
-	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/storage/ast"
 	"github.com/openziti/storage/boltz"
 	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
-	"reflect"
 )
 
 const annotationsBucketName = "annotations"
 
-type EntityManager interface {
-	models.EntityRetriever[models.Entity]
+type EntityManager[E models.Entity] interface {
+	models.EntityRetriever[E]
 	command.EntityDeleter
 	GetEnv() Env
 
-	newModelEntity() edgeEntity
-	readEntityInTx(tx *bbolt.Tx, id string, modelEntity edgeEntity) error
+	newModelEntity() E
+	readEntityInTx(tx *bbolt.Tx, id string, modelEntity E) error
 }
 
-func newBaseEntityManager(env Env, store boltz.CrudStore) baseEntityManager {
-	return baseEntityManager{
-		BaseEntityManager: models.BaseEntityManager{
+func newBaseEntityManager[ME edgeEntity[PE], PE boltz.ExtEntity](env Env, store boltz.EntityStore[PE]) baseEntityManager[ME, PE] {
+	return baseEntityManager[ME, PE]{
+		BaseEntityManager: models.BaseEntityManager[PE]{
 			Store: store,
 		},
 		env: env,
 	}
 }
 
-type baseEntityManager struct {
-	models.BaseEntityManager
+type baseEntityManager[ME edgeEntity[PE], PE boltz.ExtEntity] struct {
+	models.BaseEntityManager[PE]
 	env  Env
-	impl EntityManager
+	impl EntityManager[ME]
 }
 
-func (self *baseEntityManager) Dispatch(command command.Command) error {
+func (self *baseEntityManager[ME, PE]) Dispatch(command command.Command) error {
 	return self.env.GetManagers().Command.Dispatch(command)
 }
 
-func (self *baseEntityManager) GetEntityTypeId() string {
+func (self *baseEntityManager[ME, PE]) GetEntityTypeId() string {
 	// default this to the store entity type and let individual controllers override it where
 	// needed to avoid collisions (e.g. edge service/router)
 	return self.GetStore().GetEntityType()
 }
 
-func (self *baseEntityManager) GetStore() boltz.CrudStore {
+func (self *baseEntityManager[ME, PE]) GetStore() boltz.EntityStore[PE] {
 	return self.Store
 }
 
-func (self *baseEntityManager) GetDb() boltz.Db {
+func (self *baseEntityManager[ME, PE]) GetDb() boltz.Db {
 	return self.env.GetDbProvider().GetDb()
 }
 
-func (self *baseEntityManager) GetEnv() Env {
+func (self *baseEntityManager[ME, PE]) GetEnv() Env {
 	return self.env
 }
 
-func (self *baseEntityManager) BaseLoad(id string) (models.Entity, error) {
+func (self *baseEntityManager[ME, PE]) BaseLoad(id string) (ME, error) {
 	entity := self.impl.newModelEntity()
 	if err := self.readEntity(id, entity); err != nil {
-		return nil, err
+		return *new(ME), err
 	}
 	return entity, nil
 }
 
-func (self *baseEntityManager) BaseLoadInTx(tx *bbolt.Tx, id string) (models.Entity, error) {
+func (self *baseEntityManager[ME, PE]) BaseLoadInTx(tx *bbolt.Tx, id string) (ME, error) {
 	entity := self.impl.newModelEntity()
 	if err := self.readEntityInTx(tx, id, entity); err != nil {
-		return nil, err
+		return *new(ME), err
 	}
 	return entity, nil
 }
 
-func (self *baseEntityManager) BaseList(query string) (*models.EntityListResult[models.Entity], error) {
-	result := &models.EntityListResult[models.Entity]{Loader: self}
+func (self *baseEntityManager[ME, PE]) BaseList(query string) (*models.EntityListResult[ME], error) {
+	result := &models.EntityListResult[ME]{Loader: self}
 	if err := self.ListWithHandler(query, result.Collect); err != nil {
 		return nil, err
 	}
 	return result, nil
 }
 
-func (self *baseEntityManager) BasePreparedList(query ast.Query) (*models.EntityListResult[models.Entity], error) {
-	result := &models.EntityListResult[models.Entity]{Loader: self}
+func (self *baseEntityManager[ME, PE]) BasePreparedList(query ast.Query) (*models.EntityListResult[ME], error) {
+	result := &models.EntityListResult[ME]{Loader: self}
 	if err := self.PreparedListWithHandler(query, result.Collect); err != nil {
 		return nil, err
 	}
 	return result, nil
 }
 
-func (self *baseEntityManager) BasePreparedListIndexed(cursorProvider ast.SetCursorProvider, query ast.Query) (*models.EntityListResult[models.Entity], error) {
-	result := &models.EntityListResult[models.Entity]{Loader: self}
+func (self *baseEntityManager[ME, PE]) BasePreparedListIndexed(cursorProvider ast.SetCursorProvider, query ast.Query) (*models.EntityListResult[ME], error) {
+	result := &models.EntityListResult[ME]{Loader: self}
 	if err := self.PreparedListIndexed(cursorProvider, query, result.Collect); err != nil {
 		return nil, err
 	}
 	return result, nil
 }
 
-func (self *baseEntityManager) PreparedListWithHandler(query ast.Query, resultHandler models.ListResultHandler) error {
+func (self *baseEntityManager[ME, PE]) PreparedListWithHandler(query ast.Query, resultHandler models.ListResultHandler) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.PreparedListWithTx(tx, query, resultHandler)
 	})
 }
 
-func (self *baseEntityManager) PreparedListIndexed(cursorProvider ast.SetCursorProvider, query ast.Query, resultHandler models.ListResultHandler) error {
+func (self *baseEntityManager[ME, PE]) PreparedListIndexed(cursorProvider ast.SetCursorProvider, query ast.Query, resultHandler models.ListResultHandler) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.PreparedListIndexedWithTx(tx, cursorProvider, query, resultHandler)
 	})
 }
 
-func (self *baseEntityManager) PreparedListAssociatedWithHandler(id string, association string, query ast.Query, handler models.ListResultHandler) error {
+func (self *baseEntityManager[ME, PE]) PreparedListAssociatedWithHandler(id string, association string, query ast.Query, handler models.ListResultHandler) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.PreparedListAssociatedWithTx(tx, id, association, query, handler)
 	})
 }
 
-func (self *baseEntityManager) createEntity(modelEntity edgeEntity) (string, error) {
+func (self *baseEntityManager[ME, PE]) createEntity(modelEntity edgeEntity[PE], ctx boltz.MutateContext) (string, error) {
 	var id string
-	err := self.GetDb().Update(func(tx *bbolt.Tx) error {
+	err := self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		var err error
-		id, err = self.createEntityInTx(boltz.NewMutateContext(tx), modelEntity)
+		id, err = self.createEntityInTx(ctx, modelEntity)
 		return err
 	})
 	if err != nil {
@@ -149,7 +147,7 @@ func (self *baseEntityManager) createEntity(modelEntity edgeEntity) (string, err
 	return id, nil
 }
 
-func (self *baseEntityManager) createEntityInTx(ctx boltz.MutateContext, modelEntity edgeEntity) (string, error) {
+func (self *baseEntityManager[ME, PE]) createEntityInTx(ctx boltz.MutateContext, modelEntity edgeEntity[PE]) (string, error) {
 	if modelEntity == nil {
 		return "", errors.Errorf("can't create %v with nil value", self.Store.GetEntityType())
 	}
@@ -157,12 +155,12 @@ func (self *baseEntityManager) createEntityInTx(ctx boltz.MutateContext, modelEn
 		modelEntity.SetId(eid.New())
 	}
 
-	boltEntity, err := modelEntity.toBoltEntityForCreate(ctx.Tx(), self.impl)
+	boltEntity, err := modelEntity.toBoltEntityForCreate(ctx.Tx(), self.env)
 	if err != nil {
 		return "", err
 	}
 
-	if err = self.ValidateNameOnCreate(ctx, boltEntity); err != nil {
+	if err = self.ValidateNameOnCreate(ctx.Tx(), boltEntity); err != nil {
 		return "", err
 	}
 
@@ -174,37 +172,22 @@ func (self *baseEntityManager) createEntityInTx(ctx boltz.MutateContext, modelEn
 	return modelEntity.GetId(), nil
 }
 
-func (self *baseEntityManager) updateEntityBatch(modelEntity edgeEntity, checker boltz.FieldChecker) error {
-	return self.GetDb().Batch(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
-		existing := self.GetStore().NewStoreEntity()
-		found, err := self.GetStore().BaseLoadOneById(tx, modelEntity.GetId(), existing)
+func (self *baseEntityManager[ME, PE]) updateEntityBatch(modelEntity edgeEntity[PE], checker boltz.FieldChecker, changeCtx *change.Context) error {
+	return self.GetDb().Batch(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+		existing, found, err := self.GetStore().FindById(ctx.Tx(), modelEntity.GetId())
 		if err != nil {
 			return err
 		}
 		if !found {
 			return boltz.NewNotFoundError(self.GetStore().GetSingularEntityType(), "id", modelEntity.GetId())
 		}
-		boltEntity, err := modelEntity.toBoltEntityForUpdate(tx, self.impl, checker)
+		boltEntity, err := modelEntity.toBoltEntityForUpdate(ctx.Tx(), self.env, checker)
 		if err != nil {
 			return err
 		}
 
-		// validate name for named entities
-		if namedEntity, ok := boltEntity.(boltz.NamedExtEntity); ok {
-			existingNamed := existing.(boltz.NamedExtEntity)
-			if (checker == nil || checker.IsUpdated("name")) && namedEntity.GetName() != existingNamed.GetName() {
-				if namedEntity.GetName() == "" {
-					return errorz.NewFieldError("name is required", "name", namedEntity.GetName())
-				}
-				if nameIndexStore, ok := self.GetStore().(persistence.NameIndexedStore); ok {
-					if nameIndexStore.GetNameIndex().Read(ctx.Tx(), []byte(namedEntity.GetName())) != nil {
-						return errorz.NewFieldError("name is must be unique", "name", namedEntity.GetName())
-					}
-				} else {
-					pfxlog.Logger().Errorf("batch: entity of type %v is named, but store doesn't have name index", reflect.TypeOf(boltEntity))
-				}
-			}
+		if err = self.ValidateNameOnUpdate(ctx, boltEntity, existing, checker); err != nil {
+			return nil
 		}
 
 		if err := self.GetStore().Update(ctx, boltEntity, checker); err != nil {
@@ -215,37 +198,23 @@ func (self *baseEntityManager) updateEntityBatch(modelEntity edgeEntity, checker
 	})
 }
 
-func (self *baseEntityManager) updateEntity(modelEntity edgeEntity, checker boltz.FieldChecker) error {
-	return self.GetDb().Update(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
-		existing := self.GetStore().NewStoreEntity()
-		found, err := self.GetStore().BaseLoadOneById(tx, modelEntity.GetId(), existing)
+func (self *baseEntityManager[ME, PE]) updateEntity(modelEntity ME, checker boltz.FieldChecker, ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
+		existing, found, err := self.GetStore().FindById(ctx.Tx(), modelEntity.GetId())
 		if err != nil {
 			return err
 		}
 		if !found {
 			return boltz.NewNotFoundError(self.GetStore().GetSingularEntityType(), "id", modelEntity.GetId())
 		}
-		boltEntity, err := modelEntity.toBoltEntityForUpdate(tx, self.impl, checker)
+
+		boltEntity, err := modelEntity.toBoltEntityForUpdate(ctx.Tx(), self.env, checker)
 		if err != nil {
 			return err
 		}
 
-		// validate name for named entities
-		if namedEntity, ok := boltEntity.(boltz.NamedExtEntity); ok {
-			existingNamed := existing.(boltz.NamedExtEntity)
-			if (checker == nil || checker.IsUpdated("name")) && namedEntity.GetName() != existingNamed.GetName() {
-				if namedEntity.GetName() == "" {
-					return errorz.NewFieldError("name is required", "name", namedEntity.GetName())
-				}
-				if nameIndexStore, ok := self.GetStore().(persistence.NameIndexedStore); ok {
-					if nameIndexStore.GetNameIndex().Read(ctx.Tx(), []byte(namedEntity.GetName())) != nil {
-						return errorz.NewFieldError("name is must be unique", "name", namedEntity.GetName())
-					}
-				} else {
-					pfxlog.Logger().Errorf("entity of type %v is named, but store doesn't have name index", reflect.TypeOf(boltEntity))
-				}
-			}
+		if err = self.ValidateNameOnUpdate(ctx, boltEntity, existing, checker); err != nil {
+			return nil
 		}
 
 		if err := self.GetStore().Update(ctx, boltEntity, checker); err != nil {
@@ -256,15 +225,34 @@ func (self *baseEntityManager) updateEntity(modelEntity edgeEntity, checker bolt
 	})
 }
 
-func (self *baseEntityManager) readEntity(id string, modelEntity edgeEntity) error {
+func (self *baseEntityManager[ME, PE]) Read(id string) (ME, error) {
+	modelEntity := self.impl.newModelEntity()
+	err := self.GetDb().View(func(tx *bbolt.Tx) error {
+		return self.readEntityInTx(tx, id, modelEntity)
+	})
+	if err != nil {
+		return *new(ME), err
+	}
+	return modelEntity, nil
+}
+
+func (self *baseEntityManager[ME, PE]) readInTx(tx *bbolt.Tx, id string) (ME, error) {
+	modelEntity := self.impl.newModelEntity()
+	if err := self.readEntityInTx(tx, id, modelEntity); err != nil {
+		return *new(ME), err
+	}
+	return modelEntity, nil
+}
+
+func (self *baseEntityManager[ME, PE]) readEntity(id string, modelEntity ME) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.readEntityInTx(tx, id, modelEntity)
 	})
 }
 
-func (self *baseEntityManager) readEntityInTx(tx *bbolt.Tx, id string, modelEntity edgeEntity) error {
-	boltEntity := self.GetStore().NewStoreEntity()
-	found, err := self.GetStore().BaseLoadOneById(tx, id, boltEntity)
+func (self *baseEntityManager[ME, PE]) readEntityInTx(tx *bbolt.Tx, id string, modelEntity ME) error {
+	boltEntity := self.GetStore().GetEntityStrategy().NewEntity()
+	found, err := self.GetStore().LoadEntity(tx, id, boltEntity)
 	if err != nil {
 		return err
 	}
@@ -272,16 +260,16 @@ func (self *baseEntityManager) readEntityInTx(tx *bbolt.Tx, id string, modelEnti
 		return boltz.NewNotFoundError(self.GetStore().GetSingularEntityType(), "id", id)
 	}
 
-	return modelEntity.fillFrom(self.impl, tx, boltEntity)
+	return modelEntity.fillFrom(self.env, tx, boltEntity)
 }
 
-func (self *baseEntityManager) readEntityWithIndex(name string, key []byte, index boltz.ReadIndex, modelEntity edgeEntity) error {
+func (self *baseEntityManager[ME, PE]) readEntityWithIndex(name string, key []byte, index boltz.ReadIndex, modelEntity ME) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.readEntityInTxWithIndex(name, tx, key, index, modelEntity)
 	})
 }
 
-func (self *baseEntityManager) readEntityInTxWithIndex(name string, tx *bbolt.Tx, key []byte, index boltz.ReadIndex, modelEntity edgeEntity) error {
+func (self *baseEntityManager[ME, PE]) readEntityInTxWithIndex(name string, tx *bbolt.Tx, key []byte, index boltz.ReadIndex, modelEntity ME) error {
 	id := index.Read(tx, key)
 	if id == nil {
 		return boltz.NewNotFoundError(self.GetStore().GetSingularEntityType(), name, string(key))
@@ -289,7 +277,7 @@ func (self *baseEntityManager) readEntityInTxWithIndex(name string, tx *bbolt.Tx
 	return self.readEntityInTx(tx, string(id), modelEntity)
 }
 
-func (self *baseEntityManager) readEntityByQuery(query string) (models.Entity, error) {
+func (self *baseEntityManager[ME, PE]) readEntityByQuery(query string) (models.Entity, error) {
 	result, err := self.BaseList(query)
 	if err != nil {
 		return nil, err
@@ -300,31 +288,31 @@ func (self *baseEntityManager) readEntityByQuery(query string) (models.Entity, e
 	return nil, nil
 }
 
-func (self *baseEntityManager) Delete(id string) error {
+func (self *baseEntityManager[ME, PE]) Delete(id string, ctx *change.Context) error {
 	cmd := &command.DeleteEntityCommand{
+		Context: ctx,
 		Deleter: self.impl, // needs to be impl, otherwise we will miss overrides to GetEntityTypeId
 		Id:      id,
 	}
 	return self.Dispatch(cmd)
 }
 
-func (self *baseEntityManager) ApplyDelete(cmd *command.DeleteEntityCommand) error {
-	return self.GetDb().Update(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
+func (self *baseEntityManager[ME, PE]) ApplyDelete(cmd *command.DeleteEntityCommand, ctx boltz.MutateContext) error {
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		return self.Store.DeleteById(ctx, cmd.Id)
 	})
 }
 
-func (self *baseEntityManager) deleteEntity(id string) error {
-	return self.GetDb().Update(func(tx *bbolt.Tx) error {
-		return self.GetStore().DeleteById(boltz.NewMutateContext(tx), id)
+func (self *baseEntityManager[ME, PE]) deleteEntity(id string, changeCtx *change.Context) error {
+	return self.GetDb().Update(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
+		return self.GetStore().DeleteById(ctx, id)
 	})
 }
 
-func (self *baseEntityManager) deleteEntityBatch(ids []string) error {
-	return self.GetDb().Update(func(tx *bbolt.Tx) error {
+func (self *baseEntityManager[ME, PE]) deleteEntityBatch(ids []string, changeCtx *change.Context) error {
+	return self.GetDb().Update(changeCtx.NewMutateContext(), func(ctx boltz.MutateContext) error {
 		for _, id := range ids {
-			if err := self.GetStore().DeleteById(boltz.NewMutateContext(tx), id); err != nil {
+			if err := self.GetStore().DeleteById(ctx, id); err != nil {
 				return err
 			}
 		}
@@ -332,13 +320,13 @@ func (self *baseEntityManager) deleteEntityBatch(ids []string) error {
 	})
 }
 
-func (self *baseEntityManager) ListWithHandler(queryString string, resultHandler models.ListResultHandler) error {
+func (self *baseEntityManager[ME, PE]) ListWithHandler(queryString string, resultHandler models.ListResultHandler) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.ListWithTx(tx, queryString, resultHandler)
 	})
 }
 
-func (self *baseEntityManager) queryRoleAttributes(index boltz.SetReadIndex, queryString string) ([]string, *models.QueryMetaData, error) {
+func (self *baseEntityManager[ME, PE]) queryRoleAttributes(index boltz.SetReadIndex, queryString string) ([]string, *models.QueryMetaData, error) {
 	query, err := ast.Parse(self.env.GetStores().Index, queryString)
 	if err != nil {
 		return nil, nil, err
@@ -365,13 +353,13 @@ func (self *baseEntityManager) queryRoleAttributes(index boltz.SetReadIndex, que
 	return results, qmd, nil
 }
 
-func (self *baseEntityManager) iterateRelatedEntities(id, field string, f func(tx *bbolt.Tx, relatedId string) error) error {
+func (self *baseEntityManager[ME, PE]) iterateRelatedEntities(id, field string, f func(tx *bbolt.Tx, relatedId string) error) error {
 	return self.GetDb().View(func(tx *bbolt.Tx) error {
 		return self.iterateRelatedEntitiesInTx(tx, id, field, f)
 	})
 }
 
-func (self *baseEntityManager) iterateRelatedEntitiesInTx(tx *bbolt.Tx, id, field string, f func(tx *bbolt.Tx, relatedId string) error) error {
+func (self *baseEntityManager[ME, PE]) iterateRelatedEntitiesInTx(tx *bbolt.Tx, id, field string, f func(tx *bbolt.Tx, relatedId string) error) error {
 	cursor := self.Store.GetRelatedEntitiesCursor(tx, id, field, true)
 	for cursor.IsValid() {
 		key := cursor.Current()
@@ -383,7 +371,7 @@ func (self *baseEntityManager) iterateRelatedEntitiesInTx(tx *bbolt.Tx, id, fiel
 	return nil
 }
 
-func (self *baseEntityManager) Annotate(ctx boltz.MutateContext, entityId string, key, value string) error {
+func (self *baseEntityManager[ME, PE]) Annotate(ctx boltz.MutateContext, entityId string, key, value string) error {
 	entityBucket := self.GetStore().GetEntityBucket(ctx.Tx(), []byte(entityId))
 	if entityBucket == nil {
 		return boltz.NewNotFoundError(self.GetStore().GetEntityType(), "id", entityId)
@@ -393,7 +381,7 @@ func (self *baseEntityManager) Annotate(ctx boltz.MutateContext, entityId string
 	return annotationsBucket.GetError()
 }
 
-func (self *baseEntityManager) GetAnnotation(entityId string, key string) (*string, error) {
+func (self *baseEntityManager[ME, PE]) GetAnnotation(entityId string, key string) (*string, error) {
 	var result *string
 	err := self.GetDb().View(func(tx *bbolt.Tx) error {
 		entityBucket := self.GetStore().GetEntityBucket(tx, []byte(entityId))

controller/model/base_model.go

@@ -22,9 +22,9 @@ import (
 	"go.etcd.io/bbolt"
 )
 
-type edgeEntity interface {
+type edgeEntity[PE boltz.ExtEntity] interface {
 	models.Entity
-	fillFrom(manager EntityManager, tx *bbolt.Tx, boltEntity boltz.Entity) error
-	toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error)
-	toBoltEntityForUpdate(tx *bbolt.Tx, manager EntityManager, checker boltz.FieldChecker) (boltz.Entity, error)
+	fillFrom(env Env, tx *bbolt.Tx, boltEntity PE) error
+	toBoltEntityForCreate(tx *bbolt.Tx, env Env) (PE, error)
+	toBoltEntityForUpdate(tx *bbolt.Tx, env Env, checker boltz.FieldChecker) (PE, error)
 }

controller/model/ca_manager.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
@@ -33,7 +34,7 @@ import (
 
 func NewCaManager(env Env) *CaManager {
 	manager := &CaManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().Ca),
+		baseEntityManager: newBaseEntityManager[*Ca, *persistence.Ca](env, env.GetStores().Ca),
 	}
 	manager.impl = manager
 
@@ -43,30 +44,30 @@ func NewCaManager(env Env) *CaManager {
 }
 
 type CaManager struct {
-	baseEntityManager
+	baseEntityManager[*Ca, *persistence.Ca]
 }
 
-func (self *CaManager) newModelEntity() edgeEntity {
+func (self *CaManager) newModelEntity() *Ca {
 	return &Ca{}
 }
 
-func (self *CaManager) Create(entity *Ca) error {
-	return network.DispatchCreate[*Ca](self, entity)
+func (self *CaManager) Create(entity *Ca, ctx *change.Context) error {
+	return network.DispatchCreate[*Ca](self, entity, ctx)
 }
 
-func (self *CaManager) ApplyCreate(cmd *command.CreateEntityCommand[*Ca]) error {
-	_, err := self.createEntity(cmd.Entity)
+func (self *CaManager) ApplyCreate(cmd *command.CreateEntityCommand[*Ca], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
-func (self *CaManager) Update(entity *Ca, checker fields.UpdatedFields) error {
+func (self *CaManager) Update(entity *Ca, checker fields.UpdatedFields, ctx *change.Context) error {
 	if checker != nil {
 		checker.RemoveFields(persistence.FieldCaIsVerified)
 	}
-	return network.DispatchUpdate[*Ca](self, entity, checker)
+	return network.DispatchUpdate[*Ca](self, entity, checker, ctx)
 }
 
-func (self *CaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Ca]) error {
+func (self *CaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Ca], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 
 	// isVerified should only be set by the Verified method. We remove isVerified
@@ -79,7 +80,7 @@ func (self *CaManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Ca]) error
 		}
 	}
 
-	return self.updateEntity(cmd.Entity, checker)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *CaManager) Read(id string) (*Ca, error) {
@@ -109,12 +110,12 @@ func (self *CaManager) IsUpdated(field string) bool {
 		strings.HasPrefix(field, persistence.FieldCaExternalIdClaim+".")
 }
 
-func (self *CaManager) Verified(ca *Ca) error {
+func (self *CaManager) Verified(ca *Ca, ctx *change.Context) error {
 	ca.IsVerified = true
 	checker := &fields.UpdatedFieldsMap{
 		persistence.FieldCaIsVerified: struct{}{},
 	}
-	return network.DispatchUpdate[*Ca](self, ca, checker)
+	return network.DispatchUpdate[*Ca](self, ca, checker, ctx)
 }
 
 func (self *CaManager) Query(query string) (*CaListResult, error) {

controller/model/ca_model.go

@@ -30,7 +30,6 @@ import (
 	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
 	"net/url"
-	"reflect"
 )
 
 type Ca struct {
@@ -59,11 +58,7 @@ type ExternalIdClaim struct {
 
 type ExternalIdFieldType string
 
-func (entity *Ca) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltCa, ok := boltEntity.(*persistence.Ca)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model ca", reflect.TypeOf(boltEntity))
-	}
+func (entity *Ca) fillFrom(_ Env, _ *bbolt.Tx, boltCa *persistence.Ca) error {
 	entity.FillCommon(boltCa)
 	entity.Name = boltCa.Name
 	entity.Fingerprint = boltCa.Fingerprint
@@ -89,7 +84,7 @@ func (entity *Ca) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity
 	return nil
 }
 
-func (entity *Ca) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
+func (entity *Ca) toBoltEntityForCreate(tx *bbolt.Tx, env Env) (*persistence.Ca, error) {
 	if entity.IdentityNameFormat == "" {
 		entity.IdentityNameFormat = DefaultCaIdentityNameFormat
 	}
@@ -137,7 +132,7 @@ func (entity *Ca) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (bo
 	}
 
 	query := fmt.Sprintf(`fingerprint = "%v"`, fp)
-	queryResults, _, err := manager.GetEnv().GetStores().Ca.QueryIds(tx, query)
+	queryResults, _, err := env.GetStores().Ca.QueryIds(tx, query)
 
 	if err != nil {
 		return nil, err
@@ -174,7 +169,7 @@ func (entity *Ca) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (bo
 	return boltEntity, nil
 }
 
-func (entity *Ca) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.FieldChecker) (boltz.Entity, error) {
+func (entity *Ca) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*persistence.Ca, error) {
 	if entity.IdentityNameFormat == "" {
 		entity.IdentityNameFormat = DefaultCaIdentityNameFormat
 	}

controller/model/config_manager.go

@@ -18,7 +18,9 @@ package model
 
 import (
 	"encoding/json"
+	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
@@ -31,7 +33,7 @@ import (
 
 func NewConfigManager(env Env) *ConfigManager {
 	manager := &ConfigManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().Config),
+		baseEntityManager: newBaseEntityManager[*Config, *persistence.Config](env, env.GetStores().Config),
 	}
 	manager.impl = manager
 
@@ -41,32 +43,32 @@ func NewConfigManager(env Env) *ConfigManager {
 }
 
 type ConfigManager struct {
-	baseEntityManager
+	baseEntityManager[*Config, *persistence.Config]
 }
 
-func (self *ConfigManager) newModelEntity() edgeEntity {
+func (self *ConfigManager) newModelEntity() *Config {
 	return &Config{}
 }
 
-func (self *ConfigManager) Create(entity *Config) error {
-	return network.DispatchCreate[*Config](self, entity)
+func (self *ConfigManager) Create(entity *Config, ctx *change.Context) error {
+	return network.DispatchCreate[*Config](self, entity, ctx)
 }
 
-func (self *ConfigManager) ApplyCreate(cmd *command.CreateEntityCommand[*Config]) error {
-	_, err := self.createEntity(cmd.Entity)
+func (self *ConfigManager) ApplyCreate(cmd *command.CreateEntityCommand[*Config], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
-func (self *ConfigManager) Update(entity *Config, checker fields.UpdatedFields) error {
-	return network.DispatchUpdate[*Config](self, entity, checker)
+func (self *ConfigManager) Update(entity *Config, checker fields.UpdatedFields, ctx *change.Context) error {
+	return network.DispatchUpdate[*Config](self, entity, checker, ctx)
 }
 
-func (self *ConfigManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Config]) error {
+func (self *ConfigManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Config], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = self
 	if cmd.UpdatedFields != nil {
 		checker = &AndFieldChecker{first: self, second: cmd.UpdatedFields}
 	}
-	return self.updateEntity(cmd.Entity, checker)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *ConfigManager) Read(id string) (*Config, error) {

controller/model/config_model.go

@@ -22,10 +22,8 @@ import (
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"github.com/xeipuuv/gojsonschema"
 	"go.etcd.io/bbolt"
-	"reflect"
 )
 
 type Config struct {
@@ -35,24 +33,24 @@ type Config struct {
 	Data   map[string]interface{}
 }
 
-func (entity *Config) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
+func (entity *Config) toBoltEntity(tx *bbolt.Tx, env Env) (*persistence.Config, error) {
 	if entity.TypeId != "" {
 		providedType := entity.TypeId
-		configTypeStore := manager.GetEnv().GetStores().ConfigType
+		configTypeStore := env.GetStores().ConfigType
 		if !configTypeStore.IsEntityPresent(tx, entity.TypeId) {
 			return nil, errorz.NewFieldError("invalid config type", persistence.FieldConfigType, providedType)
 		}
 	}
 
 	if entity.TypeId == "" {
-		currentConfig, err := manager.GetEnv().GetManagers().Config.readInTx(tx, entity.Id)
+		currentConfig, err := env.GetManagers().Config.readInTx(tx, entity.Id)
 		if err != nil {
 			return nil, err
 		}
 		entity.TypeId = currentConfig.TypeId
 	}
 
-	if configType, _ := manager.GetEnv().GetManagers().ConfigType.readInTx(tx, entity.TypeId); configType != nil && len(configType.Schema) > 0 {
+	if configType, _ := env.GetManagers().ConfigType.readInTx(tx, entity.TypeId); configType != nil && len(configType.Schema) > 0 {
 		compileSchema, err := configType.GetCompiledSchema()
 		if err != nil {
 			return nil, err
@@ -75,23 +73,18 @@ func (entity *Config) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (boltz.E
 	}, nil
 }
 
-func (entity *Config) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
+func (entity *Config) toBoltEntityForCreate(tx *bbolt.Tx, env Env) (*persistence.Config, error) {
 	if entity.TypeId == "" {
 		return nil, errorz.NewFieldError("config type must be specified", persistence.FieldConfigType, entity.TypeId)
 	}
-	return entity.toBoltEntity(tx, manager)
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *Config) toBoltEntityForUpdate(tx *bbolt.Tx, manager EntityManager, checker boltz.FieldChecker) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *Config) toBoltEntityForUpdate(tx *bbolt.Tx, env Env, _ boltz.FieldChecker) (*persistence.Config, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *Config) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltConfig, ok := boltEntity.(*persistence.Config)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model config", reflect.TypeOf(boltEntity))
-	}
-
+func (entity *Config) fillFrom(_ Env, _ *bbolt.Tx, boltConfig *persistence.Config) error {
 	entity.FillCommon(boltConfig)
 	entity.Name = boltConfig.Name
 	entity.TypeId = boltConfig.Type

controller/model/config_type_manager.go

@@ -19,12 +19,15 @@ package model
 import (
 	"encoding/json"
 	"github.com/michaelquigley/pfxlog"
+	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
 	"github.com/openziti/foundation/v2/stringz"
+	"github.com/openziti/storage/boltz"
 	"go.etcd.io/bbolt"
 	"google.golang.org/protobuf/proto"
 )
@@ -35,7 +38,7 @@ const (
 
 func NewConfigTypeManager(env Env) *ConfigTypeManager {
 	manager := &ConfigTypeManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().ConfigType),
+		baseEntityManager: newBaseEntityManager[*ConfigType, *persistence.ConfigType](env, env.GetStores().ConfigType),
 	}
 	manager.impl = manager
 
@@ -45,28 +48,28 @@ func NewConfigTypeManager(env Env) *ConfigTypeManager {
 }
 
 type ConfigTypeManager struct {
-	baseEntityManager
+	baseEntityManager[*ConfigType, *persistence.ConfigType]
 }
 
-func (self *ConfigTypeManager) newModelEntity() edgeEntity {
+func (self *ConfigTypeManager) newModelEntity() *ConfigType {
 	return &ConfigType{}
 }
 
-func (self *ConfigTypeManager) Create(entity *ConfigType) error {
-	return network.DispatchCreate[*ConfigType](self, entity)
+func (self *ConfigTypeManager) Create(entity *ConfigType, ctx *change.Context) error {
+	return network.DispatchCreate[*ConfigType](self, entity, ctx)
 }
 
-func (self *ConfigTypeManager) ApplyCreate(cmd *command.CreateEntityCommand[*ConfigType]) error {
-	_, err := self.createEntity(cmd.Entity)
+func (self *ConfigTypeManager) ApplyCreate(cmd *command.CreateEntityCommand[*ConfigType], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
-func (self *ConfigTypeManager) Update(entity *ConfigType, checker fields.UpdatedFields) error {
-	return network.DispatchUpdate[*ConfigType](self, entity, checker)
+func (self *ConfigTypeManager) Update(entity *ConfigType, checker fields.UpdatedFields, ctx *change.Context) error {
+	return network.DispatchUpdate[*ConfigType](self, entity, checker, ctx)
 }
 
-func (self *ConfigTypeManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ConfigType]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields)
+func (self *ConfigTypeManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*ConfigType], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *ConfigTypeManager) Read(id string) (*ConfigType, error) {

controller/model/config_type_model.go

@@ -25,7 +25,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/xeipuuv/gojsonschema"
 	"go.etcd.io/bbolt"
-	"reflect"
 )
 
 type ConfigType struct {
@@ -43,7 +42,7 @@ func (entity *ConfigType) GetCompiledSchema() (*gojsonschema.Schema, error) {
 	return schemaLoader.Compile(entitySchemaLoader)
 }
 
-func (entity *ConfigType) toBoltEntity() (boltz.Entity, error) {
+func (entity *ConfigType) toBoltEntity() (*persistence.ConfigType, error) {
 	if entity.Name == ConfigTypeAll {
 		return nil, errorz.NewFieldError(fmt.Sprintf("%v is a keyword and may not be used as a config type name", entity.Name), "name", entity.Name)
 	}
@@ -63,20 +62,15 @@ func (entity *ConfigType) toBoltEntity() (boltz.Entity, error) {
 	}, nil
 }
 
-func (entity *ConfigType) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz.Entity, error) {
+func (entity *ConfigType) toBoltEntityForCreate(*bbolt.Tx, Env) (*persistence.ConfigType, error) {
 	return entity.toBoltEntity()
 }
 
-func (entity *ConfigType) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.FieldChecker) (boltz.Entity, error) {
+func (entity *ConfigType) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*persistence.ConfigType, error) {
 	return entity.toBoltEntity()
 }
 
-func (entity *ConfigType) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltConfigType, ok := boltEntity.(*persistence.ConfigType)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model configType", reflect.TypeOf(boltEntity))
-	}
-
+func (entity *ConfigType) fillFrom(_ Env, _ *bbolt.Tx, boltConfigType *persistence.ConfigType) error {
 	entity.FillCommon(boltConfigType)
 	entity.Name = boltConfigType.Name
 	entity.Schema = boltConfigType.Schema

controller/model/create_terminator_cmd.go

@@ -5,29 +5,34 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/edge_common"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/network"
 	"github.com/openziti/fabric/pb/cmd_pb"
+	"github.com/openziti/storage/boltz"
 	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
 	"strings"
 )
 
 type CreateEdgeTerminatorCmd struct {
-	Env    Env
-	Entity *network.Terminator
+	Env     Env
+	Entity  *network.Terminator
+	Context *change.Context
 }
 
-func (self *CreateEdgeTerminatorCmd) Apply() error {
+func (self *CreateEdgeTerminatorCmd) Apply(ctx boltz.MutateContext) error {
 	createCmd := &command.CreateEntityCommand[*network.Terminator]{
 		Creator:        self.Env.GetManagers().Terminator,
 		Entity:         self.Entity,
 		PostCreateHook: self.validateTerminatorIdentity,
+		Context:        self.Context,
 	}
-	return self.Env.GetManagers().Terminator.ApplyCreate(createCmd)
+	return self.Env.GetManagers().Terminator.ApplyCreate(createCmd, ctx)
 }
 
-func (self *CreateEdgeTerminatorCmd) validateTerminatorIdentity(tx *bbolt.Tx, terminator *network.Terminator) error {
+func (self *CreateEdgeTerminatorCmd) validateTerminatorIdentity(ctx boltz.MutateContext, terminator *network.Terminator) error {
+	tx := ctx.Tx()
 	session, err := self.getTerminatorSession(tx, terminator, "")
 	if err != nil {
 		return err
@@ -57,6 +62,10 @@ func (self *CreateEdgeTerminatorCmd) validateTerminatorIdentity(tx *bbolt.Tx, te
 	return nil
 }
 
+func (self *CreateEdgeTerminatorCmd) GetChangeContext() *change.Context {
+	return self.Context
+}
+
 type terminator interface {
 	GetId() string
 	GetInstanceId() string
@@ -103,6 +112,7 @@ func (self *CreateEdgeTerminatorCmd) Encode() ([]byte, error) {
 	}
 	cmd := &edge_cmd_pb.CreateEdgeTerminatorCommand{
 		TerminatorData: terminatorData,
+		Ctx:            ContextToProtobuf(self.Context),
 	}
 	return cmd_pb.EncodeProtobuf(cmd)
 }
@@ -111,5 +121,6 @@ func (self *CreateEdgeTerminatorCmd) Decode(env Env, msg *edge_cmd_pb.CreateEdge
 	var err error
 	self.Env = env
 	self.Entity, err = env.GetManagers().Terminator.Unmarshall(msg.TerminatorData)
+	self.Context = ProtobufToContext(msg.Ctx)
 	return err
 }

controller/model/edge_router_manager.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"github.com/openziti/edge/eid"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/network"
@@ -41,7 +42,7 @@ import (
 
 func NewEdgeRouterManager(env Env) *EdgeRouterManager {
 	manager := &EdgeRouterManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().EdgeRouter),
+		baseEntityManager: newBaseEntityManager[*EdgeRouter, *persistence.EdgeRouter](env, env.GetStores().EdgeRouter),
 		allowedFieldsChecker: fields.UpdatedFieldsMap{
 			persistence.FieldName:                        struct{}{},
 			persistence.FieldEdgeRouterIsTunnelerEnabled: struct{}{},
@@ -63,7 +64,7 @@ func NewEdgeRouterManager(env Env) *EdgeRouterManager {
 }
 
 type EdgeRouterManager struct {
-	baseEntityManager
+	baseEntityManager[*EdgeRouter, *persistence.EdgeRouter]
 	allowedFieldsChecker fields.UpdatedFieldsMap
 }
 
@@ -71,11 +72,11 @@ func (self *EdgeRouterManager) GetEntityTypeId() string {
 	return "edgeRouters"
 }
 
-func (self *EdgeRouterManager) newModelEntity() edgeEntity {
+func (self *EdgeRouterManager) newModelEntity() *EdgeRouter {
 	return &EdgeRouter{}
 }
 
-func (self *EdgeRouterManager) Create(edgeRouter *EdgeRouter) error {
+func (self *EdgeRouterManager) Create(edgeRouter *EdgeRouter, ctx *change.Context) error {
 	if edgeRouter.Id == "" {
 		edgeRouter.Id = eid.New()
 	}
@@ -90,23 +91,23 @@ func (self *EdgeRouterManager) Create(edgeRouter *EdgeRouter) error {
 		manager:    self,
 		edgeRouter: edgeRouter,
 		enrollment: enrollment,
+		ctx:        ctx,
 	}
 
 	return self.Dispatch(cmd)
 }
 
-func (self *EdgeRouterManager) ApplyCreate(cmd *CreateEdgeRouterCmd) error {
+func (self *EdgeRouterManager) ApplyCreate(cmd *CreateEdgeRouterCmd, ctx boltz.MutateContext) error {
 	edgeRouter := cmd.edgeRouter
 	enrollment := cmd.enrollment
 
-	return self.GetDb().Update(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
-		boltEdgeRouter, err := edgeRouter.toBoltEntityForCreate(tx, self.impl)
+	return self.GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
+		boltEdgeRouter, err := edgeRouter.toBoltEntityForCreate(ctx.Tx(), self.env)
 		if err != nil {
 			return err
 		}
 
-		if err = self.ValidateNameOnCreate(ctx, boltEdgeRouter); err != nil {
+		if err = self.ValidateNameOnCreate(ctx.Tx(), boltEdgeRouter); err != nil {
 			return err
 		}
 
@@ -124,11 +125,12 @@ func (self *EdgeRouterManager) ApplyCreate(cmd *CreateEdgeRouterCmd) error {
 	})
 }
 
-func (self *EdgeRouterManager) Update(entity *EdgeRouter, unrestricted bool, checker fields.UpdatedFields) error {
+func (self *EdgeRouterManager) Update(entity *EdgeRouter, unrestricted bool, checker fields.UpdatedFields, ctx *change.Context) error {
 	cmd := &command.UpdateEntityCommand[*EdgeRouter]{
 		Updater:       self,
 		Entity:        entity,
 		UpdatedFields: checker,
+		Context:       ctx,
 	}
 	if unrestricted {
 		cmd.Flags = updateUnrestricted
@@ -136,7 +138,7 @@ func (self *EdgeRouterManager) Update(entity *EdgeRouter, unrestricted bool, che
 	return self.Dispatch(cmd)
 }
 
-func (self *EdgeRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouter]) error {
+func (self *EdgeRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouter], ctx boltz.MutateContext) error {
 	var checker boltz.FieldChecker = cmd.UpdatedFields
 	if cmd.Flags != updateUnrestricted {
 		if checker == nil {
@@ -145,7 +147,7 @@ func (self *EdgeRouterManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Edg
 			checker = &AndFieldChecker{first: self.allowedFieldsChecker, second: cmd.UpdatedFields}
 		}
 	}
-	return self.updateEntity(cmd.Entity, checker)
+	return self.updateEntity(cmd.Entity, checker, ctx)
 }
 
 func (self *EdgeRouterManager) Read(id string) (*EdgeRouter, error) {
@@ -289,12 +291,14 @@ func (self *EdgeRouterManager) collectEnrollmentsInTx(tx *bbolt.Tx, id string, c
 // ReEnroll creates a new JWT enrollment for an existing edge router. If the edge router already exists
 // with a JWT, a new JWT is created. If the edge router was already enrolled, all record of the enrollment is
 // reset and the edge router is disconnected forcing the edge router to complete enrollment before connecting.
-func (self *EdgeRouterManager) ReEnroll(router *EdgeRouter) error {
+func (self *EdgeRouterManager) ReEnroll(router *EdgeRouter, ctx *change.Context) error {
 	log := pfxlog.Logger().WithField("routerId", router.Id)
 
 	log.Info("attempting to set edge router state to unenrolled")
 	enrollment := &Enrollment{
-		BaseEntity:   models.BaseEntity{},
+		BaseEntity: models.BaseEntity{
+			Id: eid.New(),
+		},
 		Method:       MethodEnrollEdgeRouterOtt,
 		EdgeRouterId: &router.Id,
 	}
@@ -303,29 +307,21 @@ func (self *EdgeRouterManager) ReEnroll(router *EdgeRouter) error {
 		return fmt.Errorf("unable to fill jwt info for re-enrolling edge router: %v", err)
 	}
 
-	err := self.GetDb().Update(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
-		if id, err := self.GetEnv().GetManagers().Enrollment.createEntityInTx(ctx, enrollment); err != nil {
-			return fmt.Errorf("could not create enrollment for re-enrolling edge router: %v", err)
-		} else {
-			log.WithField("enrollmentId", id).Infof("edge router re-enrollment entity created")
-		}
-		router.Fingerprint = nil
-		router.CertPem = nil
-		router.IsVerified = false
-
-		return nil
-	})
-
-	if err != nil {
-		return fmt.Errorf("unabled to alter db for re-enrolling edge router: %v", err)
+	if err := self.env.GetManagers().Enrollment.Create(enrollment, ctx); err != nil {
+		return errors.Wrap(err, "could not create enrollment for re-enrolling edge router")
+	} else {
+		log.WithField("enrollmentId", enrollment.Id).Infof("edge router re-enrollment entity created")
 	}
 
+	router.Fingerprint = nil
+	router.CertPem = nil
+	router.IsVerified = false
+
 	if err := self.Update(router, true, fields.UpdatedFieldsMap{
 		db.FieldRouterFingerprint:             struct{}{},
 		persistence.FieldEdgeRouterCertPEM:    struct{}{},
 		persistence.FieldEdgeRouterIsVerified: struct{}{},
-	}); err != nil {
+	}, ctx); err != nil {
 		log.WithError(err).Error("unable to patch re-enrolling edge router")
 		return errors.Wrap(err, "unable to patch re-enrolling edge router")
 	}
@@ -348,7 +344,7 @@ type ExtendedCerts struct {
 	RawServerCert []byte
 }
 
-func (self *EdgeRouterManager) ExtendEnrollment(router *EdgeRouter, clientCsrPem []byte, serverCertCsrPem []byte) (*ExtendedCerts, error) {
+func (self *EdgeRouterManager) ExtendEnrollment(router *EdgeRouter, clientCsrPem []byte, serverCertCsrPem []byte, ctx *change.Context) (*ExtendedCerts, error) {
 	enrollmentModule := self.env.GetEnrollRegistry().GetByMethod("erott").(*EnrollModuleEr)
 
 	clientCertRaw, err := enrollmentModule.ProcessClientCsrPem(clientCsrPem, router.Id)
@@ -381,7 +377,7 @@ func (self *EdgeRouterManager) ExtendEnrollment(router *EdgeRouter, clientCsrPem
 	err = self.Update(router, true, &fields.UpdatedFieldsMap{
 		persistence.FieldEdgeRouterCertPEM: struct{}{},
 		db.FieldRouterFingerprint:          struct{}{},
-	})
+	}, ctx)
 
 	if err != nil {
 		return nil, err
@@ -393,7 +389,7 @@ func (self *EdgeRouterManager) ExtendEnrollment(router *EdgeRouter, clientCsrPem
 	}, nil
 }
 
-func (self *EdgeRouterManager) ExtendEnrollmentWithVerify(router *EdgeRouter, clientCsrPem []byte, serverCertCsrPem []byte) (*ExtendedCerts, error) {
+func (self *EdgeRouterManager) ExtendEnrollmentWithVerify(router *EdgeRouter, clientCsrPem []byte, serverCertCsrPem []byte, ctx *change.Context) (*ExtendedCerts, error) {
 	enrollmentModule := self.env.GetEnrollRegistry().GetByMethod("erott").(*EnrollModuleEr)
 
 	clientCertRaw, err := enrollmentModule.ProcessClientCsrPem(clientCsrPem, router.Id)
@@ -426,7 +422,7 @@ func (self *EdgeRouterManager) ExtendEnrollmentWithVerify(router *EdgeRouter, cl
 	err = self.Update(router, true, &fields.UpdatedFieldsMap{
 		persistence.FieldEdgeRouterUnverifiedCertPEM:     struct{}{},
 		persistence.FieldEdgeRouterUnverifiedFingerprint: struct{}{},
-	})
+	}, ctx)
 
 	if err != nil {
 		return nil, err
@@ -442,7 +438,7 @@ func (self *EdgeRouterManager) ReadOneByUnverifiedFingerprint(fingerprint string
 	return self.ReadOneByQuery(fmt.Sprintf(`%s = "%v"`, persistence.FieldEdgeRouterUnverifiedFingerprint, fingerprint))
 }
 
-func (self *EdgeRouterManager) ExtendEnrollmentVerify(router *EdgeRouter) error {
+func (self *EdgeRouterManager) ExtendEnrollmentVerify(router *EdgeRouter, ctx *change.Context) error {
 	if router.UnverifiedFingerprint != nil && router.UnverifiedCertPem != nil {
 		router.Fingerprint = router.UnverifiedFingerprint
 		router.CertPem = router.UnverifiedCertPem
@@ -455,7 +451,7 @@ func (self *EdgeRouterManager) ExtendEnrollmentVerify(router *EdgeRouter) error
 			persistence.FieldCaCertPem:                       struct{}{},
 			persistence.FieldEdgeRouterUnverifiedCertPEM:     struct{}{},
 			persistence.FieldEdgeRouterUnverifiedFingerprint: struct{}{},
-		})
+		}, ctx)
 	}
 
 	return errors.New("no outstanding verification necessary")
@@ -558,10 +554,11 @@ type CreateEdgeRouterCmd struct {
 	manager    *EdgeRouterManager
 	edgeRouter *EdgeRouter
 	enrollment *Enrollment
+	ctx        *change.Context
 }
 
-func (self *CreateEdgeRouterCmd) Apply() error {
-	return self.manager.ApplyCreate(self)
+func (self *CreateEdgeRouterCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyCreate(self, ctx)
 }
 
 func (self *CreateEdgeRouterCmd) Encode() ([]byte, error) {
@@ -578,6 +575,7 @@ func (self *CreateEdgeRouterCmd) Encode() ([]byte, error) {
 	cmd := &edge_cmd_pb.CreateEdgeRouterCmd{
 		EdgeRouter: edgeRouterMsg,
 		Enrollment: enrollment,
+		Ctx:        ContextToProtobuf(self.ctx),
 	}
 
 	return cmd_pb.EncodeProtobuf(cmd)
@@ -597,6 +595,11 @@ func (self *CreateEdgeRouterCmd) Decode(env Env, msg *edge_cmd_pb.CreateEdgeRout
 
 	self.edgeRouter = edgeRouter
 	self.enrollment = enrollment
+	self.ctx = ProtobufToContext(msg.Ctx)
 
 	return nil
 }
+
+func (self *CreateEdgeRouterCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}

controller/model/edge_router_manager_test.go

@@ -2,6 +2,7 @@ package model
 
 import (
 	"github.com/openziti/edge/eid"
+	"github.com/openziti/fabric/controller/change"
 	"go.etcd.io/bbolt"
 	"testing"
 )
@@ -20,7 +21,7 @@ func (ctx *TestContext) testGetEdgeRoutersForServiceAndIdentity(*testing.T) {
 	identity := ctx.requireNewIdentity(false)
 	service := ctx.requireNewService()
 	service.RoleAttributes = []string{eid.New()}
-	ctx.NoError(ctx.managers.EdgeService.Update(service, nil))
+	ctx.NoError(ctx.managers.EdgeService.Update(service, nil, change.New().SetSource("test")))
 
 	ctx.requireNewEdgeRouterPolicy(ss("#all"), ss("#all"))
 
@@ -37,7 +38,7 @@ func (ctx *TestContext) testGetEdgeRoutersForServiceAndIdentity(*testing.T) {
 	ctx.False(ctx.managers.EdgeRouter.IsSharedEdgeRouterPresent(identity.Id, service.Id))
 
 	serp.EdgeRouterRoles = []string{"@" + edgeRouter.Id}
-	ctx.NoError(ctx.managers.ServiceEdgeRouterPolicy.Update(serp, nil))
+	ctx.NoError(ctx.managers.ServiceEdgeRouterPolicy.Update(serp, nil, change.New().SetSource("test")))
 
 	// should be accessible if we limit to our specific router
 	ctx.True(ctx.isEdgeRouterAccessible(edgeRouter.Id, identity.Id, service.Id))

controller/model/edge_router_model.go

@@ -17,14 +17,11 @@
 package model
 
 import (
-	"github.com/openziti/foundation/v2/versions"
-	"reflect"
-
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/fabric/controller/db"
 	"github.com/openziti/fabric/controller/models"
+	"github.com/openziti/foundation/v2/versions"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
 )
 
@@ -46,7 +43,11 @@ type EdgeRouter struct {
 	Disabled              bool
 }
 
-func (entity *EdgeRouter) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz.Entity, error) {
+func (self *EdgeRouter) GetName() string {
+	return self.Name
+}
+
+func (entity *EdgeRouter) toBoltEntityForCreate(*bbolt.Tx, Env) (*persistence.EdgeRouter, error) {
 	boltEntity := &persistence.EdgeRouter{
 		Router: db.Router{
 			BaseExtEntity: *boltz.NewExtEntity(entity.Id, entity.Tags),
@@ -64,7 +65,7 @@ func (entity *EdgeRouter) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz
 	return boltEntity, nil
 }
 
-func (entity *EdgeRouter) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.FieldChecker) (boltz.Entity, error) {
+func (entity *EdgeRouter) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*persistence.EdgeRouter, error) {
 	return &persistence.EdgeRouter{
 		Router: db.Router{
 			BaseExtEntity: *boltz.NewExtEntity(entity.Id, entity.Tags),
@@ -84,12 +85,7 @@ func (entity *EdgeRouter) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.
 	}, nil
 }
 
-func (entity *EdgeRouter) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltEdgeRouter, ok := boltEntity.(*persistence.EdgeRouter)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model edge router", reflect.TypeOf(boltEntity))
-	}
-
+func (entity *EdgeRouter) fillFrom(_ Env, _ *bbolt.Tx, boltEdgeRouter *persistence.EdgeRouter) error {
 	entity.FillCommon(boltEdgeRouter)
 	entity.Name = boltEdgeRouter.Name
 	entity.RoleAttributes = boltEdgeRouter.RoleAttributes

controller/model/edge_router_policy_manager.go

@@ -17,18 +17,20 @@
 package model
 
 import (
+	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/fabric/controller/network"
-	"go.etcd.io/bbolt"
+	"github.com/openziti/storage/boltz"
 	"google.golang.org/protobuf/proto"
 )
 
 func NewEdgeRouterPolicyManager(env Env) *EdgeRouterPolicyManager {
 	manager := &EdgeRouterPolicyManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().EdgeRouterPolicy),
+		baseEntityManager: newBaseEntityManager[*EdgeRouterPolicy, *persistence.EdgeRouterPolicy](env, env.GetStores().EdgeRouterPolicy),
 	}
 	manager.impl = manager
 
@@ -38,44 +40,28 @@ func NewEdgeRouterPolicyManager(env Env) *EdgeRouterPolicyManager {
 }
 
 type EdgeRouterPolicyManager struct {
-	baseEntityManager
+	baseEntityManager[*EdgeRouterPolicy, *persistence.EdgeRouterPolicy]
 }
 
-func (self *EdgeRouterPolicyManager) newModelEntity() edgeEntity {
+func (self *EdgeRouterPolicyManager) newModelEntity() *EdgeRouterPolicy {
 	return &EdgeRouterPolicy{}
 }
 
-func (self *EdgeRouterPolicyManager) Create(entity *EdgeRouterPolicy) error {
-	return network.DispatchCreate[*EdgeRouterPolicy](self, entity)
+func (self *EdgeRouterPolicyManager) Create(entity *EdgeRouterPolicy, ctx *change.Context) error {
+	return network.DispatchCreate[*EdgeRouterPolicy](self, entity, ctx)
 }
 
-func (self *EdgeRouterPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*EdgeRouterPolicy]) error {
-	_, err := self.createEntity(cmd.Entity)
+func (self *EdgeRouterPolicyManager) ApplyCreate(cmd *command.CreateEntityCommand[*EdgeRouterPolicy], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
-func (self *EdgeRouterPolicyManager) Update(entity *EdgeRouterPolicy, checker fields.UpdatedFields) error {
-	return network.DispatchUpdate[*EdgeRouterPolicy](self, entity, checker)
+func (self *EdgeRouterPolicyManager) Update(entity *EdgeRouterPolicy, checker fields.UpdatedFields, ctx *change.Context) error {
+	return network.DispatchUpdate[*EdgeRouterPolicy](self, entity, checker, ctx)
 }
 
-func (self *EdgeRouterPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouterPolicy]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields)
-}
-
-func (self *EdgeRouterPolicyManager) Read(id string) (*EdgeRouterPolicy, error) {
-	modelEntity := &EdgeRouterPolicy{}
-	if err := self.readEntity(id, modelEntity); err != nil {
-		return nil, err
-	}
-	return modelEntity, nil
-}
-
-func (self *EdgeRouterPolicyManager) readInTx(tx *bbolt.Tx, id string) (*EdgeRouterPolicy, error) {
-	modelEntity := &EdgeRouterPolicy{}
-	if err := self.readEntityInTx(tx, id, modelEntity); err != nil {
-		return nil, err
-	}
-	return modelEntity, nil
+func (self *EdgeRouterPolicyManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*EdgeRouterPolicy], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *EdgeRouterPolicyManager) Marshall(entity *EdgeRouterPolicy) ([]byte, error) {

controller/model/edge_router_policy_model.go

@@ -20,9 +20,7 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
-	"reflect"
 )
 
 type EdgeRouterPolicy struct {
@@ -33,7 +31,7 @@ type EdgeRouterPolicy struct {
 	EdgeRouterRoles []string
 }
 
-func (entity *EdgeRouterPolicy) toBoltEntity() (boltz.Entity, error) {
+func (entity *EdgeRouterPolicy) toBoltEntity() (*persistence.EdgeRouterPolicy, error) {
 	return &persistence.EdgeRouterPolicy{
 		BaseExtEntity:   *boltz.NewExtEntity(entity.Id, entity.Tags),
 		Name:            entity.Name,
@@ -43,19 +41,15 @@ func (entity *EdgeRouterPolicy) toBoltEntity() (boltz.Entity, error) {
 	}, nil
 }
 
-func (entity *EdgeRouterPolicy) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz.Entity, error) {
+func (entity *EdgeRouterPolicy) toBoltEntityForCreate(*bbolt.Tx, Env) (*persistence.EdgeRouterPolicy, error) {
 	return entity.toBoltEntity()
 }
 
-func (entity *EdgeRouterPolicy) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.FieldChecker) (boltz.Entity, error) {
+func (entity *EdgeRouterPolicy) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*persistence.EdgeRouterPolicy, error) {
 	return entity.toBoltEntity()
 }
 
-func (entity *EdgeRouterPolicy) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltEdgeRouterPolicy, ok := boltEntity.(*persistence.EdgeRouterPolicy)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model edge router policy", reflect.TypeOf(boltEntity))
-	}
+func (entity *EdgeRouterPolicy) fillFrom(_ Env, _ *bbolt.Tx, boltEdgeRouterPolicy *persistence.EdgeRouterPolicy) error {
 	entity.FillCommon(boltEdgeRouterPolicy)
 	entity.Name = boltEdgeRouterPolicy.Name
 	entity.Semantic = boltEdgeRouterPolicy.Semantic

controller/model/edge_service_manager.go

@@ -20,6 +20,7 @@ import (
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/db"
 	"github.com/openziti/fabric/controller/fields"
@@ -33,9 +34,11 @@ import (
 
 func NewEdgeServiceManager(env Env) *EdgeServiceManager {
 	manager := &EdgeServiceManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().EdgeService),
+		baseEntityManager: newBaseEntityManager[*Service, *persistence.EdgeService](env, env.GetStores().EdgeService),
+		detailLister:      &ServiceDetailLister{},
 	}
 	manager.impl = manager
+	manager.detailLister.manager = manager
 
 	network.RegisterManagerDecoder[*Service](env.GetHostController().GetNetwork().Managers, manager)
 
@@ -43,43 +46,40 @@ func NewEdgeServiceManager(env Env) *EdgeServiceManager {
 }
 
 type EdgeServiceManager struct {
-	baseEntityManager
+	baseEntityManager[*Service, *persistence.EdgeService]
+	detailLister *ServiceDetailLister
+}
+
+func (self *EdgeServiceManager) GetDetailLister() *ServiceDetailLister {
+	return self.detailLister
 }
 
 func (self *EdgeServiceManager) GetEntityTypeId() string {
 	return "edgeServices"
 }
 
-func (self *EdgeServiceManager) newModelEntity() edgeEntity {
-	return &ServiceDetail{}
+func (self *EdgeServiceManager) newModelEntity() *Service {
+	return &Service{}
 }
 
-func (self *EdgeServiceManager) Create(entity *Service) error {
-	return network.DispatchCreate[*Service](self, entity)
+func (self *EdgeServiceManager) Create(entity *Service, ctx *change.Context) error {
+	return network.DispatchCreate[*Service](self, entity, ctx)
 }
 
-func (self *EdgeServiceManager) ApplyCreate(cmd *command.CreateEntityCommand[*Service]) error {
-	_, err := self.createEntity(cmd.Entity)
+func (self *EdgeServiceManager) ApplyCreate(cmd *command.CreateEntityCommand[*Service], ctx boltz.MutateContext) error {
+	_, err := self.createEntity(cmd.Entity, ctx)
 	return err
 }
 
-func (self *EdgeServiceManager) Update(entity *Service, checker fields.UpdatedFields) error {
+func (self *EdgeServiceManager) Update(entity *Service, checker fields.UpdatedFields, ctx *change.Context) error {
 	if checker != nil {
 		checker = checker.RemoveFields("encryptionRequired")
 	}
-	return network.DispatchUpdate[*Service](self, entity, checker)
+	return network.DispatchUpdate[*Service](self, entity, checker, ctx)
 }
 
-func (self *EdgeServiceManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Service]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields)
-}
-
-func (self *EdgeServiceManager) Read(id string) (*Service, error) {
-	entity := &Service{}
-	if err := self.readEntity(id, entity); err != nil {
-		return nil, err
-	}
-	return entity, nil
+func (self *EdgeServiceManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Service], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
 func (self *EdgeServiceManager) ReadByName(name string) (*Service, error) {
@@ -93,7 +93,16 @@ func (self *EdgeServiceManager) ReadByName(name string) (*Service, error) {
 
 func (self *EdgeServiceManager) readInTx(tx *bbolt.Tx, id string) (*ServiceDetail, error) {
 	entity := &ServiceDetail{}
-	if err := self.readEntityInTx(tx, id, entity); err != nil {
+	boltEntity := self.GetStore().GetEntityStrategy().NewEntity()
+	found, err := self.GetStore().LoadEntity(tx, id, boltEntity)
+	if err != nil {
+		return nil, err
+	}
+	if !found {
+		return nil, boltz.NewNotFoundError(self.GetStore().GetSingularEntityType(), "id", id)
+	}
+
+	if err = entity.fillFrom(self.env, tx, boltEntity); err != nil {
 		return nil, err
 	}
 	return entity, nil
@@ -369,3 +378,39 @@ func (self *EdgeServiceManager) GetPolicyPostureChecks(identityId, serviceId str
 
 	return policyIdToChecks
 }
+
+type ServiceDetailLister struct {
+	manager *EdgeServiceManager
+}
+
+func (self *ServiceDetailLister) GetListStore() boltz.Store {
+	return self.manager.GetListStore()
+}
+
+func (self *ServiceDetailLister) BaseLoadInTx(tx *bbolt.Tx, id string) (*ServiceDetail, error) {
+	return self.manager.readInTx(tx, id)
+}
+
+func (self *ServiceDetailLister) BasePreparedList(query ast.Query) (*models.EntityListResult[*ServiceDetail], error) {
+	result := &models.EntityListResult[*ServiceDetail]{
+		Loader: self,
+	}
+
+	if err := self.manager.PreparedListWithHandler(query, result.Collect); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+func (self *ServiceDetailLister) BasePreparedListIndexed(cursorProvider ast.SetCursorProvider, query ast.Query) (*models.EntityListResult[*ServiceDetail], error) {
+	result := &models.EntityListResult[*ServiceDetail]{
+		Loader: self,
+	}
+
+	if err := self.manager.PreparedListIndexed(cursorProvider, query, result.Collect); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}

controller/model/edge_service_model.go

@@ -23,9 +23,7 @@ import (
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/foundation/v2/errorz"
 	"github.com/openziti/storage/boltz"
-	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
-	"reflect"
 )
 
 type Service struct {
@@ -37,8 +35,8 @@ type Service struct {
 	EncryptionRequired bool     `json:"encryptionRequired"`
 }
 
-func (entity *Service) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
-	if err := entity.validateConfigs(tx, manager); err != nil {
+func (entity *Service) toBoltEntity(tx *bbolt.Tx, env Env) (*persistence.EdgeService, error) {
+	if err := entity.validateConfigs(tx, env); err != nil {
 		return nil, err
 	}
 
@@ -55,13 +53,13 @@ func (entity *Service) toBoltEntity(tx *bbolt.Tx, manager EntityManager) (boltz.
 	return edgeService, nil
 }
 
-func (entity *Service) toBoltEntityForCreate(tx *bbolt.Tx, manager EntityManager) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *Service) toBoltEntityForCreate(tx *bbolt.Tx, env Env) (*persistence.EdgeService, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *Service) validateConfigs(tx *bbolt.Tx, manager EntityManager) error {
+func (entity *Service) validateConfigs(tx *bbolt.Tx, env Env) error {
 	typeMap := map[string]*persistence.Config{}
-	configStore := manager.GetEnv().GetStores().Config
+	configStore := env.GetStores().Config
 	for _, id := range entity.Configs {
 		config, _ := configStore.LoadOneById(tx, id)
 		if config == nil {
@@ -70,7 +68,7 @@ func (entity *Service) validateConfigs(tx *bbolt.Tx, manager EntityManager) erro
 		conflictConfig, found := typeMap[config.Type]
 		if found {
 			configTypeName := "<not found>"
-			if configType, _ := manager.GetEnv().GetStores().ConfigType.LoadOneById(tx, config.Type); configType != nil {
+			if configType, _ := env.GetStores().ConfigType.LoadOneById(tx, config.Type); configType != nil {
 				configTypeName = configType.Name
 			}
 			msg := fmt.Sprintf("duplicate configs named %v and %v found for config type %v. Only one config of a given typed is allowed per service ",
@@ -82,15 +80,11 @@ func (entity *Service) validateConfigs(tx *bbolt.Tx, manager EntityManager) erro
 	return nil
 }
 
-func (entity *Service) toBoltEntityForUpdate(tx *bbolt.Tx, manager EntityManager, checker boltz.FieldChecker) (boltz.Entity, error) {
-	return entity.toBoltEntity(tx, manager)
+func (entity *Service) toBoltEntityForUpdate(tx *bbolt.Tx, env Env, _ boltz.FieldChecker) (*persistence.EdgeService, error) {
+	return entity.toBoltEntity(tx, env)
 }
 
-func (entity *Service) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltService, ok := boltEntity.(*persistence.EdgeService)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model service", reflect.TypeOf(boltEntity))
-	}
+func (entity *Service) fillFrom(_ Env, _ *bbolt.Tx, boltService *persistence.EdgeService) error {
 	entity.FillCommon(boltService)
 	entity.Name = boltService.Name
 	entity.TerminatorStrategy = boltService.TerminatorStrategy
@@ -111,19 +105,15 @@ type ServiceDetail struct {
 	EncryptionRequired bool                              `json:"encryptionRequired"`
 }
 
-func (entity *ServiceDetail) toBoltEntityForCreate(*bbolt.Tx, EntityManager) (boltz.Entity, error) {
+func (entity *ServiceDetail) toBoltEntityForCreate(*bbolt.Tx, Env) (*persistence.EdgeService, error) {
 	panic("should never be called")
 }
 
-func (entity *ServiceDetail) toBoltEntityForUpdate(*bbolt.Tx, EntityManager, boltz.FieldChecker) (boltz.Entity, error) {
+func (entity *ServiceDetail) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*persistence.EdgeService, error) {
 	panic("should never be called")
 }
 
-func (entity *ServiceDetail) fillFrom(_ EntityManager, _ *bbolt.Tx, boltEntity boltz.Entity) error {
-	boltService, ok := boltEntity.(*persistence.EdgeService)
-	if !ok {
-		return errors.Errorf("unexpected type %v when filling model service", reflect.TypeOf(boltEntity))
-	}
+func (entity *ServiceDetail) fillFrom(_ Env, _ *bbolt.Tx, boltService *persistence.EdgeService) error {
 	entity.FillCommon(boltService)
 	entity.Name = boltService.Name
 	entity.TerminatorStrategy = boltService.TerminatorStrategy

controller/model/enrollment.go

@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/runtime"
 	"github.com/openziti/edge/controller/apierror"
 	fabricApiError "github.com/openziti/fabric/controller/apierror"
+	"github.com/openziti/fabric/controller/change"
 	"io"
 	"net/http"
 	"strings"
@@ -72,15 +73,17 @@ type EnrollmentContext interface {
 	GetCerts() []*x509.Certificate
 	GetHeaders() map[string]interface{}
 	GetMethod() string
+	GetChangeContext() *change.Context
 }
 
 type EnrollmentContextHttp struct {
-	Headers    map[string]interface{}
-	Parameters map[string]interface{}
-	Data       interface{}
-	Certs      []*x509.Certificate
-	Token      string
-	Method     string
+	Headers       map[string]interface{}
+	Parameters    map[string]interface{}
+	Data          interface{}
+	Certs         []*x509.Certificate
+	Token         string
+	Method        string
+	ChangeContext *change.Context
 }
 
 func (context *EnrollmentContextHttp) GetToken() string {
@@ -127,7 +130,11 @@ func (context *EnrollmentContextHttp) GetHeaders() map[string]interface{} {
 	return context.Headers
 }
 
-func (context *EnrollmentContextHttp) FillFromHttpRequest(request *http.Request) error {
+func (context *EnrollmentContextHttp) GetChangeContext() *change.Context {
+	return context.ChangeContext
+}
+
+func (context *EnrollmentContextHttp) FillFromHttpRequest(request *http.Request, changeCtx *change.Context) error {
 	queryValues := request.URL.Query()
 	parameters := map[string]interface{}{}
 
@@ -179,6 +186,7 @@ func (context *EnrollmentContextHttp) FillFromHttpRequest(request *http.Request)
 	context.Data = enrollData
 	context.Certs = request.TLS.PeerCertificates
 	context.Headers = headers
+	context.ChangeContext = changeCtx
 
 	return nil
 }

controller/model/enrollment_manager.go

@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/edge/controller/persistence"
 	"github.com/openziti/edge/internal/cert"
 	"github.com/openziti/edge/pb/edge_cmd_pb"
+	"github.com/openziti/fabric/controller/change"
 	"github.com/openziti/fabric/controller/command"
 	"github.com/openziti/fabric/controller/fields"
 	"github.com/openziti/fabric/controller/models"
@@ -37,13 +38,13 @@ import (
 )
 
 type EnrollmentManager struct {
-	baseEntityManager
+	baseEntityManager[*Enrollment, *persistence.Enrollment]
 	enrollmentStore persistence.EnrollmentStore
 }
 
 func NewEnrollmentManager(env Env) *EnrollmentManager {
 	manager := &EnrollmentManager{
-		baseEntityManager: newBaseEntityManager(env, env.GetStores().Enrollment),
+		baseEntityManager: newBaseEntityManager[*Enrollment, *persistence.Enrollment](env, env.GetStores().Enrollment),
 		enrollmentStore:   env.GetStores().Enrollment,
 	}
 
@@ -55,13 +56,18 @@ func NewEnrollmentManager(env Env) *EnrollmentManager {
 	return manager
 }
 
-func (self *EnrollmentManager) Create(entity *Enrollment) error {
-	return network.DispatchCreate[*Enrollment](self, entity)
+func (self *EnrollmentManager) Create(entity *Enrollment, ctx *change.Context) error {
+	return network.DispatchCreate[*Enrollment](self, entity, ctx)
 }
 
-func (self *EnrollmentManager) ApplyCreate(cmd *command.CreateEntityCommand[*Enrollment]) error {
+func (self *EnrollmentManager) ApplyCreate(cmd *command.CreateEntityCommand[*Enrollment], ctx boltz.MutateContext) error {
 	model := cmd.Entity
 
+	if model.EdgeRouterId != nil || model.TransitRouterId != nil {
+		_, err := self.createEntity(model, ctx)
+		return err
+	}
+
 	if model.IdentityId == nil {
 		return apierror.NewBadRequestFieldError(*errorz.NewFieldError("identity not found", "identityId", model.IdentityId))
 	}
@@ -115,19 +121,19 @@ func (self *EnrollmentManager) ApplyCreate(cmd *command.CreateEntityCommand[*Enr
 		return err
 	}
 
-	_, err = self.createEntity(model)
+	_, err = self.createEntity(model, ctx)
 	return err
 }
 
-func (self *EnrollmentManager) Update(entity *Enrollment, checker fields.UpdatedFields) error {
-	return network.DispatchUpdate[*Enrollment](self, entity, checker)
+func (self *EnrollmentManager) Update(entity *Enrollment, checker fields.UpdatedFields, ctx *change.Context) error {
+	return network.DispatchUpdate[*Enrollment](self, entity, checker, ctx)
 }
 
-func (self *EnrollmentManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Enrollment]) error {
-	return self.updateEntity(cmd.Entity, cmd.UpdatedFields)
+func (self *EnrollmentManager) ApplyUpdate(cmd *command.UpdateEntityCommand[*Enrollment], ctx boltz.MutateContext) error {
+	return self.updateEntity(cmd.Entity, cmd.UpdatedFields, ctx)
 }
 
-func (self *EnrollmentManager) newModelEntity() edgeEntity {
+func (self *EnrollmentManager) newModelEntity() *Enrollment {
 	return &Enrollment{}
 }
 
@@ -187,7 +193,7 @@ func (self *EnrollmentManager) ReadByToken(token string) (*Enrollment, error) {
 			return nil
 		}
 
-		return enrollment.fillFrom(self, tx, boltEntity)
+		return enrollment.fillFrom(self.env, tx, boltEntity)
 	})
 
 	if err != nil {
@@ -197,11 +203,12 @@ func (self *EnrollmentManager) ReadByToken(token string) (*Enrollment, error) {
 	return enrollment, nil
 }
 
-func (self *EnrollmentManager) ReplaceWithAuthenticator(enrollmentId string, authenticator *Authenticator) error {
+func (self *EnrollmentManager) ReplaceWithAuthenticator(enrollmentId string, authenticator *Authenticator, ctx *change.Context) error {
 	return self.Dispatch(&ReplaceEnrollmentWithAuthenticatorCmd{
 		manager:       self,
 		enrollmentId:  enrollmentId,
 		authenticator: authenticator,
+		ctx:           ctx,
 	})
 }
 
@@ -225,10 +232,8 @@ func (self *EnrollmentManager) GetClientCertChain(certRaw []byte) (string, error
 	return string(clientChainPem), nil
 }
 
-func (self *EnrollmentManager) ApplyReplaceEncoderWithAuthenticatorCommand(cmd *ReplaceEnrollmentWithAuthenticatorCmd) error {
-	return self.env.GetDbProvider().GetDb().Update(func(tx *bbolt.Tx) error {
-		ctx := boltz.NewMutateContext(tx)
-
+func (self *EnrollmentManager) ApplyReplaceEncoderWithAuthenticatorCommand(cmd *ReplaceEnrollmentWithAuthenticatorCmd, ctx boltz.MutateContext) error {
+	return self.env.GetDbProvider().GetDb().Update(ctx, func(ctx boltz.MutateContext) error {
 		err := self.env.GetStores().Enrollment.DeleteById(ctx, cmd.enrollmentId)
 		if err != nil {
 			return err
@@ -255,7 +260,7 @@ func (self *EnrollmentManager) Read(id string) (*Enrollment, error) {
 	return entity, nil
 }
 
-func (self *EnrollmentManager) RefreshJwt(id string, expiresAt time.Time) error {
+func (self *EnrollmentManager) RefreshJwt(id string, expiresAt time.Time, ctx *change.Context) error {
 	enrollment, err := self.Read(id)
 
 	if err != nil {
@@ -274,17 +279,15 @@ func (self *EnrollmentManager) RefreshJwt(id string, expiresAt time.Time) error
 		return errorz.NewFieldError("must be after the current date and time", "expiresAt", expiresAt)
 	}
 
-	if err := enrollment.FillJwtInfoWithExpiresAt(self.env, *enrollment.IdentityId, expiresAt); err != nil {
+	if err = enrollment.FillJwtInfoWithExpiresAt(self.env, *enrollment.IdentityId, expiresAt); err != nil {
 		return err
 	}
 
-	err = self.Update(enrollment, fields.UpdatedFieldsMap{
+	return self.Update(enrollment, fields.UpdatedFieldsMap{
 		persistence.FieldEnrollmentJwt:       struct{}{},
 		persistence.FieldEnrollmentExpiresAt: struct{}{},
 		persistence.FieldEnrollmentIssuedAt:  struct{}{},
-	})
-
-	return err
+	}, ctx)
 }
 
 func (self *EnrollmentManager) Query(query string) ([]*Enrollment, error) {
@@ -366,13 +369,14 @@ func (self *EnrollmentManager) Unmarshall(bytes []byte) (*Enrollment, error) {
 }
 
 type ReplaceEnrollmentWithAuthenticatorCmd struct {
+	ctx           *change.Context
 	manager       *EnrollmentManager
 	enrollmentId  string
 	authenticator *Authenticator
 }
 
-func (self *ReplaceEnrollmentWithAuthenticatorCmd) Apply() error {
-	return self.manager.ApplyReplaceEncoderWithAuthenticatorCommand(self)
+func (self *ReplaceEnrollmentWithAuthenticatorCmd) Apply(ctx boltz.MutateContext) error {
+	return self.manager.ApplyReplaceEncoderWithAuthenticatorCommand(self, ctx)
 }
 
 func (self *ReplaceEnrollmentWithAuthenticatorCmd) Encode() ([]byte, error) {
@@ -382,6 +386,7 @@ func (self *ReplaceEnrollmentWithAuthenticatorCmd) Encode() ([]byte, error) {
 	}
 
 	cmd := &edge_cmd_pb.ReplaceEnrollmentWithAuthenticatorCmd{
+		Ctx:           ContextToProtobuf(self.ctx),
 		EnrollmentId:  self.enrollmentId,
 		Authenticator: authMsg,
 	}
@@ -389,6 +394,7 @@ func (self *ReplaceEnrollmentWithAuthenticatorCmd) Encode() ([]byte, error) {
 }
 
 func (self *ReplaceEnrollmentWithAuthenticatorCmd) Decode(env Env, msg *edge_cmd_pb.ReplaceEnrollmentWithAuthenticatorCmd) error {
+	self.ctx = ProtobufToContext(msg.Ctx)
 	self.manager = env.GetManagers().Enrollment
 	self.enrollmentId = msg.EnrollmentId
 	authenticator, err := env.GetManagers().Authenticator.ProtobufToAuthenticator(msg.Authenticator)
@@ -398,3 +404,7 @@ func (self *ReplaceEnrollmentWithAuthenticatorCmd) Decode(env Env, msg *edge_cmd
 	self.authenticator = authenticator
 	return nil
 }
+
+func (self *ReplaceEnrollmentWithAuthenticatorCmd) GetChangeContext() *change.Context {
+	return self.ctx
+}

controller/model/enrollment_mod_ca.go

@@ -201,7 +201,7 @@ func (module *EnrollModuleCa) completeCertAuthenticatorEnrollment(log *logrus.En
 		},
 	}
 
-	_, authenticatorId, err := module.env.GetManagers().Identity.CreateWithAuthenticator(identity, newAuthenticator)
+	_, authenticatorId, err := module.env.GetManagers().Identity.CreateWithAuthenticator(identity, newAuthenticator, context.GetChangeContext())
 
 	if err != nil {
 		log.WithError(err).Error("failed to create identity with authenticator")
@@ -264,7 +264,7 @@ func (module *EnrollModuleCa) completeExternalIdEnrollment(log *logrus.Entry, co
 
 	identity.ExternalId = &externalId
 
-	if err = module.env.GetManagers().Identity.Create(identity); err != nil {
+	if err = module.env.GetManagers().Identity.Create(identity, context.GetChangeContext()); err != nil {
 		log.WithError(err).Error("failed to create identity, enrollment failed")
 		return nil, err
 	}
@@ -281,13 +281,16 @@ func (module *EnrollModuleCa) completeExternalIdEnrollment(log *logrus.Entry, co
 }
 
 // getIdentityName returns a unique identity name based taking into account:
-//	1) the requested name from the enrolling identity
-//  2) the name formatting requirements determined by the enrolling CA
-//  3) the uniqueness of the name that is a result of 1 and 2
 //
-//  The requested name is only used if the CA's name format allows it to be used.
+//  1. the requested name from the enrolling identity
 //
-//  If the resulting name is not unique a six digit zero-padded numerical suffix is appended (i.e. 000001).
+//  2. the name formatting requirements determined by the enrolling CA
+//
+//  3. the uniqueness of the name that is a result of 1 and 2
+//
+//     The requested name is only used if the CA's name format allows it to be used.
+//
+//     If the resulting name is not unique a six digit zero-padded numerical suffix is appended (i.e. 000001).
 func (module *EnrollModuleCa) getIdentityName(ca *Ca, enrollmentCert *x509.Certificate, requestedName string, identityId string) string {
 	formatter := NewIdentityNameFormatter(ca, enrollmentCert, requestedName, identityId)
 	nameFormat := ca.IdentityNameFormat

controller/model/enrollment_mod_erott.go

@@ -127,11 +127,11 @@ func (module *EnrollModuleEr) Process(context EnrollmentContext) (*EnrollmentRes
 	edgeRouter.CertPem = &clientCertPemStr
 	edgeRouter.IsVerified = true
 	edgeRouter.Fingerprint = &clientCertFingerprint
-	if err := module.env.GetManagers().EdgeRouter.Update(edgeRouter, true, nil); err != nil {
+	if err := module.env.GetManagers().EdgeRouter.Update(edgeRouter, true, nil, context.GetChangeContext()); err != nil {
 		return nil, fmt.Errorf("could not update edge router: %s", err)
 	}
 
-	if err := module.env.GetManagers().Enrollment.Delete(enrollment.Id); err != nil {
+	if err := module.env.GetManagers().Enrollment.Delete(enrollment.Id, context.GetChangeContext()); err != nil {
 		return nil, fmt.Errorf("could not delete enrollment: %s", err)
 	}