Audit records now attribute registered-operation writes to the authenticated user

[kriszyp]

Summary

Operation handlers that write via the static Resource API without an explicit context (table.put(id, record) etc.) produced audit records with user: undefined, because nothing bridged the authenticated req.body.hdb_user into the ambient AsyncLocalStorage context the transactional wrappers fall back to. This affected registerOperation-based (component-registered) operations; built-in CRUD was unaffected (ResourceBridge builds explicit contexts).

Fix at the dispatch layer (invariant, not per-handler): processLocalTransaction now runs the operation function inside a user-bearing ambient context. Closes #1591 (full root-cause chain there).

Semantics (where to look)

The small change in serverUtilities.ts has four deliberate behaviors, each pinned by a regression test:

• Explicit contexts still win — the transactional wrappers only consult contextStorage when no context argument is passed.
• Same-user ambient context is preserved untouched — server.operation() called from inside a component request handler keeps the exact request context object (open transaction, response), avoiding any semantics change on that embedded path (currentStore?.user !== hdbUser, object identity — the embedded path passes the same hdb_user reference).
• Different-user (or user-over-userless) contexts merge — the wrap spreads the current ambient context and swaps only the user ({ ...currentStore, user: hdbUser }): the ambient transaction, signal, and caches are preserved (atomicity intact), while attribution — which is captured per-write — follows the new user. The outer context object is never mutated. (This was replace-not-merge in the first revision; gemini-code-assist's review correctly flagged that replacing discards an ambient transaction, breaking atomicity for nested dispatch — adopted in 050e70c9c.)
• No hdb_user → no wrap — both absent and the explicit hdb_user: null set by the unauthenticated-allowed path; internal bypass_auth dispatch and legacy-clustering catchup are unchanged (catchup writes attribute explicitly through the dataLayer anyway).

All contextStorage.getStore() consumers in core were audited for dependence on an empty ambient context during op execution; none found (details in #1591). Behavioral note: overlapping no-context writes within one handler (e.g. Promise.all) now share one ambient context and can join one transaction — same machinery and semantics as the REST per-request path; sequential writes still get separate transactions.

Known residual (pre-existing, out of scope): jobProcess.ts invokes built-in job ops bare; registered ops cannot dispatch via the job process today, but if that's ever added it needs the same wrap.

Tests

• unitTests/server/serverHelpers/serverUtilities.test.js — the ambient-context seam, all quadrants: wraps with hdb_user; no wrap when absent; no wrap when explicitly null; same-user ambient preserved (exact object); different-user merge (transaction identity + request state preserved, user swapped, outer object unmutated); userless-ambient merge (transaction preserved, user added).
• unitTests/resources/operationContextUser.test.js (new) — end-to-end: static put inside an op is attributed in the audit record; explicit context wins; unattributed without hdb_user.
• Adjacent suites green locally (auditLog, transaction, MCP operations); full unit suites left to CI.

No docs changes needed: bug fix to existing audit behavior, no new API/config surface.

Review

Generated by an LLM (Claude — Fable 5), reviewed by Kris. Cross-model review complete (thorough: Codex leg + Gemini leg + Harper-domain adjudication): no blockers in the adjudicated pass; gemini-code-assist's PR review then correctly identified that the first revision's different-user path replaced rather than merged the ambient context — adopted (see Semantics above; threads resolved with rationale). Remaining suggestions were applied (hdb_user: null contract test, merge-preservation tests) or rejected with rationale (optional chaining on req.body — unreachable; ALS-overhead concern — ops dispatch is not the nanosecond-hot path and transaction() already runs contextStorage.run per write).

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request addresses issue #1591 by bridging the authenticated user into the ambient async context during local transaction processing, ensuring static Resource API calls inherit user attribution for audit records. The review feedback highlights a critical issue where replacing the ambient context discards other existing context properties (such as transaction or cache state), potentially breaking transactional safety. It is recommended to merge the existing context instead of replacing it entirely, and to add a corresponding unit test to verify that other context properties are preserved.

[claude]

Reviewed; no blockers found.