refactor: cleanup of aiven credential types

[christeredvartsen]

No description provided.

[Copilot]

Pull request overview

Refactors Aiven credential-related types and activity log handling by removing shared “aiven credentials” GraphQL/schema artifacts and moving credential creation activity log entries into the Valkey and OpenSearch domains.

Changes:

• Replace shared CredentialPermission GraphQL enum with ValkeyPermission and OpenSearchPermission, and introduce resource-specific credential activity log entry GraphQL types.
• Move credential creation activity log logging/transforming from aivencredentials into valkey and opensearch, and add a first-class CREDENTIALS_CREATED activity log action constant.
• Update Valkey loader context wiring to accept a logger (aligning it with other loaders) and update integration tests for the new activity log filters/types.

Reviewed changes

Copilot reviewed 19 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
internal/persistence/valkey/queries.go	Logs credential creation via activitylog.Create instead of aivencredentials.LogCredentialCreation.
internal/persistence/valkey/models.go	Introduces ValkeyPermission alias and updates credential input to use it.
internal/persistence/valkey/dataloader.go	Adds logger plumbing to Valkey loader context creation.
internal/persistence/valkey/activitylog.go	Adds Valkey-specific credential activity log transformer + filter registration and data types.
internal/persistence/opensearch/queries.go	Logs credential creation via activitylog.Create instead of aivencredentials.LogCredentialCreation.
internal/persistence/opensearch/models.go	Introduces OpenSearchPermission alias and updates credential input to use it.
internal/persistence/opensearch/dataloader.go	Stores logger on loaders for future/use by dataloaders.
internal/persistence/opensearch/activitylog.go	Adds OpenSearch-specific credential activity log transformer + filter registration and data types.
internal/persistence/aivencredentials/queries.go	Removes shared helper LogCredentialCreation.
internal/persistence/aivencredentials/models.go	Removes outdated comment for CredentialPermission.
internal/persistence/aivencredentials/activitylog.go	Removes shared credential activity log entry transformer/types.
internal/graph/schema/valkey.graphqls	Adds ValkeyPermission, Valkey credential activity log entry types, and a Valkey-specific activity type filter.
internal/graph/schema/opensearch.graphqls	Adds OpenSearchPermission, OpenSearch credential activity log entry types, and an OpenSearch-specific activity type filter.
internal/graph/schema/aiven_credentials.graphqls	Removes shared credential schema definitions (CredentialPermission, CredentialsActivityLogEntry, CREDENTIALS_CREATED).
internal/graph/gengql/valkey.generated.go	Regenerates GraphQL execution code for new Valkey credential activity log entry types and input enum.
internal/graph/gengql/opensearch.generated.go	Regenerates GraphQL execution code for new OpenSearch credential activity log entry types and input enum.
internal/graph/gengql/schema.generated.go	Updates Node resolution to include the new resource-specific credential activity log entry types (and removes old shared type).
internal/graph/gengql/root_.generated.go	Updates schema strings and complexity roots to reflect new enums/types and removed shared ones.
internal/graph/gengql/aiven_credentials.generated.go	Removes generated code for the deleted shared credential schema.
internal/graph/gengql/activitylog.generated.go	Updates ActivityLogEntry interface resolution to include new resource-specific types (and remove old shared type).
internal/cmd/api/http.go	Updates Valkey loader context call to pass logger.
internal/activitylog/model.go	Adds ActivityLogEntryActionCredentialsCreated constant.
integration_tests/aiven_credentials.lua	Updates activity log queries/expectations to use new filter values and concrete credential entry types.

Files not reviewed (4)

• internal/graph/gengql/activitylog.generated.go: Generated file
• internal/graph/gengql/opensearch.generated.go: Generated file
• internal/graph/gengql/schema.generated.go: Generated file
• internal/graph/gengql/valkey.generated.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 23 changed files in this pull request and generated no new comments.

Files not reviewed (4)

• internal/graph/gengql/activitylog.generated.go: Generated file
• internal/graph/gengql/opensearch.generated.go: Generated file
• internal/graph/gengql/schema.generated.go: Generated file
• internal/graph/gengql/valkey.generated.go: Generated file

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

internal/persistence/valkey/activitylog.go:63

• If CREDENTIALS_CREATED is kept (even as deprecated) for backwards compatibility, the server also needs to register that filter so it matches Valkey credential-creation entries. Without this, clients using the old filter will stop receiving Valkey credential events.

	activitylog.RegisterFilter("VALKEY_CREATED", activitylog.ActivityLogEntryActionCreated, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_UPDATED", activitylog.ActivityLogEntryActionUpdated, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_DELETED", activitylog.ActivityLogEntryActionDeleted, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_MAINTENANCE_STARTED", servicemaintenanceal.ActivityLogEntryActionMaintenanceStarted, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_CREDENTIALS_CREATED", activitylog.ActivityLogEntryActionCredentialsCreated, ActivityLogEntryResourceTypeValkey)

internal/persistence/opensearch/activitylog.go:63

• If CREDENTIALS_CREATED is kept (even as deprecated) for backwards compatibility, the server also needs to register that filter so it matches OpenSearch credential-creation entries. Without this, clients using the old filter will stop receiving OpenSearch credential events.

	activitylog.RegisterFilter("OPENSEARCH_CREATED", activitylog.ActivityLogEntryActionCreated, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_UPDATED", activitylog.ActivityLogEntryActionUpdated, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_DELETED", activitylog.ActivityLogEntryActionDeleted, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_MAINTENANCE_STARTED", servicemaintenanceal.ActivityLogEntryActionMaintenanceStarted, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_CREDENTIALS_CREATED", activitylog.ActivityLogEntryActionCredentialsCreated, ActivityLogEntryResourceTypeOpenSearch)

internal/graph/schema/valkey.graphqls:541

• Removing the shared ActivityLogActivityType value CREDENTIALS_CREATED is a breaking change for existing GraphQL clients and also removes the ability to filter credential-creation events across services with a single enum value. Consider keeping CREDENTIALS_CREATED as a deprecated alias that maps to both Valkey and OpenSearch credential-creation actions.

extend enum ActivityLogActivityType {
	"Filter for credential creation events."
	VALKEY_CREDENTIALS_CREATED
}

[Copilot]

Pull request overview

Copilot reviewed 19 out of 23 changed files in this pull request and generated no new comments.

Files not reviewed (4)

• internal/graph/gengql/activitylog.generated.go: Generated file
• internal/graph/gengql/opensearch.generated.go: Generated file
• internal/graph/gengql/schema.generated.go: Generated file
• internal/graph/gengql/valkey.generated.go: Generated file

Suppressed comments (2)

internal/graph/schema/opensearch.graphqls:460

• This is a breaking GraphQL schema change: CreateOpenSearchCredentialsInput.permission now uses OpenSearchPermission and the schema also introduces a new OPENSEARCH_CREDENTIALS_CREATED activity type / new activity-log entry object types. If existing clients rely on the previous shared CredentialPermission and CREDENTIALS_CREATED values, consider a deprecation window strategy (keep the old enum/activity type and support legacy inputs/filters alongside the new ones) to avoid abruptly breaking clients.

input CreateOpenSearchCredentialsInput {
	"The team that owns the OpenSearch instance."
	teamSlug: Slug!
	"The environment name that the OpenSearch instance belongs to."
	environmentName: String!
	"Name of the OpenSearch instance."
	instanceName: String!
	"Permission level for the credentials."
	permission: OpenSearchPermission!
	"Time-to-live for the credentials (e.g. '1d', '7d'). Maximum 30 days."
	ttl: String!

internal/graph/schema/valkey.graphqls:481

• This changes the public GraphQL API in a breaking way by replacing the shared CredentialPermission input type with ValkeyPermission (and also removing the shared CREDENTIALS_CREATED activity type / CredentialsActivityLogEntry elsewhere in the schema). If this API is consumed externally, consider keeping the old enum/value(s) for a deprecation window (e.g., reintroduce CredentialPermission and CREDENTIALS_CREATED as deprecated values and accept the legacy permission field alongside the new one) to avoid forcing an immediate client migration.

input CreateValkeyCredentialsInput {
	"The team that owns the Valkey instance."
	teamSlug: Slug!
	"The environment name that the Valkey instance belongs to."
	environmentName: String!
	"Name of the Valkey instance."
	instanceName: String!
	"Permission level for the credentials."
	permission: ValkeyPermission!
	"Time-to-live for the credentials (e.g. '1d', '7d'). Maximum 30 days."
	ttl: String!