feat: preserve automation actor provenance

src/govoplan_dataflow/backend/schemas.py

@@ -429,6 +429,16 @@ class DataflowTriggerDeliveryListResponse(BaseModel):
     deliveries: list[DataflowTriggerDeliveryResponse]
 
 
+class DataflowEventActor(BaseModel):
+    type: str = Field(
+        min_length=1,
+        max_length=100,
+        pattern=r"^[A-Za-z0-9_.:-]+$",
+    )
+    id: str | None = Field(default=None, max_length=255)
+    label: str | None = Field(default=None, max_length=300)
+
+
 class DataflowEventDeliveryRequest(BaseModel):
     event_id: str = Field(min_length=1, max_length=128)
     type: str = Field(
@@ -445,6 +455,7 @@ class DataflowEventDeliveryRequest(BaseModel):
     occurred_at: datetime
     correlation_id: str | None = Field(default=None, max_length=128)
     causation_id: str | None = Field(default=None, max_length=128)
+    actor: DataflowEventActor | None = None
     classification: Literal[
         "public",
         "internal",

src/govoplan_dataflow/backend/triggers.py

@@ -746,9 +746,10 @@ def _dispatch_delivery(
             now=now,
             error="Access automation-principal capability is unavailable.",
         )
+    event = delivery.event_ or {}
     resolution = provider.resolve_automation_principal(
         session,
-        request=AutomationPrincipalRequest(
+        request=AutomationPrincipalRequest.delegated_user(
             tenant_id=trigger.tenant_id,
             account_id=trigger.authorization_account_id,
             membership_id=trigger.authorization_membership_id,
@@ -760,6 +761,8 @@ def _dispatch_delivery(
                 "delivery_ref": (
                     f"dataflow-trigger-delivery:{delivery.id}"
                 ),
+                "event_actor": event.get("actor"),
+                "operator_override": event.get("operator_override"),
             },
         ),
     )
@@ -783,7 +786,6 @@ def _dispatch_delivery(
             action="automate",
         )
         publication = _publication_target(trigger)
-        event = delivery.event_ or {}
         run, _ = start_pipeline_run(
             session,
             tenant_id=trigger.tenant_id,
@@ -813,6 +815,11 @@ def _dispatch_delivery(
                     causation_id=_optional_text(event.get("causation_id")),
                     scheduled_for=delivery.scheduled_for,
                     requested_by=trigger.authorization_account_id,
+                    metadata={
+                        "authorization_provenance": dict(
+                            resolution.provenance
+                        )
+                    },
                 ),
             ),
         )
@@ -968,6 +975,11 @@ class SqlDataflowTriggerDispatcher:
                 occurred_at=event.occurred_at,
                 correlation_id=event.correlation_id,
                 causation_id=event.causation_id,
+                actor=(
+                    event.actor.to_dict()
+                    if event.actor is not None
+                    else None
+                ),
                 classification=event.classification,
             ),
         )