feat: preserve automation actor provenance

tests/test_triggers.py

@@ -97,15 +97,20 @@ class CurrentPrincipalProvider:
     def __init__(self, actor: ApiPrincipal, *, allowed: bool = True) -> None:
         self.actor = actor
         self.allowed = allowed
+        self.last_request = None
 
     def resolve_automation_principal(self, _session, *, request):
+        self.last_request = request
         return AutomationPrincipalResolution(
             allowed=self.allowed,
             principal=self.actor if self.allowed else None,
             reason=None if self.allowed else "Owner authorization revoked.",
             granted_scopes=tuple(request.grant_scopes) if self.allowed else (),
             missing_scopes=() if self.allowed else tuple(request.grant_scopes),
-            provenance={"status": "current" if self.allowed else "revoked"},
+            provenance={
+                "status": "current" if self.allowed else "revoked",
+                "event_actor": request.context.get("event_actor"),
+            },
         )
 
 
@@ -116,12 +121,13 @@ class Registry:
         *,
         automation_allowed: bool = True,
     ) -> None:
+        self.automation_provider = CurrentPrincipalProvider(
+            actor,
+            allowed=automation_allowed,
+        )
         self.capabilities = {
             POLICY_CAPABILITY: AllowDefinitionPolicy(),
-            AUTOMATION_CAPABILITY: CurrentPrincipalProvider(
-                actor,
-                allowed=automation_allowed,
-            ),
+            AUTOMATION_CAPABILITY: self.automation_provider,
         }
 
     def has_capability(self, name: str) -> bool:
@@ -322,6 +328,11 @@ class DataflowTriggerTests(unittest.TestCase):
             module_id="files",
             payload={"folder_id": "incoming", "file_id": "file-1"},
             occurred_at=utcnow(),
+            actor={
+                "type": "user",
+                "id": "account-2",
+                "label": "Uploader",
+            },
         )
 
         self.assertEqual(
@@ -355,6 +366,22 @@ class DataflowTriggerTests(unittest.TestCase):
         self.assertEqual(1, result.succeeded)
         self.assertEqual("event", run.invocation_kind)
         self.assertEqual("event-1", run.request_["invocation"]["event_id"])
+        self.assertEqual(
+            {
+                "type": "user",
+                "id": "account-2",
+                "label": "Uploader",
+            },
+            self.registry.automation_provider.last_request.context[
+                "event_actor"
+            ],
+        )
+        self.assertEqual(
+            "account-2",
+            run.request_["invocation"]["metadata"][
+                "authorization_provenance"
+            ]["event_actor"]["id"],
+        )
 
     def test_revoked_owner_blocks_delivery_before_execution(self) -> None:
         trigger = self._event_trigger()