Adds creator auditing for custom workflow-run states

[raylrui]

Summary

Resolve #174

Adds creator auditing and JWT-based authorization for custom workflow-run states (DEPRECATED, RESOLVED, and CANCELLED).

Changes

• Added a nullable State.created_by field with no data backfill.
• Records the normalized Bearer JWT email claim when creating custom states.
• Requires Bearer JWT authentication for:
  • Custom state creation.
  • State comment updates.
• Restricts comment updates to the state creator when created_by is populated.
• Allows any authenticated user to update legacy states where created_by is null.
• Exposes createdBy in state history and workflow-run currentState responses.
• Ignores client-supplied createdBy; ownership always comes from the JWT.
• State comment updates continue to emit no WRSC event.

WRSC Changes

• Added optional createdBy to the WRSC schema and generated Pydantic model.
• Bumped the WRSC version from 1.0.0 to 1.1.0.
• Included createdBy in WRSC event hashing.
• System-originated states remain unauthored and omit createdBy from emitted events.
• Updated the WRSC examples and schema documentation.

Migration

Existing states retain created_by = null. No ownership is inferred or backfilled.

Compatibility Notes

• Custom state creation and state comment PATCH endpoints now require a valid Bearer JWT containing an email claim.
• createdBy remains optional in WRSC for backward compatibility.
• JWT signature verification remains delegated to API Gateway, consistent with the existing authentication helper.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Adds creator auditing and authorization for custom workflow-run states.

Changes:

• Persists and exposes normalized state creator emails.
• Enforces JWT authentication and creator-only comment updates.
• Extends WRSC v1.1.0 schemas, events, hashing, examples, and tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
WorkflowRunStateChange.schema.yaml	Defines optional createdBy.
WorkflowRunStateChange.schema.json	Adds generated createdBy property.
WRSC__example1.json	Updates event version.
WRSC__example2.json	Demonstrates creator auditing.
viewsets/state.py	Adds authentication and ownership checks.
tests/test_state_viewset.py	Tests auditing and authorization.
tests/test_event_bridge.py	Tests WRSC creator emission.
serializers/state.py	Exposes state creators.
models/state.py	Adds creator persistence.
0024_state_created_by.py	Migrates the nullable field.
workflow_manager_proc/tests/test_workflow_run.py	Tests WRSC mapping and hashing.
workflow_manager_proc/services/workflow_run.py	Maps and hashes createdBy.
domain/event/wrsc.py	Adds createdBy to the generated model.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.