Pull request overview

Refactors Aiven credential-related types and activity log handling by removing shared “aiven credentials” GraphQL/schema artifacts and moving credential creation activity log entries into the Valkey and OpenSearch domains.

Changes:

• Replace shared CredentialPermission GraphQL enum with ValkeyPermission and OpenSearchPermission, and introduce resource-specific credential activity log entry GraphQL types.
• Move credential creation activity log logging/transforming from aivencredentials into valkey and opensearch, and add a first-class CREDENTIALS_CREATED activity log action constant.
• Update Valkey loader context wiring to accept a logger (aligning it with other loaders) and update integration tests for the new activity log filters/types.

Reviewed changes

Copilot reviewed 19 out of 23 changed files in this pull request and generated 5 comments.

• internal/graph/gengql/activitylog.generated.go: Generated file
• internal/graph/gengql/opensearch.generated.go: Generated file
• internal/graph/gengql/schema.generated.go: Generated file
• internal/graph/gengql/valkey.generated.go: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Pull request overview

Copilot reviewed 19 out of 23 changed files in this pull request and generated no new comments.

• internal/graph/gengql/activitylog.generated.go: Generated file
• internal/graph/gengql/opensearch.generated.go: Generated file
• internal/graph/gengql/schema.generated.go: Generated file
• internal/graph/gengql/valkey.generated.go: Generated file

Previously missed (2) — in code that hasn't changed since the last review.

internal/persistence/valkey/activitylog.go:63

• If CREDENTIALS_CREATED is kept (even as deprecated) for backwards compatibility, the server also needs to register that filter so it matches Valkey credential-creation entries. Without this, clients using the old filter will stop receiving Valkey credential events.

	activitylog.RegisterFilter("VALKEY_CREATED", activitylog.ActivityLogEntryActionCreated, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_UPDATED", activitylog.ActivityLogEntryActionUpdated, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_DELETED", activitylog.ActivityLogEntryActionDeleted, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_MAINTENANCE_STARTED", servicemaintenanceal.ActivityLogEntryActionMaintenanceStarted, ActivityLogEntryResourceTypeValkey)
	activitylog.RegisterFilter("VALKEY_CREDENTIALS_CREATED", activitylog.ActivityLogEntryActionCredentialsCreated, ActivityLogEntryResourceTypeValkey)

internal/persistence/opensearch/activitylog.go:63

• If CREDENTIALS_CREATED is kept (even as deprecated) for backwards compatibility, the server also needs to register that filter so it matches OpenSearch credential-creation entries. Without this, clients using the old filter will stop receiving OpenSearch credential events.

	activitylog.RegisterFilter("OPENSEARCH_CREATED", activitylog.ActivityLogEntryActionCreated, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_UPDATED", activitylog.ActivityLogEntryActionUpdated, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_DELETED", activitylog.ActivityLogEntryActionDeleted, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_MAINTENANCE_STARTED", servicemaintenanceal.ActivityLogEntryActionMaintenanceStarted, ActivityLogEntryResourceTypeOpenSearch)
	activitylog.RegisterFilter("OPENSEARCH_CREDENTIALS_CREATED", activitylog.ActivityLogEntryActionCredentialsCreated, ActivityLogEntryResourceTypeOpenSearch)

internal/graph/schema/valkey.graphqls:541

• Removing the shared ActivityLogActivityType value CREDENTIALS_CREATED is a breaking change for existing GraphQL clients and also removes the ability to filter credential-creation events across services with a single enum value. Consider keeping CREDENTIALS_CREATED as a deprecated alias that maps to both Valkey and OpenSearch credential-creation actions.

extend enum ActivityLogActivityType {
	"Filter for credential creation events."
	VALKEY_CREDENTIALS_CREATED
}

Pull request overview

Copilot reviewed 19 out of 23 changed files in this pull request and generated no new comments.

• internal/graph/gengql/activitylog.generated.go: Generated file
• internal/graph/gengql/opensearch.generated.go: Generated file
• internal/graph/gengql/schema.generated.go: Generated file
• internal/graph/gengql/valkey.generated.go: Generated file

internal/graph/schema/opensearch.graphqls:460

• This is a breaking GraphQL schema change: CreateOpenSearchCredentialsInput.permission now uses OpenSearchPermission and the schema also introduces a new OPENSEARCH_CREDENTIALS_CREATED activity type / new activity-log entry object types. If existing clients rely on the previous shared CredentialPermission and CREDENTIALS_CREATED values, consider a deprecation window strategy (keep the old enum/activity type and support legacy inputs/filters alongside the new ones) to avoid abruptly breaking clients.

input CreateOpenSearchCredentialsInput {
	"The team that owns the OpenSearch instance."
	teamSlug: Slug!
	"The environment name that the OpenSearch instance belongs to."
	environmentName: String!
	"Name of the OpenSearch instance."
	instanceName: String!
	"Permission level for the credentials."
	permission: OpenSearchPermission!
	"Time-to-live for the credentials (e.g. '1d', '7d'). Maximum 30 days."
	ttl: String!

internal/graph/schema/valkey.graphqls:481

• This changes the public GraphQL API in a breaking way by replacing the shared CredentialPermission input type with ValkeyPermission (and also removing the shared CREDENTIALS_CREATED activity type / CredentialsActivityLogEntry elsewhere in the schema). If this API is consumed externally, consider keeping the old enum/value(s) for a deprecation window (e.g., reintroduce CredentialPermission and CREDENTIALS_CREATED as deprecated values and accept the legacy permission field alongside the new one) to avoid forcing an immediate client migration.

input CreateValkeyCredentialsInput {
	"The team that owns the Valkey instance."
	teamSlug: Slug!
	"The environment name that the Valkey instance belongs to."
	environmentName: String!
	"Name of the Valkey instance."
	instanceName: String!
	"Permission level for the credentials."
	permission: ValkeyPermission!
	"Time-to-live for the credentials (e.g. '1d', '7d'). Maximum 30 days."
	ttl: String!