Revoke Grant Events

[mj-palanker]

Creates the new revoke grant event types in the event feed.

Summary by CodeRabbit

• New Features
  • Added automated tracking and logging of user removals from group memberships for improved audit visibility.

[coderabbitai]

Walkthrough

A new event filter named CreateRevokeFilter was introduced to handle group membership removal events. The filter validates one UserGroup and one User target, constructs resources accordingly, and emits a CreateRevokeEvent with a "member" entitlement. The filter was registered in the active filter list used by event log operations.

Changes

Cohort / File(s)	Summary
New EventFilter Implementation pkg/connector/event_filters.go	Introduced CreateRevokeFilter EventFilter that processes group.user_membership.remove events. Validates exactly one UserGroup and one User target, constructs group resource and user principal, creates user email trait, and emits CreateRevokeEvent with "member" entitlement type. Includes debug logging.
Filter Registration pkg/connector/event_log.go	Added CreateRevokeFilter to the active event filter list in ListEvents, enabling it to participate in filter mappings and query parameter construction.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Filter implementation closely mirrors the existing CreateGrantFilter pattern, reducing cognitive overhead
• Straightforward validation logic and event emission
• Registration is a simple list addition with no conditional logic
• No architectural changes or complex interactions introduced

Poem

🐰 A rabbit's gentle revoke,
When memberships must go,
With one group and one user spoke,
The removal seeds we sow,
No more "member" to invoke!

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Revoke Grant Events' directly aligns with the PR's objective to create new revoke grant event types, matching the CreateRevokeFilter implementation for handling group.user_membership.remove events.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch mjp/revoke-event

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

pkg/connector/event_filters.go (1)

88-133: LGTM! Revoke filter correctly mirrors the grant filter.

The CreateRevokeFilter implementation is correct and appropriately handles group membership removal events. The logic properly validates targets, constructs resources and principals, attaches user trait annotations, and emits the revoke event.

The code is nearly identical to CreateGrantFilter (lines 42-87). If additional grant/revoke filters are added in the future, consider extracting the shared logic into a helper function to reduce duplication. For now, the duplication is acceptable and keeps the filters self-contained and clear.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d3cd357 and b3cddba.

📒 Files selected for processing (2)

• pkg/connector/event_filters.go (1 hunks)
• pkg/connector/event_log.go (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (2)

pkg/connector/event_log.go (1)

pkg/connector/event_filters.go (1)

• CreateRevokeFilter (88-133)

pkg/connector/event_filters.go (1)

pkg/connector/event_filter.go (1)

• EventFilter (16-26)

🔇 Additional comments (1)

pkg/connector/event_log.go (1)

51-51: LGTM! Filter correctly registered.

The CreateRevokeFilter is properly added to the active filters list and will participate in event processing as expected.

[laurenleach]

AlternateId is the email?