refactor: typed event payload structs + roundtrip tests (PR F of cleanup) (#192)

* refactor: typed event payload structs + roundtrip tests (PR F of cleanup)

Server-only refactor; no SDK or proto changes.

Promotes the projector decoder Raw structs to exported payload
structs in a shared internal/eventtypes/payloads/ package. Handler
emit sites now construct typed structs instead of map[string]any
literals. Catches handler/projector schema drift at compile time
— exactly the bug class behind issue #135's partial-write hazard.

One enabler change: store.Event.Data type is broadened from
map[string]any to any so call sites can pass typed structs.
AppendEvent's existing JSON marshal accepts any JSON-marshalable
value; legacy map-literal call sites continue to compile unchanged.

Files created:
- internal/eventtypes/payloads/{user,device,action,assignment,
  execution,lps_password,luks_key}.go — 36 typed payload structs
  across 7 stream types
- internal/eventtypes/payloads/doc.go — package docs
- internal/eventtypes/payloads/payloads_test.go — 32 roundtrip
  tests (one per payload), each marshal → unmarshal → assert.Equal

Files modified:
- internal/store/store.go — Event.Data: any
- internal/projectors/{user,device,action,assignment,execution,
  lps_password,luks_key}.go — decoders use payloads.X structs
- ~30 handler emit sites converted to typed payloads:
  - internal/api/user_handler.go — 11 sites
  - internal/api/device_handler.go — 6 sites
  - internal/api/registration_handler.go — DeviceRegistered
  - internal/api/certificate_handler.go — DeviceCertRenewed
  - internal/api/system_actions.go — AssignmentCreated +
    UserSystemActionLinked
  - internal/control/inbox_worker.go — 5 execution sites +
    introduced commandOutputPayload helper

Deferred to PR G (final tech-debt audit): ~50 emit sites still
use map[string]any. They continue to work because Event.Data is
now any, but they don't get the compile-time schema-drift
guarantee. Mechanical follow-up: add payload structs in remaining
files (action.go, internal_handler.go, idp/sso/auth handlers,
SCIM, role/group handlers, settings, totp, terminal, compliance)
and update emit sites.

Note: lps_password and luks_key payload structs preserve the
masked LogValue() method from the projector originals so neither
password nor passphrase can leak into slog output.

Part of the 2026.06 cleanup-release sweep. PR G (final audit)
follows.

* test: redaction + RawCommandOutput contract tests (CR catches on PR #192)

Three nitpick test additions from CR review:

- TestLpsPasswordRotated_LogValueMasksPassword: locks the
  security guarantee — routing the payload through slog (e.g.
  slog.Warn("...", "payload", payload)) must NEVER emit the raw
  Password value. Asserts both 'NotContains(secret)' and
  'Contains([REDACTED])'.
- TestLuksKeyRotated_LogValueMasksPassphrase: sibling for LUKS.
- TestRawCommandOutput_NilOmitted +
  TestRawCommandOutput_ProducesObject: locks the wire contract
  used by ExecutionTerminal / ExecutionTimedOut. Nil input
  produces nil so omitempty fires; non-nil input produces a
  JSON object (NOT a quoted string), with the exact legacy keys
  (stdout, stderr, exit_code), and round-trips cleanly through
  ExecutionTerminal.

* test: assert exact legacy key count + omitempty parent contract (CR catches on PR #192)

Two more nitpick test tightenings from CR review:

- TestRoundtrip_CommandOutput + TestRawCommandOutput_ProducesObject:
  added assert.Len(asMap, 3) so an extra key (regression where a
  new field gets added to CommandOutput) would fail the test.
- TestRawCommandOutput_NilOmitted: added end-to-end omitempty
  contract assertion via ExecutionTerminal — marshal a payload
  with Output: RawCommandOutput(nil) and assert the wire JSON
  does NOT contain the 'output' key. Without this the helper
  could regress to []byte('null') and we'd only catch it via
  downstream projector failures.

Author: PaulDotterer

internal/api/certificate_handler.go

@@ -12,6 +12,7 @@ import (
 	pm "github.com/manchtools/power-manage/sdk/gen/go/pm/v1"
 	"github.com/manchtools/power-manage/server/internal/ca"
 	"github.com/manchtools/power-manage/server/internal/eventtypes"
+	"github.com/manchtools/power-manage/server/internal/eventtypes/payloads"
 	"github.com/manchtools/power-manage/server/internal/store"
 	db "github.com/manchtools/power-manage/server/internal/store/generated"
 )
@@ -82,13 +83,15 @@ func (h *CertificateHandler) RenewCertificate(ctx context.Context, req *connect.
 	}
 
 	// Emit DeviceCertRenewed event (projection handler already exists in migration 001)
+	fingerprint := newCert.Fingerprint
+	notAfterStr := newCert.NotAfter.Format(time.RFC3339)
 	if err := h.store.AppendEvent(ctx, store.Event{
 		StreamType: "device",
 		StreamID:   deviceID,
 		EventType:  string(eventtypes.DeviceCertRenewed),
-		Data: map[string]any{
-			"cert_fingerprint": newCert.Fingerprint,
-			"cert_not_after":   newCert.NotAfter.Format(time.RFC3339),
+		Data: payloads.DeviceCertRenewed{
+			CertFingerprint: &fingerprint,
+			CertNotAfter:    &notAfterStr,
 		},
 		ActorType: "device",
 		ActorID:   deviceID,

internal/api/device_handler.go

@@ -22,6 +22,7 @@ import (
 	"github.com/manchtools/power-manage/server/internal/auth"
 	"github.com/manchtools/power-manage/server/internal/crypto"
 	"github.com/manchtools/power-manage/server/internal/eventtypes"
+	"github.com/manchtools/power-manage/server/internal/eventtypes/payloads"
 	"github.com/manchtools/power-manage/server/internal/middleware"
 	"github.com/manchtools/power-manage/server/internal/search"
 	"github.com/manchtools/power-manage/server/internal/store"
@@ -215,9 +216,9 @@ func (h *DeviceHandler) SetDeviceLabel(ctx context.Context, req *connect.Request
 		StreamType: "device",
 		StreamID:   req.Msg.Id,
 		EventType:  string(eventtypes.DeviceLabelSet),
-		Data: map[string]any{
-			"key":   req.Msg.Key,
-			"value": req.Msg.Value,
+		Data: payloads.DeviceLabelSet{
+			Key:   &req.Msg.Key,
+			Value: &req.Msg.Value,
 		},
 		ActorType: "user",
 		ActorID:   userCtx.ID,
@@ -260,8 +261,8 @@ func (h *DeviceHandler) RemoveDeviceLabel(ctx context.Context, req *connect.Requ
 		StreamType: "device",
 		StreamID:   req.Msg.Id,
 		EventType:  string(eventtypes.DeviceLabelRemoved),
-		Data: map[string]any{
-			"key": req.Msg.Key,
+		Data: payloads.DeviceLabelRemoved{
+			Key: &req.Msg.Key,
 		},
 		ActorType: "user",
 		ActorID:   userCtx.ID,
@@ -375,12 +376,13 @@ func (h *DeviceHandler) AssignDevice(ctx context.Context, req *connect.Request[p
 			return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to get user")
 		}
 
+		uid := userID
 		if err := appendEvent(ctx, h.store, h.logger, store.Event{
 			StreamType: "device",
 			StreamID:   req.Msg.DeviceId,
 			EventType:  string(eventtypes.DeviceAssigned),
-			Data: map[string]any{
-				"user_id": userID,
+			Data: payloads.DeviceUserAssignment{
+				UserID: &uid,
 			},
 			ActorType: "user",
 			ActorID:   userCtx.ID,
@@ -403,12 +405,13 @@ func (h *DeviceHandler) AssignDevice(ctx context.Context, req *connect.Request[p
 			return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to get user group")
 		}
 
+		gid := groupID
 		if err := appendEvent(ctx, h.store, h.logger, store.Event{
 			StreamType: "device",
 			StreamID:   req.Msg.DeviceId,
 			EventType:  string(eventtypes.DeviceGroupAssigned),
-			Data: map[string]any{
-				"group_id": groupID,
+			Data: payloads.DeviceGroupAssignment{
+				GroupID: &gid,
 			},
 			ActorType: "user",
 			ActorID:   userCtx.ID,
@@ -480,8 +483,8 @@ func (h *DeviceHandler) UnassignDevice(ctx context.Context, req *connect.Request
 			StreamType: "device",
 			StreamID:   req.Msg.DeviceId,
 			EventType:  string(eventtypes.DeviceUnassigned),
-			Data: map[string]any{
-				"user_id": req.Msg.UserId,
+			Data: payloads.DeviceUserAssignment{
+				UserID: &req.Msg.UserId,
 			},
 			ActorType: "user",
 			ActorID:   userCtx.ID,
@@ -494,8 +497,8 @@ func (h *DeviceHandler) UnassignDevice(ctx context.Context, req *connect.Request
 			StreamType: "device",
 			StreamID:   req.Msg.DeviceId,
 			EventType:  string(eventtypes.DeviceGroupUnassigned),
-			Data: map[string]any{
-				"group_id": req.Msg.GroupId,
+			Data: payloads.DeviceGroupAssignment{
+				GroupID: &req.Msg.GroupId,
 			},
 			ActorType: "user",
 			ActorID:   userCtx.ID,
@@ -533,12 +536,13 @@ func (h *DeviceHandler) SetDeviceSyncInterval(ctx context.Context, req *connect.
 	}
 
 	// Emit DeviceSyncIntervalSet event
+	syncInterval := req.Msg.SyncIntervalMinutes
 	if err := appendEvent(ctx, h.store, h.logger, store.Event{
 		StreamType: "device",
 		StreamID:   req.Msg.Id,
 		EventType:  string(eventtypes.DeviceSyncIntervalSet),
-		Data: map[string]any{
-			"sync_interval_minutes": req.Msg.SyncIntervalMinutes,
+		Data: payloads.DeviceSyncIntervalSet{
+			SyncIntervalMinutes: &syncInterval,
 		},
 		ActorType: "user",
 		ActorID:   userCtx.ID,

internal/api/registration_handler.go

@@ -17,6 +17,7 @@ import (
 	pm "github.com/manchtools/power-manage/sdk/gen/go/pm/v1"
 	"github.com/manchtools/power-manage/server/internal/ca"
 	"github.com/manchtools/power-manage/server/internal/eventtypes"
+	"github.com/manchtools/power-manage/server/internal/eventtypes/payloads"
 	"github.com/manchtools/power-manage/server/internal/store"
 )
 
@@ -193,21 +194,36 @@ func (h *RegistrationHandler) Register(ctx context.Context, req *connect.Request
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to issue certificate")
 	}
 
-	// Build event data for device registration
-	eventData := map[string]any{
-		"hostname":              req.Msg.Hostname,
-		"agent_version":         req.Msg.AgentVersion,
-		"cert_fingerprint":      cert.Fingerprint,
-		"cert_not_after":        cert.NotAfter.Format(time.RFC3339),
-		"registration_token_id": token.ID,
-		"cert_pem":              string(cert.CertPEM),
-		"ca_cert_pem":           string(h.ca.CACertPEM()),
+	// Build event data for device registration. CertPEM + CACertPEM
+	// ride along so future replays can recover the cert bytes from
+	// the event log; the projector ignores them.
+	hostname := req.Msg.Hostname
+	agentVersion := req.Msg.AgentVersion
+	certFingerprint := cert.Fingerprint
+	// Preserve the legacy RFC 3339-string serialisation (no
+	// sub-second precision) so wire bytes stay identical to the
+	// pre-typed-payload emission. The projector parses the string
+	// back into a time.Time via parseOptionalRFC3339, which accepts
+	// both RFC 3339 and RFC 3339Nano.
+	certNotAfterStr := cert.NotAfter.Format(time.RFC3339)
+	registrationTokenID := token.ID
+	certPEM := string(cert.CertPEM)
+	caCertPEM := string(h.ca.CACertPEM())
+	deviceData := payloads.DeviceRegistered{
+		Hostname:            &hostname,
+		AgentVersion:        &agentVersion,
+		CertFingerprint:     &certFingerprint,
+		CertNotAfter:        &certNotAfterStr,
+		RegistrationTokenID: &registrationTokenID,
+		CertPEM:             &certPEM,
+		CACertPEM:           &caCertPEM,
 	}
 
 	// Auto-assign device to token owner if the token has an owner
 	if token.OwnerID != nil && *token.OwnerID != "" {
-		eventData["assigned_user_id"] = *token.OwnerID
-		logger.Info("auto-assigning device to token owner", "owner_id", *token.OwnerID)
+		ownerID := *token.OwnerID
+		deviceData.AssignedUserID = &ownerID
+		logger.Info("auto-assigning device to token owner", "owner_id", ownerID)
 	}
 
 	// Consume the token FIRST to prevent race conditions with one-time tokens.
@@ -238,7 +254,7 @@ func (h *RegistrationHandler) Register(ctx context.Context, req *connect.Request
 		StreamType: "device",
 		StreamID:   deviceID,
 		EventType:  string(eventtypes.DeviceRegistered),
-		Data:       eventData,
+		Data:       deviceData,
 		ActorType:  "system",
 		ActorID:    "registration",
 	}); err != nil {

internal/api/system_actions.go

@@ -12,6 +12,7 @@ import (
 	"github.com/manchtools/power-manage/server/internal/actionparams"
 	"github.com/manchtools/power-manage/server/internal/ca"
 	"github.com/manchtools/power-manage/server/internal/eventtypes"
+	"github.com/manchtools/power-manage/server/internal/eventtypes/payloads"
 	"github.com/manchtools/power-manage/server/internal/store"
 	db "github.com/manchtools/power-manage/server/internal/store/generated"
 )
@@ -529,18 +530,19 @@ func (m *SystemActionManager) createSystemAction(ctx context.Context, name strin
 // assignActionToUser emits an AssignmentCreated event.
 func (m *SystemActionManager) assignActionToUser(ctx context.Context, actionID, userID string) error {
 	assignmentID := newULID()
-
+	mode := int32(0) // REQUIRED
+	sortOrder := int32(0)
 	return m.store.AppendEvent(ctx, store.Event{
 		StreamType: "assignment",
 		StreamID:   assignmentID,
 		EventType:  string(eventtypes.AssignmentCreated),
-		Data: map[string]any{
-			"source_type": "action",
-			"source_id":   actionID,
-			"target_type": "user",
-			"target_id":   userID,
-			"mode":        0, // REQUIRED
-			"sort_order":  0,
+		Data: payloads.AssignmentCreated{
+			SourceType: "action",
+			SourceID:   actionID,
+			TargetType: "user",
+			TargetID:   userID,
+			Mode:       &mode,
+			SortOrder:  &sortOrder,
 		},
 		ActorType: "system",
 		ActorID:   "system",
@@ -586,9 +588,9 @@ func (m *SystemActionManager) linkSystemAction(ctx context.Context, userID, fiel
 		StreamType: "user",
 		StreamID:   userID,
 		EventType:  string(eventtypes.UserSystemActionLinked),
-		Data: map[string]any{
-			"field":     field,
-			"action_id": actionID,
+		Data: payloads.UserSystemActionLinked{
+			Field:    &field,
+			ActionID: &actionID,
 		},
 		ActorType: "system",
 		ActorID:   "system",