feat: introduce grant diff in update

core/grant/service.go

@@ -141,12 +141,21 @@ func (s *Service) Update(ctx context.Context, payload *domain.GrantUpdate) (*dom
 	s.logger.Info(ctx, "grant updated", "grant_id", grant.ID, "updatedGrant", latestGrant)
 
 	go func() {
+		diff, err := latestGrant.Compare(grant)
+		if err != nil {
+			s.logger.Error(ctx, "failed to compare grant", "error", err)
+			return
+		}
+		for _, d := range diff {
+			d.Actor = payload.Actor
+		}
+
 		ctx := context.WithoutCancel(ctx)
 		if err := s.auditLogger.Log(ctx, AuditKeyUpdate, map[string]interface{}{
 			"grant_id":      payload.ID,
 			"payload":       payload,
 			"updated_grant": latestGrant,
-			// TODO: diff
+			"diff":          diff,
 		}); err != nil {
 			s.logger.Error(ctx, "failed to record audit log", "error", err)
 		}

domain/grant.go

@@ -6,6 +6,8 @@ import (
 	"sort"
 	"strings"
 	"time"
+
+	"github.com/goto/guardian/pkg/diff"
 )
 
 type GrantStatus string
@@ -125,12 +127,32 @@ func (g *Grant) GetPermissions() []string {
 	return permissions
 }
 
+func (g *Grant) Compare(old *Grant) ([]*DiffItem, error) {
+	diff, err := diff.Compare(old, g)
+	if err != nil {
+		return nil, err
+	}
+
+	diffItems := make([]*DiffItem, 0, len(diff))
+	for _, d := range diff {
+		diffItems = append(diffItems, &DiffItem{
+			Op:       d.Op,
+			Path:     d.Path,
+			OldValue: d.OldValue,
+			NewValue: d.NewValue,
+		})
+	}
+	return diffItems, nil
+}
+
 type GrantUpdate struct {
 	ID                   string     `json:"id" yaml:"id"`
 	Owner                *string    `json:"owner,omitempty" yaml:"owner,omitempty"`
 	IsPermanent          *bool      `json:"is_permanent,omitempty" yaml:"is_permanent,omitempty"`
 	ExpirationDate       *time.Time `json:"expiration_date,omitempty" yaml:"expiration_date,omitempty"`
 	ExpirationDateReason *string    `json:"expiration_date_reason,omitempty" yaml:"expiration_date_reason,omitempty"`
+
+	Actor string `json:"actor" yaml:"actor"`
 }
 
 func (gu *GrantUpdate) IsUpdatingExpirationDate() bool {

jobs/revoke_grants_by_user_criteria.go

@@ -195,6 +195,7 @@ func (h *handler) reassignGrantsOwnership(ctx context.Context, ownedGrants []*do
 		payload := &domain.GrantUpdate{
 			ID:    g.ID,
 			Owner: &newOwner,
+			Actor: domain.SystemActorName,
 		}
 		if _, err := h.grantService.Update(ctx, payload); err != nil {
 			failedGrants = append(failedGrants, g)