Stop recording the address a delegate accepts a grant from

A consent record has to answer who consented and when, and the grant row
already does. It does not have to answer from where, and an address kept for
as long as both accounts exist is personal data held past the point it
evidences anything. Nothing read the column, which makes it exactly the
write-only field scripts/audit-column-readers.ts exists to surface.

The acceptance stays evidenced: audit_logs records it with the caller's
address under that table's own retention. The column never reached the wire,
so the grant view and the OpenAPI contract are unchanged.

Written before the feature shipped, so migration 0295 drops an empty column.
This commit is contained in:
Marc-André Bombeck committed 2026-08-02 16:36:12 +02:00
1 parent 0d4b79d91b
commit a463b1fa01
6 files changed
+33 -26

No files matched your search

+1 -3
View File
@@ -216,8 +216,6 @@ export interface AcceptGrantInput {
grantId: string;
/** Taken from the authenticated session — never from a request body. */
granteeId: string;
/** The delegate's IP at acceptance, as the audit trail records one. */
ip?: string | null;
}
/**
@@ -241,7 +239,7 @@ export async function acceptGrant(
revokedAt: null,
OR: [{ expiresAt: null }, { expiresAt: { gt: now } }],
},
data: { acceptedAt: now, acceptedIp: input.ip ?? null },
data: { acceptedAt: now },
});
if (count === 0) {