Record the actor on assign, archive and unarchive (#35)

Assign logged only the assignee (user_id), archive/unarchive logged nothing.
Migration 018 adds actor_user_id/actor_service_account_id to incident_events
for 'assigned'; archive/unarchive now log archived/unarchived events with the
caller via callerActorIDs. Timeline JSON gains actor_* fields; web timeline
renders them. Service accounts are still not assignable.

internal/api/incidents_test.go

@@ -870,3 +870,105 @@ func contains(haystack []string, needle string) bool {
 	}
 	return false
 }
+
+// ---------------------------------------------------------------------------
+// Actor on assign / archive / unarchive (terdut-server#35)
+// ---------------------------------------------------------------------------
+
+// lastEvent returns the newest timeline event of the given type.
+func lastEvent(t *testing.T, events []map[string]any, typ string) map[string]any {
+	t.Helper()
+	for i := len(events) - 1; i >= 0; i-- {
+		if events[i]["type"] == typ {
+			return events[i]
+		}
+	}
+	t.Fatalf("no %q event in %v", typ, eventTypes(events))
+	return nil
+}
+
+func TestIncident_AssignRecordsHumanActor(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-asg-actor", "Assignable", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+	s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": "alice", "email": "alice@test.com"}).Body.Close()
+	s.req(t, http.MethodPost, "/api/incidents/1/assign", map[string]any{"user_id": 2}).Body.Close()
+
+	ev := lastEvent(t, timeline(t, s, 1), "assigned")
+	if ev["username"] != "alice" {
+		t.Errorf("expected the assignee alice in username, got %v", ev["username"])
+	}
+	if ev["actor_user_id"] == nil || ev["actor_username"] == nil {
+		t.Errorf("expected the assigning human in actor_*, got %v", ev)
+	}
+	if ev["actor_service_account_id"] != nil {
+		t.Errorf("expected no service-account actor, got %v", ev["actor_service_account_id"])
+	}
+}
+
+func TestIncident_ArchiveUnarchiveRecordHumanActor(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-arc-actor", "Archivable", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+	s.req(t, http.MethodPost, "/api/incidents/1/archive", nil).Body.Close()
+	s.req(t, http.MethodDelete, "/api/incidents/1/archive", nil).Body.Close()
+
+	events := timeline(t, s, 1)
+	for _, typ := range []string{"archived", "unarchived"} {
+		ev := lastEvent(t, events, typ)
+		if ev["user_id"] == nil || ev["service_account_id"] != nil {
+			t.Errorf("%s: expected only the human actor, got %v", typ, ev)
+		}
+	}
+}
+
+func TestServiceAccount_AssignArchiveUnarchiveRecordActor(t *testing.T) {
+	s := newTS(t)
+	instanceKey := createServiceAccount(t, s, s.key, "operator", models.ServiceAccountScopeInstance, 0)
+	teamA := createTeamAs(t, s, instanceKey, "team-a")
+	keyA := createServiceAccount(t, s, instanceKey, "team-a-sa", models.ServiceAccountScopeTeam, teamA)
+	var integration struct {
+		Key string `json:"key"`
+	}
+	decode(t, s.reqAs(t, keyA, http.MethodPost, "/api/teams/"+id64(teamA)+"/integrations",
+		map[string]string{"name": "test"}), &integration)
+	postToIntegration(t, s, integration.Key, "fp-sa-35", "SA35") // incident 1
+
+	resp := s.reqAs(t, keyA, http.MethodPost, "/api/incidents/1/assign", map[string]any{"user_id": 1})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("service account assign: %d", resp.StatusCode)
+	}
+	resp = s.reqAs(t, keyA, http.MethodPost, "/api/incidents/1/resolve", nil)
+	resp.Body.Close()
+	resp = s.reqAs(t, keyA, http.MethodPost, "/api/incidents/1/archive", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("service account archive: %d", resp.StatusCode)
+	}
+	resp = s.reqAs(t, keyA, http.MethodDelete, "/api/incidents/1/archive", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("service account unarchive: %d", resp.StatusCode)
+	}
+
+	var events []map[string]any
+	decode(t, s.reqAs(t, keyA, http.MethodGet, "/api/incidents/1/timeline", nil), &events)
+	asg := lastEvent(t, events, "assigned")
+	if asg["actor_service_account_id"] == nil || asg["actor_user_id"] != nil {
+		t.Errorf("assigned: expected only the service-account actor, got %v", asg)
+	}
+	if asg["user_id"] == nil {
+		t.Errorf("assigned: user_id must stay the assignee, got %v", asg)
+	}
+	for _, typ := range []string{"archived", "unarchived"} {
+		ev := lastEvent(t, events, typ)
+		if ev["service_account_id"] == nil || ev["user_id"] != nil {
+			t.Errorf("%s: expected only the service-account actor, got %v", typ, ev)
+		}
+	}
+}