Add narrow audit log actor loaders for CSV export

Replace full Identity and PersonalAPIKey batch loads with
rows that select only id, email, name fields used in export.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/coredata/identity.go

@@ -388,7 +388,17 @@ WHERE
 	return count, nil
 }
 
-func (i *Identities) LoadByIDs(
+type (
+	IdentityAuditLogActorRow struct {
+		ID           gid.GID   `db:"id"`
+		EmailAddress mail.Addr `db:"email_address"`
+		FullName     string    `db:"full_name"`
+	}
+
+	IdentityAuditLogActorRows []*IdentityAuditLogActorRow
+)
+
+func (rows *IdentityAuditLogActorRows) LoadByIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	identityIDs []gid.GID,
@@ -397,13 +407,7 @@ func (i *Identities) LoadByIDs(
 SELECT
     id,
     email_address,
-    full_name,
-    hashed_password,
-    email_address_verified,
-    saml_subject,
-    locale,
-    created_at,
-    updated_at
+    full_name
 FROM
     identities
 WHERE
@@ -412,17 +416,17 @@ WHERE
 
 	args := pgx.StrictNamedArgs{"identity_ids": identityIDs}
 
-	rows, err := conn.Query(ctx, q, args)
+	rowsResult, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query identities: %w", err)
+		return fmt.Errorf("cannot query identity audit log actors: %w", err)
 	}
 
-	identities, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Identity])
+	actors, err := pgx.CollectRows(rowsResult, pgx.RowToAddrOfStructByName[IdentityAuditLogActorRow])
 	if err != nil {
-		return fmt.Errorf("cannot collect identities: %w", err)
+		return fmt.Errorf("cannot collect identity audit log actors: %w", err)
 	}
 
-	*i = identities
+	*rows = actors
 
 	return nil
 }

pkg/coredata/personal_api_key.go

@@ -302,7 +302,16 @@ WHERE
 	return nil
 }
 
-func (a *PersonalAPIKeys) LoadByIDs(
+type (
+	PersonalAPIKeyAuditLogActorRow struct {
+		ID   gid.GID `db:"id"`
+		Name string  `db:"name"`
+	}
+
+	PersonalAPIKeyAuditLogActorRows []*PersonalAPIKeyAuditLogActorRow
+)
+
+func (rows *PersonalAPIKeyAuditLogActorRows) LoadByIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	apiKeyIDs []gid.GID,
@@ -310,13 +319,7 @@ func (a *PersonalAPIKeys) LoadByIDs(
 	q := `
 SELECT
     id,
-    identity_id,
-    name,
-    expires_at,
-    expire_reason,
-    last_used_at,
-    created_at,
-    updated_at
+    name
 FROM
     iam_personal_api_keys
 WHERE
@@ -325,17 +328,17 @@ WHERE
 
 	args := pgx.StrictNamedArgs{"api_key_ids": apiKeyIDs}
 
-	rows, err := conn.Query(ctx, q, args)
+	rowsResult, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query personal api keys: %w", err)
+		return fmt.Errorf("cannot query personal api key audit log actors: %w", err)
 	}
 
-	apiKeys, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[PersonalAPIKey])
+	actors, err := pgx.CollectRows(rowsResult, pgx.RowToAddrOfStructByName[PersonalAPIKeyAuditLogActorRow])
 	if err != nil {
-		return fmt.Errorf("cannot collect personal api keys: %w", err)
+		return fmt.Errorf("cannot collect personal api key audit log actors: %w", err)
 	}
 
-	*a = apiKeys
+	*rows = actors
 
 	return nil
 }

pkg/iam/log_export_csv.go

@@ -270,30 +270,26 @@ func loadAuditLogActorExportInfo(
 
 	result := make(map[gid.GID]auditLogActorExportInfo)
 
-	if len(identityIDs) > 0 {
-		var identities coredata.Identities
-		if err := identities.LoadByIDs(ctx, conn, identityIDs); err != nil {
-			return nil, fmt.Errorf("cannot load audit log actor identities: %w", err)
-		}
+	var identities coredata.IdentityAuditLogActorRows
+	if err := identities.LoadByIDs(ctx, conn, identityIDs); err != nil {
+		return nil, fmt.Errorf("cannot load audit log actor identities: %w", err)
+	}
 
-		for _, identity := range identities {
-			result[identity.ID] = auditLogActorExportInfo{
-				email: identity.EmailAddress.String(),
-				name:  identity.FullName,
-			}
+	for _, identity := range identities {
+		result[identity.ID] = auditLogActorExportInfo{
+			email: identity.EmailAddress.String(),
+			name:  identity.FullName,
 		}
 	}
 
-	if len(apiKeyIDs) > 0 {
-		var apiKeys coredata.PersonalAPIKeys
-		if err := apiKeys.LoadByIDs(ctx, conn, apiKeyIDs); err != nil {
-			return nil, fmt.Errorf("cannot load audit log actor API keys: %w", err)
-		}
+	var apiKeys coredata.PersonalAPIKeyAuditLogActorRows
+	if err := apiKeys.LoadByIDs(ctx, conn, apiKeyIDs); err != nil {
+		return nil, fmt.Errorf("cannot load audit log actor API keys: %w", err)
+	}
 
-		for _, apiKey := range apiKeys {
-			result[apiKey.ID] = auditLogActorExportInfo{
-				name: apiKey.Name,
-			}
+	for _, apiKey := range apiKeys {
+		result[apiKey.ID] = auditLogActorExportInfo{
+			name: apiKey.Name,
 		}
 	}