NEWS.md
safe_output() now preserves Opal 6.0 RESOLVE operations independently of ASSIGN operations, including the resolved symbol and source table/resource for provenance. RESOLVE entries are retained even when no matching ASSIGN follows (e.g., a failed resolution). This is only enabled when the server reports Opal >= 6.0.safe_output() (and written to the _mappings.csv file) now has a unique id (UUID), and the tibble gains a column field recording the column referenced by a function call argument (e.g. D$LAB_TSC), where applicable.D$LAB_TSC) are now resolved back to the single registered symbol they reference, along with the referenced column. Expressions that reference several symbols, or none that are registered, are returned unchanged.safe_symbol() are now plain UUIDs, without the previous "symbol-" prefix.safe_output() failing when an audit session contains no ASSIGN operations: an empty, correctly typed symbols table is now used.safe_output() failing when no function calls could be reconstructed from the logs: an empty, correctly typed calls table is now used.safe_output() no longer injects a placeholder row (ds_profile = "-999999") into the parsed logs; a zero-row typed tibble is used to guarantee the ds_profile column exists instead.resolve_dependencies() failing on an empty symbol registry, and resolve_provenance() failing when given an NA symbol ID. Both now return an empty tibble.validate_backend_version() (opal method) no longer emits warnings from utils::compareVersion().safe_output() with RESOLVE and ASSIGN operations, and RESOLVE operations without ASSIGN; updated as.data.frame.safe_call() test for the new id column.safe_output() to silence R CMD check notes about undefined global variables.enrich_argument() and safe_call(); regenerated with roxygen2 8.1.0.safe_output() where Opal audit logs containing no AGGREGATE events could cause the audit pipeline to fail when constructing the calls table.safe_output() now handles audit sessions with logs but no AGGREGATE calls gracefully, returning an empty calls table rather than attempting to operate on NULL.as.data.frame.safe_call() (two files each defined this S3 method with different output columns; only one could ever take effect, silently). The safe-call.R version — timestamp, user, r_cmd, fx, args, session, profile — is now the sole implementation.print.safe_symbol() referencing stale column/parent fields left over from before the 0.2.0 symbol-model refactor; it now correctly displays the symbol’s asset, expr, and session (guarding on both NULL and NA, since these fields default to NA_character_).as.data.frame.symbol_registry(), which previously iterated over the columns of the underlying tibble instead of its rows (via lapply() on a data frame), causing it to error whenever called on a non-empty registry. It also referenced non-existent parent/column fields. The method now simply returns x$symbols coerced to a data frame, which already carries the correct columns.register_symbol() erroring on a brand-new, empty registry (the very first symbol registered in any session): the emptiness check compared nrow() of a plain, pre-tibble list() before checking length(), producing a zero-length logical passed to ||. The length() check is now evaluated first, so it short-circuits correctly.as.data.frame.safe_call()’s args column having an unstable name and shape depending on how many arguments the underlying call had (a single-argument call collapsed the column into one named after that argument, e.g. x; multiple arguments spread into several columns instead of one). The argument list is now wrapped with I(list(...)) so it always appears as a single, reliably-named args list-column.safe_call()/as.data.frame.safe_call(), print.safe_symbol(), and register_symbol()/as.data.frame.symbol_registry(), none of which previously had any test coverage.has_symbol()/has_symbol.symbol_registry() (and its S3 export) and safe_symbol_reference()/new_safe_symbol_reference(), none of which were called anywhere in the package.safe_symbol() and print.safe_call().@param, @returns, @keywords internal, @noRd) and explanatory comments to the internal symbol-tracking functions introduced in 0.2.0 (safe_call(), safe_symbol(), safe_reference(), symbol_registry(), and their supporting utilities), with no change in behaviour.WORDLIST.safe_output() no longer includes a table column. It has been replaced by three more granular columns: kind (whether the tracked object is a table, resource or expression), asset (the resolved table/resource name) and expr (the associated R expression, when applicable). Code that reads the table column directly will need to be updated.safe_symbol(), safe_call(), safe_reference(), symbol_registry()) that replaces regex-based parsing of Opal logs, modelling assignments and aggregate function calls as objects and resolving arguments back to the symbols/tables they reference.backend_logs(), backend_options(), backend_users(), backend_projects(), backend_sys_perms(), and others) so internal code no longer calls opalr:: directly, paving the way for additional backends.check_permissions(), init(), report(), safe_data(), safe_output(), safe_people() and safe_setting() now all have ArmadilloCredentials methods, returning clear “not yet implemented” errors ahead of full support.default S3 methods for audit(), audit_engine() and check_permissions(), giving clearer errors when an unsupported connection object is supplied.verbose argument to check_permissions() (opal method) to optionally print a success message when permissions are sufficient.print.safe_call() and print.safe_symbol() methods, plus as.data.frame() methods for safe_call and symbol_registry objects, for readable inspection of the new internal tracking objects.safe_people() now determines admin/auditor status from actual system permissions and group membership, rather than a hardcoded name check against "admin"/"administrator", improving compatibility with deployments that use differently named privileged accounts.safe_people() now fall back gracefully to an empty result instead of aborting the whole audit.init(), safe_data(), report() and related functions now accept either opal or ArmadilloCredentials connections.audit(), audit_engine() and check_permissions(), along with a mock-connection test helper, reducing reliance on a live demo Opal server.uuid to Imports, used to generate unique IDs for tracked symbols.testthat version requirement in Suggests from >= 3.0.0 to >= 3.1.4.check_permissions() support for backend connections, allowing users to verify whether a connection has sufficient privileges to run safe_* auditing functions before execution (#15).opalr::opal.datasources() with opalr::opal.projects(), reducing the permissions required for metadata extraction and improving compatibility with auditor accounts (#21).safe_data() and safe_people() permission handling (#19).safe_output.opal() S3 generic now uses overwrite = TRUE to update the root (./) entity.