fix: prevent Ecto.ConstraintError on audit_logs_pkey during *_and_log (OPS-4616)

[palantir-valiot]

Description

Prevent Ecto.ConstraintError on audit_logs_pkey (or equivalent primary-key constraint) when EctoTrail.*_and_log/* (or log/*) performs the audit insert.

Root cause: changelog_changeset/1 did not declare unique_constraint(:id) (or known pkey constraint names), and the audit repo.insert/1 calls in log_changes/5 and log_changes_alone/6 were not protected. When a duplicate PK value was generated (custom UUID PKs, sequence rewind, retry paths, etc.), the error propagated out of the audit path and aborted the caller's transaction.

Changes:

• lib/ecto_trail/ecto_trail.ex:598 — changelog_changeset/1 now declares unique_constraint(:id) plus the two common pkey names seen in the wild (audit_logs_pkey, audit_log_pkey).
• lib/ecto_trail/ecto_trail.ex:440 and lib/ecto_trail/ecto_trail.ex:470 — wrap the repo.insert() in log_changes/5 and log_changes_alone/6 with try/rescue. Any DB error during audit logging is logged and turned into {:ok, reason} so the outer *_and_log transaction still commits the business write.
• test/unit/ecto_trail_test.exs — added regression test that forces a pkey collision via setval and asserts update_and_log still succeeds.
• mix.exs — version 1.0.4.
• CHANGELOG.md — concise entry under 1.0.4.

Fixes the exact stack from the incident:

(ecto_trail 1.0.3) lib/ecto_trail/ecto_trail.ex:435: EctoTrail.log_changes/5
(ecto_trail 1.0.3) lib/ecto_trail/ecto_trail.ex:315: anonymous fn/4 in EctoTrail.update_and_log/4

Why

Linear: OPS-4616 — Ecto.ConstraintError on audit_logs_pkey during EctoTrail.update_and_log on Device update in eliot-lamosa-gto-prod. Triage classified as code_bug (high). The package must never let an audit-log failure abort the caller's business operation.

Test plan

• mix format --check-formatted (passes)
• mix test executed (Postgres is not available in this runner; the test helper fails on connection as expected — the new regression lives in test/unit/ecto_trail_test.exs and will exercise the rescue path when a DB is present; all prior tests continue to compile and the change is minimal/isolated).
• Manual review of git diff --stat and full diff: only the audit constraint handling, the TDD test, version bump, and changelog. No debug prints, no unrelated scope.
• PR body written from the skeleton (not left empty).

Closes OPS-4616

[linear-code]

OPS-4616

[palantir-valiot]

Overall Assessment

The PR modifies log_changes/5 and log_changes_alone/6 to wrap repo.insert() in try/rescue, and adds unique_constraint(:id) declarations (for :id, audit_logs_pkey, audit_log_pkey) in changelog_changeset/1. Audit failures are logged and turned into {:ok, _} so the caller's *_and_log transaction commits the business write. A regression test using setval exercises the pkey collision path. No blocking bugs found.

Findings

No actionable findings.

Notes

• The try/rescue is a safety net; unique_constraint declarations will convert matching constraint violations into {:error, changeset} (already handled), while the rescue catches Ecto.ConstraintError for unmatched names or other DB errors.
• Existing log_bulk/5 already uses a similar rescue pattern, so the approach is consistent.
• The new test covers the serial PK collision case; custom UUID PK collision scenarios mentioned in the PR description are not exercised by the test but would still hit the rescue path.
• Version bump and changelog entry are present and minimal.

[palantir-valiot]

Thanks for the review. Acknowledged:

• try/rescue is the safety net for Ecto.ConstraintError (and other DB errors) when the declared unique_constraint/3 names don't match the actual constraint (e.g. custom table names or UUID PKs); consistent with the existing log_bulk/5 rescue.
• The regression test forces the serial PK collision via setval; UUID collision cases (mentioned in the incident) will still be caught by the rescue path.
• Version bump + changelog entry are present.

No further code changes needed from this review. Ready for merge once CI is green.

[acrogenesis]

Closing as a duplicate of #24 — same bug: Ecto.ConstraintError on audit_logs_pkey in EctoTrail.log_changes/5. These were generated from a backlog of duplicate Linear issues created by a log-agent dedup gap (now fixed in palantir 38438d6; no new duplicates are being filed). Consolidating on #24.