Fix actor fields and transactions for API operations as they are recorded to DB.

paskia/fastapi/user.py

@@ -55,7 +55,7 @@ async def user_update_display_name(
         raise HTTPException(status_code=400, detail="display_name required")
     if len(new_name) > 64:
         raise HTTPException(status_code=400, detail="display_name too long")
-    db.update_user_display_name(s.user_uuid, new_name)
+    db.update_user_display_name(s.user_uuid, new_name, actor=str(s.user_uuid))
     return {"status": "ok"}
 
 
@@ -69,7 +69,7 @@ async def api_logout_all(request: Request, response: Response, auth=AUTH_COOKIE)
         raise authz.AuthException(
             status_code=401, detail="Session expired", mode="login"
         )
-    db.delete_sessions_for_user(s.user_uuid)
+    db.delete_sessions_for_user(s.user_uuid, actor=str(s.user_uuid))
     session.clear_session_cookie(response)
     return {"message": "Logged out from all hosts"}
 
@@ -103,7 +103,7 @@ async def api_delete_session(
     if not target_session or target_session.user_uuid != current_session.user_uuid:
         raise HTTPException(status_code=404, detail="Session not found")
 
-    db.delete_session(target_key)
+    db.delete_session(target_key, actor=str(current_session.user_uuid))
     current_terminated = target_key == session_key(auth)
     if current_terminated:
         session.clear_session_cookie(response)  # explicit because 200
@@ -149,6 +149,7 @@ async def api_create_link(
         key=tokens.reset_key(token),
         expiry=expiry,
         token_type="device addition",
+        actor=str(s.user_uuid),
     )
     url = hostutil.reset_link_url(token)
     return {