CHR0034: [PII] cannot be applied to an EventSourceId<T>

Rule Description

A property or record parameter whose type derives from EventSourceId<T> is marked with [PII]. The event source id is the identity Chronicle uses to look up the encryption key for a subject, so it cannot itself be encrypted. Applying [PII] to it throws PIINotSupportedOnEventSourceId at runtime.

Remove the [PII] attribute. The id is already the compliance subject.

Severity

Error

Example

C#

using Cratis.Chronicle.Compliance.GDPR;
using Cratis.Chronicle.Events;

// Error CHR0034: 'CustomerId' is typed as 'CustomerId' (derives from EventSourceId<T>);
// [PII] cannot be applied to an event source id — Chronicle throws
// PIINotSupportedOnEventSourceId at runtime. Remove [PII].
[EventType]
public record CustomerRegistered([PII] Chr0034CustomerId CustomerId, string Name);

public record Chr0034CustomerId(Guid Value) : EventSourceId<Guid>(Value)
{
    public static implicit operator Chr0034CustomerId(Guid value) => new(value);
}

Why This Rule Exists

Chronicle encrypts [PII] values per subject, and the subject is resolved from the event source id. That makes the id the key-lookup identity for every other encrypted value on the event. If the id itself were encrypted, there would be nothing left to resolve the key by — a circular dependency Chronicle cannot satisfy, so it throws PIINotSupportedOnEventSourceId.

This analyzer turns that runtime failure into a compile-time error, caught the moment you write the attribute rather than the first time the event is appended.

If the identifier itself is sensitive, do not try to encrypt the id. Instead use a random Guid-backed surrogate as the event source id and store the sensitive value in a separate [PII] property, which Chronicle can encrypt under the surrogate subject.

Related Rules

• CHR0026: [Key] or [Subject] on an EventSourceId<T> is redundant — the id is already the key and the compliance subject.
• Subject — how the compliance subject is resolved.