sqlaudit

type Log = audit.Log

type Record struct {
	Event      string `json:"event"`
	Profile    string `json:"profile,omitempty"`
	Engine     string `json:"engine,omitempty"`
	Host       string `json:"host,omitempty"`
	DB         string `json:"db,omitempty"`
	DBUser     string `json:"db_user,omitempty"`
	SSHHost    string `json:"ssh_host,omitempty"`
	SSHHostKey string `json:"ssh_host_key,omitempty"`
	Class      string `json:"class,omitempty"`
	SQL        string `json:"sql,omitempty"`
	Verdict    string `json:"verdict,omitempty"`
	Decision   string `json:"decision,omitempty"`
	Error      string `json:"error,omitempty"`
	// Code is the refusal code of a refused record (package refusal), and
	// Span where the refusal points in the statement, when known.
	Code       string        `json:"code,omitempty"`
	Span       *refusal.Span `json:"span,omitempty"`
	Rows       int64         `json:"rows,omitempty"`
	Affected   int64         `json:"affected,omitempty"`
	DurationMS int64         `json:"duration_ms,omitempty"`
	Truncated  bool          `json:"truncated,omitempty"`
	Unmasked   bool          `json:"unmasked,omitempty"`
	Warnings   []string      `json:"warnings,omitempty"`
	// Intent is the agent's one-line reason for a plan (untrusted text,
	// like SQL), kept on every record of that plan.
	Intent string `json:"intent,omitempty"`
	// Reason is the human's reason for a denial, escaped.
	Reason string `json:"reason,omitempty"`
	// Approval is how the human approved: "session" (typed in a login
	// session of the console account), "desktop+typed" (typed in a desktop
	// window, level 1) or "desktop+fingerprint" (level 2).
	Approval string `json:"approval,omitempty"`
	// The client behind a request, from the kernel's peer credentials:
	// set on the records of client requests only. PeerUID is nil when
	// unknown (uid 0 is root); PeerUser is the account name when it
	// resolves. The process name is the agent's choice and is not kept.
	PeerUID  *int   `json:"peer_uid,omitempty"`
	PeerPID  int    `json:"peer_pid,omitempty"`
	PeerUser string `json:"peer_user,omitempty"`
	// Scope, Profiles and AllowLoosen describe a config import: the scope
	// written (user or project), the profiles it changes and whether
	// loosening was allowed. Never a value.
	Scope       string   `json:"scope,omitempty"`
	Profiles    []string `json:"profiles,omitempty"`
	AllowLoosen bool     `json:"allow_loosen,omitempty"`
	// The hub's decision behind a record, in hub mode only (lockkit's
	// audit.Base names): the ticket ID, who answered it and on which
	// facade, and the hub's signature of the decision.
	Ticket   string           `json:"ticket,omitempty"`
	Approver *ticket.Approver `json:"approver,omitempty"`
	Facade   string           `json:"facade,omitempty"`
	HubSig   string           `json:"hub_sig,omitempty"`
}