Documentation
¶
Overview ¶
Package audit 是租户级、append-only、不可泄密的安全审计日志域。 只承载：事件/动作常量、结构化 metadata builder（敏感 key 自动 [REDACTED]）、 request id 归一化与生成。持久化由 internal/store 负责，落点由 internal/server 编排。
Index ¶
Constants ¶
View Source
const ( ActionSetup = "auth.setup" ActionLogin = "auth.login" ActionLogout = "auth.logout" ActionUserCreate = "user.create" ActionUserUpdate = "user.update" ActionUserDisable = "user.disable" ActionUserEnable = "user.enable" ActionUserPasswordReset = "user.password_reset" ActionTokenCreate = "token.create" ActionTokenRevoke = "token.revoke" ActionCommandAccepted = "command.accepted" ActionCommandRejected = "command.rejected" ActionEdgeAuthSuccess = "edge.auth.success" ActionEdgeAuthFailure = "edge.auth.failure" )
动作常量：均为 "<域>.<动作>"，可查询、可扩展。
View Source
const ( OutcomeSuccess = "success" OutcomeFailure = "failure" )
结果常量。
View Source
const ( ActorSystem = "system" ActorUser = "user" ActorToken = "token" ActorEdge = "edge" TargetTenant = "tenant" TargetUser = "user" TargetToken = "token" TargetDevice = "device" TargetEdge = "edge" )
actor / target 类型常量。
View Source
const MaxRequestIDLen = 128
MaxRequestIDLen 是请求方传入 X-Request-ID 的长度上限。
View Source
const Redacted = "[REDACTED]"
Redacted 是敏感 metadata 值的统一占位符。
Variables ¶
This section is empty.
Functions ¶
func NormalizeRequestID ¶
NormalizeRequestID 校验并规范化请求方传入的 X-Request-ID： 允许 [A-Za-z0-9._-]，长度 1..MaxRequestIDLen；非法返回空串（调用方回退自生成）。
Types ¶
type Entry ¶
type Entry struct {
ID int64 `json:"id"`
TenantID int64 `json:"tenant_id"`
ActorType string `json:"actor_type"`
ActorID int64 `json:"actor_id"`
ActorName string `json:"actor_name"`
Action string `json:"action"`
TargetType string `json:"target_type"`
TargetID string `json:"target_id"`
Outcome string `json:"outcome"`
RequestID string `json:"request_id"`
RemoteIP string `json:"remote_ip"`
Metadata map[string]any `json:"metadata"`
CreatedAt int64 `json:"created_at"`
}
Entry 是审计事件的可查询/JSON 视图（查询端点透出用）。
type Event ¶
type Event struct {
TenantID int64
ActorType string
ActorID int64
ActorName string
Action string
TargetType string
TargetID string
Outcome string
RequestID string
RemoteIP string
Metadata map[string]any
}
Event 是一次待落库的审计事件（不含任何明文凭据）。
type Metadata ¶
type Metadata struct {
// contains filtered or unexported fields
}
Metadata 是结构化 metadata builder：敏感 key 的值一律替换为 [REDACTED]。 调用方只允许通过类型化方法写入，禁止把请求原 body/header 整段塞入。
func NewMetadata ¶
func NewMetadata() *Metadata
Source Files
Click to show internal directories.
Click to hide internal directories.