audit

type Page struct {
	Cursor string
	Limit  int
}

type Query struct {
	// Type restricts to one event type.
	Type string
	// Actor restricts to one actor, which is how "what did this admin do"
	// and "what did break-glass do" are asked.
	Actor string
	// Enrollment restricts to one enrollment id.
	Enrollment string
	// Since and Until bound the record time. Zero means unbounded.
	Since, Until time.Time
}

type Record struct {
	// EventID identifies the source occurrence. Nonempty IDs are deduplicated
	// by Append, independently of the numeric audit cursor.
	EventID string
	// ID orders the trail and is the pagination cursor. It is assigned by
	// the store, ascending, so the newest record has the highest id.
	ID int64
	// At is when the event happened, from the publisher's clock.
	At time.Time
	// Type is the event type, for example "command-queued".
	Type string
	// Actor is who caused it: "device", "admin", a principal name, or
	// "break-glass".
	Actor string
	// Enrollment is the enrollment the event concerned, zero for events with
	// no enrollment such as an admin action.
	Enrollment mdm.EnrollmentID
	// Fields is the projected payload, stored as JSON.
	Fields map[string]any
}

type Result[T any] struct {
	Items      []T
	NextCursor string
}

type Store interface {
	// Append writes one record and returns it with its assigned ID.
	// ErrInvalid for a record with no type.
	Append(ctx context.Context, rec Record) (Record, error)
	// List pages the trail newest first, filtered by q. An unparsable
	// cursor is ErrInvalid.
	List(ctx context.Context, q Query, p Page) (Result[Record], error)
	// Get returns one record. ErrNotFound when it does not exist.
	Get(ctx context.Context, id int64) (Record, error)
	// Prune removes records older than before and returns how many went.
	// Retention is the only way a record leaves the trail.
	Prune(ctx context.Context, before time.Time) (int, error)
}