Documentation
¶
Overview ¶
Package audit emits audit events onto the event bus.
Audit records are compliance artefacts rather than diagnostics: they carry who did what to which resource, and they are published as signed events so a consumer can verify they were not forged in transit.
Index ¶
- Constants
- type AuditClient
- func NewAuditClient(rabbitmqURL, serviceName string, signingConfig *eventbus.SignatureConfig) (*AuditClient, error)
- func NewAuditClientUnsigned(rabbitmqURL, serviceName string) (*AuditClient, error)
- func NewAuditClientWithPublisher(publisher PublisherInterface, serviceName string) *AuditClient
- func NewClusterAuditClient(nodes []string, serviceName string, signingConfig *eventbus.SignatureConfig) (*AuditClient, error)
- func (c *AuditClient) Close() error
- func (c *AuditClient) Log(ctx context.Context, eventType, actorType, actorID, action, resource string, ...) error
- func (c *AuditClient) LogDataAccess(ctx context.Context, userID, resource, resourceID string, opts *LogOptions) error
- func (c *AuditClient) LogDataModification(ctx context.Context, userID, action, resource, resourceID string, ...) error
- func (c *AuditClient) LogSecurityEvent(ctx context.Context, actorType, actorID, action, resource string, ...) error
- func (c *AuditClient) LogServiceAction(ctx context.Context, action, resource string, status string, opts *LogOptions) error
- func (c *AuditClient) LogUserAction(ctx context.Context, userID, userName, action, resource string, status string, ...) error
- type AuditEventData
- type LogOptions
- type PublisherInterface
Constants ¶
const (
EventAuditLog = "audit.log"
)
Event types for audit service
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuditClient ¶
type AuditClient struct {
// contains filtered or unexported fields
}
AuditClient provides an interface for services to publish audit events.
A nil *AuditClient is valid and means auditing is switched off: every method returns nil without doing anything. That is what a service gets when audit was wired as optional and the broker was unreachable, so callers do not have to nil-check before every call.
func NewAuditClient ¶
func NewAuditClient(rabbitmqURL, serviceName string, signingConfig *eventbus.SignatureConfig) (*AuditClient, error)
NewAuditClient creates a new audit client with signed event publishing
func NewAuditClientUnsigned ¶
func NewAuditClientUnsigned(rabbitmqURL, serviceName string) (*AuditClient, error)
NewAuditClientUnsigned creates an audit client without signing (for testing only)
func NewAuditClientWithPublisher ¶
func NewAuditClientWithPublisher(publisher PublisherInterface, serviceName string) *AuditClient
NewAuditClientWithPublisher creates an audit client over an existing publisher. It is how a service routes audit events through a transport it already owns — and the only way to supply the exported PublisherInterface, which otherwise had no constructor accepting it.
func NewClusterAuditClient ¶
func NewClusterAuditClient(nodes []string, serviceName string, signingConfig *eventbus.SignatureConfig) (*AuditClient, error)
NewClusterAuditClient creates a new audit client with cluster support
func (*AuditClient) Close ¶
func (c *AuditClient) Close() error
Close closes the audit client connection
func (*AuditClient) Log ¶
func (c *AuditClient) Log(ctx context.Context, eventType, actorType, actorID, action, resource string, status string, opts *LogOptions) error
Log publishes an audit event asynchronously via RabbitMQ
func (*AuditClient) LogDataAccess ¶
func (c *AuditClient) LogDataAccess(ctx context.Context, userID, resource, resourceID string, opts *LogOptions) error
LogDataAccess logs data access events (for compliance)
func (*AuditClient) LogDataModification ¶
func (c *AuditClient) LogDataModification(ctx context.Context, userID, action, resource, resourceID string, changes map[string]any, opts *LogOptions) error
LogDataModification logs data modification events
func (*AuditClient) LogSecurityEvent ¶
func (c *AuditClient) LogSecurityEvent(ctx context.Context, actorType, actorID, action, resource string, status string, opts *LogOptions) error
LogSecurityEvent logs a security-related event
func (*AuditClient) LogServiceAction ¶
func (c *AuditClient) LogServiceAction(ctx context.Context, action, resource string, status string, opts *LogOptions) error
LogServiceAction logs a service-initiated action
func (*AuditClient) LogUserAction ¶
func (c *AuditClient) LogUserAction(ctx context.Context, userID, userName, action, resource string, status string, opts *LogOptions) error
LogUserAction logs a user-initiated action
type AuditEventData ¶
type AuditEventData struct {
// Event identifiers
EventID string `json:"event_id"`
TraceID string `json:"trace_id,omitempty"`
// Event metadata
EventType string `json:"event_type"` // "user_action", "system_event", "security_event"
Version string `json:"version"`
// Actor information
ActorType string `json:"actor_type"` // "user", "service", "system"
ActorID string `json:"actor_id,omitempty"`
ActorName string `json:"actor_name,omitempty"`
// Action details
Action string `json:"action"` // "create", "read", "update", "delete"
Resource string `json:"resource"` // "user", "form", "skill", "location"
ResourceID string `json:"resource_id,omitempty"`
// Context
SessionID string `json:"session_id,omitempty"`
IPAddress string `json:"ip_address,omitempty"`
UserAgent string `json:"user_agent,omitempty"`
Location string `json:"location,omitempty"`
Platform string `json:"platform,omitempty"` // "web", "mobile", "api"
// Result
Status string `json:"status"` // "success", "failure", "warning"
StatusCode int `json:"status_code,omitempty"`
ErrorMsg string `json:"error_message,omitempty"`
Duration int64 `json:"duration_ms,omitempty"`
// Compliance
Sensitivity string `json:"sensitivity,omitempty"` // "public", "internal", "confidential", "restricted"
LegalBasis string `json:"legal_basis,omitempty"`
Purpose string `json:"purpose,omitempty"`
// Additional data
Metadata map[string]any `json:"metadata,omitempty"`
Changes map[string]any `json:"changes,omitempty"`
}
AuditEventData represents the data structure for audit events
type LogOptions ¶
type LogOptions struct {
TraceID string
SessionID string
IPAddress string
UserAgent string
Location string
Platform string
Duration time.Duration
StatusCode int
ErrorMsg string
Sensitivity string
LegalBasis string
Purpose string
Metadata map[string]any
Changes map[string]any
}
LogOptions contains optional parameters for audit logging
Source Files