Documentation
¶
Overview ¶
Package audit provides session logging, storage, and observation for intercepted proxy traffic.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type FileRef ¶
type FileRef struct {
Path string `json:"path"`
Source string `json:"source"` // how it was detected: "json_field", "text_pattern"
}
FileRef represents a file reference detected in an API payload.
type InterceptedExchange ¶
type InterceptedExchange struct {
Timestamp time.Time `json:"timestamp"`
Method string `json:"method"`
URL string `json:"url"`
RequestHeaders map[string]string `json:"request_headers,omitempty"`
RequestBody string `json:"request_body,omitempty"`
DetectedFiles []FileRef `json:"detected_files,omitempty"`
Blocked bool `json:"blocked,omitempty"`
BlockReason string `json:"block_reason,omitempty"`
StatusCode int `json:"status_code"`
ResponseHeaders map[string]string `json:"response_headers,omitempty"`
ResponseBody string `json:"response_body,omitempty"`
}
InterceptedExchange records a single HTTP request/response pair captured via TLS interception.
type MultiSink ¶
type MultiSink struct {
// contains filtered or unexported fields
}
MultiSink fans out sessions to multiple sinks.
func NewMultiSink ¶
func NewMultiSink(sinks ...SessionSink) *MultiSink
type Session ¶
type Session struct {
ID string `json:"session_id"`
StartedAt time.Time `json:"started_at"`
EndedAt time.Time `json:"ended_at,omitempty"`
DurationMs int64 `json:"duration_ms,omitempty"`
ClientAddr string `json:"client_addr"`
TargetHost string `json:"target_host"`
TargetPort string `json:"target_port"`
DialStatus string `json:"dial_status,omitempty"`
Error string `json:"error,omitempty"`
Exchanges []InterceptedExchange `json:"exchanges,omitempty"`
}
func NewSession ¶
type SessionObserver ¶
type SessionObserver func(s *Session)
SessionObserver is called when a new session is logged.
type SessionSink ¶
type SessionSink interface {
Log(s *Session)
}
SessionSink receives completed sessions for logging or processing.
type SessionStore ¶
type SessionStore struct {
// contains filtered or unexported fields
}
SessionStore is a thread-safe in-memory ring buffer of recent sessions.
func NewSessionStore ¶
func NewSessionStore(capacity int) *SessionStore
func (*SessionStore) GetByID ¶
func (s *SessionStore) GetByID(id string) *Session
GetByID looks up a session by ID.
func (*SessionStore) Log ¶
func (s *SessionStore) Log(sess *Session)
Log adds a session to the ring buffer and notifies observers.
func (*SessionStore) OnSession ¶
func (s *SessionStore) OnSession(fn SessionObserver)
OnSession registers a callback for new sessions.
func (*SessionStore) Recent ¶
func (s *SessionStore) Recent(limit int) []*Session
Recent returns the most recent N sessions, newest first.
func (*SessionStore) Stats ¶
func (s *SessionStore) Stats() StoreStats
type StoreStats ¶
type StoreStats struct {
TotalSessions int `json:"total_sessions"`
BlockedCount int `json:"blocked_count"`
FileDetections int `json:"file_detections"`
}
Stats returns aggregate statistics.
Source Files
Directories