audit

const (
	// UserLogin records a successful login. Failures are not recorded
	// here — a failed login says nothing about who the actor was, and
	// recording attempts keyed by a supplied email would turn the audit log
	// into a place to write arbitrary strings.
	UserLogin = "user.login"
	// UserLogout records a session being revoked on purpose. It is the
	// counterpart to UserLogin: together they bound when a session could
	// have been used.
	UserLogout = "user.logout"
	// RefreshReuse records a refresh token presented after it had already
	// been exchanged. It means the credential existed in two places, and the
	// session was revoked in response. Unlike the actions above this is not a
	// user's intent — it is the server reporting what it saw.
	RefreshReuse = "auth.refresh_reuse"
	// PasswordSet records an account's password being set or changed. The
	// event says that it happened, never what it became.
	PasswordSet = "user.password_set"
	// UserCreated records an account coming into existence, and
	// LoginCodeIssued records a way into one being minted. They are
	// separate because they are separate decisions: creating an account gives
	// nobody access until a code or a password follows.
	UserCreated     = "user.created"
	LoginCodeIssued = "user.login_code_issued"
	// UserDisabled and UserEnabled record an account's access being
	// stopped and restored. Disabling is not deletion: nothing is removed, and
	// enabling reverses the state and nothing else.
	UserDisabled = "user.disabled"
	UserEnabled  = "user.enabled"
	// SessionsRevoked records every live session of one account being
	// retired at once. It is separate from user.logout, which is a person
	// ending their own.
	SessionsRevoked = "user.sessions_revoked"
	// TeamMemberAdded and TeamMemberRemoved record changes to who
	// can reach a team's resources.
	TeamMemberAdded   = "team.member_added"
	TeamMemberRemoved = "team.member_removed"
	// ModelCreated, ModelEnabled, and ModelDisabled record
	// changes to which models a deployment will call. The catalog holds
	// provider credentials, so a change to it is a change to what the
	// deployment can spend and where prompts go.
	ModelCreated  = "llm_model.created"
	ModelEnabled  = "llm_model.enabled"
	ModelDisabled = "llm_model.disabled"
	// AccessDenied records a refused request. This is the one action
	// written on failure rather than success: a denial is what shows someone
	// probing at a boundary. TeamID is empty when the refused route was
	// deployment-scoped rather than team-scoped.
	AccessDenied = "access.denied"
	// SystemAdminGranted and SystemAdminRevoked record deployment
	// authority changing hands. They are not team-scoped, so TeamID is empty.
	//
	// These are the two actions in this list where a dropped write costs the
	// most: a grant that was made and not recorded is exactly what an
	// investigation needs. The write is still best-effort, for the reason in
	// internal/service/audit — see docs/design/system-administration.md
	// section 9.
	SystemAdminGranted = "system.admin_granted"
	SystemAdminRevoked = "system.admin_revoked"
	// ArtifactCreated and ArtifactDeleted record a durable file
	// entering and leaving a team's keeping. They are metadata-only by
	// construction: the target is the ar_ ID, and neither the storage key, the
	// content, nor an uploader-supplied description belongs in the trail.
	ArtifactCreated = "artifact.created"
	ArtifactDeleted = "artifact.deleted"
	// The plugin actions record changes to what a deployment's members can
	// install. A release is instructions that cause tool use, processes that
	// start with someone's credentials, and hooks that run local programs, so
	// publishing one is a change to what every machine that installs it will
	// do. The detail names the version and a digest prefix — never package
	// contents or configuration values.
	PluginCreated    = "plugin.created"
	PluginUpdated    = "plugin.updated"
	PluginArchived   = "plugin.archived"
	PluginUnarchived = "plugin.unarchived"
	PluginPublished  = "plugin.published"
	PluginYanked     = "plugin.yanked"

	// A team activating a release is the record that answers "why did this run
	// have this capability". The pin moves and the suspension are separate
	// actions because each is a different decision about a team's runs.
	PluginActivated    = "plugin.activated"
	PluginPinMoved     = "plugin.pin_moved"
	PluginSuspended    = "plugin.suspended"
	PluginResumed      = "plugin.resumed"
	TeamPluginCuration = "team.plugin_curation_set"
	// EventsExported records the trail itself being read out in bulk.
	// Reading every recorded action is a sensitive action, and an export that
	// left no trace would be the one way to consult the record without
	// appearing in it.
	EventsExported = "audit.exported"
	// EventsPruned records events expiring under the deployment's
	// retention window, naming the cutoff and how many rows went.
	//
	// It is what separates a gap that policy created from evidence that was
	// lost: without it, a trail that starts on a Tuesday is indistinguishable
	// from a trail somebody truncated. Recording the deletion in the same
	// table it deletes from is deliberate — the event survives its own sweep
	// until the window moves past it, and by then a later one says the same.
	EventsPruned = "audit.pruned"
	// QuotaThresholdReached records a team crossing a share of its quota,
	// and QuotaExceeded records work being refused because the limit was
	// reached. The first is a warning nobody was blocked by; the second is the
	// block. They are separate actions because they call for different
	// responses — one is a heads-up, the other is work not happening.
	//
	// Both are written at most once per limit per period, so a team that keeps
	// submitting does not turn its own trail into a log of retries.
	QuotaThresholdReached = "quota.threshold_reached"
	QuotaExceeded         = "quota.exceeded"
)

const (
	ActorUser   = "user"
	ActorWorker = "worker"
	ActorSystem = "system"
)

const ActorOperator = "buildmax-server"