Documentation
¶
Overview ¶
Package audit is the /v1/admin/audit query surface, wired to cloud's REAL tamper-evident audit store (the audit.Recorder Serve builds and hands over via deps.Audit).
cloud keeps its OWN append-only, hash-chained trail of every security-relevant request against this binary, and that is what a compliance auditor queries here. IAM's own login/session records remain a DIFFERENT trail; admin still federates them as a fallback when cloud's local store is not configured, so no capability is lost.
SECURITY. Both ops call core.Admit (SuperAdmin only, fail-closed) on their first line. They are READ-ONLY (Query and Verify issue SELECT only), so exposing them cannot weaken the append-only property.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type RecordsIn ¶
type RecordsIn struct {
// Org restricts the trail to one tenant.
Org string `json:"org"`
// Sub restricts it to one actor (the validated subject that made the request).
Sub string `json:"sub"`
// Action restricts it to one action name, e.g. "admin.waitlist.grant".
Action string `json:"action"`
// Resource restricts it to one resource kind, e.g. "credit-grant".
Resource string `json:"resource"`
// ResourceID restricts it to one resource instance.
ResourceID string `json:"resourceId"`
// Result restricts it to "success" or "error".
Result string `json:"result"`
// Since is the inclusive lower time bound, RFC3339. An unparseable value is
// ignored rather than refused — one malformed filter must not hide the trail.
Since string `json:"since"`
// Until is the upper time bound, RFC3339, with the same tolerance.
Until string `json:"until"`
// PageSize is rows per page, default 100.
PageSize string `json:"pageSize"`
// Page is the 1-based page number, driving the offset.
Page string `json:"p"`
}
RecordsIn is the GET /v1/admin/audit filter. Every field is optional; a blank one is simply not applied.
type RecordsOut ¶
type RecordsOut struct {
Status string `json:"status"`
Msg string `json:"msg"`
Data any `json:"data"`
Total *int `json:"total,omitempty"`
Integrity *auditstore.Integrity `json:"integrity"`
}
RecordsOut is the GET /v1/admin/audit envelope.
`integrity` is this op's own field, beside the envelope's four: it carries the chain's live verification so the console can badge a listing as verified without a second round trip. It is null when the check could not run — a verify failure must not fail the listing — and on the IAM fallback, which is a different trail with no chain of ours to verify.
`data` is opaque because it is one of two shapes: this store's own records (audit.Wire), or IAM's get-records payload forwarded verbatim by the fallback.
Source Files