Documentation
¶
Overview ¶
Package auditlog converts persisted audit rows into the normalized public read model.
Authorization, decryption, and sensitive-field blanking remain the responsibility of the gateway and API layers. Keeping those concerns outside this package makes presentation and outcome classification deterministic and reusable by HTTP responses and JSONL exports.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClassifyMCPOutcome ¶
func ClassifyMCPOutcome(status int, responseError string) api.AuditLogOutcomeStatus
ClassifyMCPOutcome derives the normalized outcome of an MCP request/response pair from the recorded HTTP status and error. Explicit denial and timeout statuses take precedence over generic errors. A row with no recorded status and no error is classified as unknown.
func NormalizeSourceTypes ¶
func NormalizeSourceTypes(sourceTypes []api.AuditLogSourceType) []api.AuditLogSourceType
NormalizeSourceTypes applies the MCP-only default and removes duplicate source types while preserving their original order. It intentionally preserves unknown values so callers can reject them during validation rather than silently changing the requested source selection.
func Present ¶
func Present(log gatewaytypes.MCPAuditLog, opts PresentOptions) api.AuditLogEvent
Present converts an internal persisted audit-log row into the normalized public read model. The caller is responsible for authorization and for loading the row with the appropriate payload visibility. Present does not mutate the input row and performs no decryption.
Types ¶
type PresentOptions ¶
type PresentOptions struct {
// IncludeDetails controls whether the event includes typed metadata and payload sections. List
// callers should leave it false; detail and export callers normally set it true.
IncludeDetails bool
// PayloadRedacted records the caller's payload authorization in the public event. It does not
// perform redaction itself: the gateway client must decrypt or blank sensitive fields before
// Present is called.
PayloadRedacted bool
}
PresentOptions controls which authorized portions of an audit event are exposed by Present.
Source Files