audit

type Entry struct {
	// ID is the unique identifier for this audit entry.
	ID string `json:"id"`
	// Timestamp is when the request was processed.
	Timestamp time.Time `json:"timestamp"`
	// User is the authenticated subject (from JWT sub claim).
	User string `json:"user"`
	// Roles are the roles from the JWT token.
	Roles []string `json:"roles"`
	// Method is the HTTP method (GET, POST, PUT, DELETE).
	Method string `json:"method"`
	// Path is the request URL path.
	Path string `json:"path"`
	// OperationID is the OpenAPI operation ID (if available).
	OperationID string `json:"operation_id,omitempty"`
	// SourceIP is the client's IP address.
	SourceIP string `json:"source_ip"`
	// ResponseCode is the HTTP response status code.
	ResponseCode int `json:"response_code"`
	// DurationMs is the request processing time in milliseconds.
	DurationMs int64 `json:"duration_ms"`
	// TraceID is the OpenTelemetry trace ID for correlation.
	TraceID string `json:"trace_id,omitempty"`
	// JobID is the job the request created, empty for a request that created
	// none. It is what joins an audit entry to the job's own status timeline.
	JobID string `json:"job_id,omitempty"`
	// RequestSummary is what the request asked for, with sensitive values
	// replaced. Recorded for methods that change something, because "who ran
	// command/shell against which host" without the command is not an answer.
	RequestSummary string `json:"request_summary,omitempty"`
}

type Publisher interface {
	Publish(
		ctx context.Context,
		subject string,
		data []byte,
	) error
}

type Store interface {
	// Write persists an audit entry.
	Write(
		ctx context.Context,
		entry Entry,
	) error

	// Get retrieves a single audit entry by ID.
	Get(
		ctx context.Context,
		id string,
	) (*Entry, error)

	// List retrieves audit entries with pagination.
	// Returns the entries, total count, and any error.
	List(
		ctx context.Context,
		limit int,
		offset int,
	) ([]Entry, int, error)

	// ListAll retrieves all audit entries without pagination.
	ListAll(
		ctx context.Context,
	) ([]Entry, error)
}

type StreamStore struct {
	// contains filtered or unexported fields
}