Documentation
¶
Overview ¶
Package auditlog captures domain events and exposes them via HTTP.
Schema contracts and domain types of the auditlog module.
Index ¶
- Constants
- type AuditLogID
- type Entry
- type ListFilters
- type Module
- type Option
- type Page
- type PostgresStore
- func (s *PostgresStore) ClientNameFilterValues(ctx context.Context) ([]string, error)
- func (s *PostgresStore) List(ctx context.Context, filters ListFilters, params Page) ([]Entry, int, error)
- func (s *PostgresStore) Record(ctx context.Context, entry *Entry, exec ...datastore.Executor) error
- func (s *PostgresStore) UserFilterValues(ctx context.Context) ([]string, error)
- type Status
- type Store
- type Trigger
Constants ¶
const ModuleName = "auditlog"
ModuleName identifies the audit log module in the registry.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuditLogID ¶
AuditLogID identifies an audit_logs row: a UUIDv7 suffix plus a snake_case prefix matching the singular table name.
type Entry ¶
type Entry struct {
ID AuditLogID `json:"id"`
Event string `json:"event"`
Trigger Trigger `json:"trigger"`
Status Status `json:"status"`
Payload map[string]any `json:"payload,omitzero"`
ResourceType string `json:"resource_type,omitzero"`
ResourceID *string `json:"resource_id,omitzero"`
UserID *string `json:"user_id,omitzero"`
IPAddress *string `json:"ip_address,omitzero"`
UserAgent *string `json:"user_agent,omitzero"`
// Device is the human-readable client summary parsed from the
// user agent at read time ("<browser> on <os> <version>").
Device string `json:"device,omitzero"`
CreatedAt time.Time `json:"created_at"`
}
Entry is a single audit record. UserID and ResourceID are raw UUID strings (columns), so the module stays decoupled from other domains' typed IDs; adapters convert at the boundary.
type ListFilters ¶
ListFilters narrows the listing. UserID is a raw UUID string (columns stay decoupled from other domains' typed IDs).
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the audit log feature: a Store plus a read-only API. The self listing is separate from the admin listing and filters.
func (*Module) RPCService ¶ added in v0.0.12
RPCService returns the Connect registration for the audit log read surface. The self listing resolves the bearer; the admin listing and filter facets demand an admin, guarded per procedure.
type Option ¶
type Option func(*Module)
Option configures the audit log module at construction.
func WithAdminGuard ¶
WithAdminGuard protects the admin listing and filters; without one those routes stay unmounted (fail closed).
func WithSelfAuth ¶
func WithSelfAuth(auth kernel.Authenticator) Option
WithSelfAuth wires the session resolver for the per-user listing; without one that route stays unmounted.
type Page ¶
Page is the store-level paging window: plain ints with no HTTP dependency. The handler converts the request query into it.
type PostgresStore ¶
type PostgresStore struct {
// contains filtered or unexported fields
}
PostgresStore persists audit entries in public.audit_logs. It builds on the shared Executor — never owns connections. Queries are composed with go-sqlbuilder (PostgreSQL flavor).
func NewPostgresStore ¶
func NewPostgresStore(exec datastore.Executor) *PostgresStore
NewPostgresStore builds the production audit log store.
func (*PostgresStore) ClientNameFilterValues ¶
func (s *PostgresStore) ClientNameFilterValues(ctx context.Context) ([]string, error)
ClientNameFilterValues lists distinct client names recorded in payloads (oidc clients carry client_name).
func (*PostgresStore) List ¶
func (s *PostgresStore) List(ctx context.Context, filters ListFilters, params Page) ([]Entry, int, error)
List returns matching entries newest first plus the total count. All-page params (-1) skip LIMIT/OFFSET.
func (*PostgresStore) Record ¶
Record inserts one entry; the row's uuidv7() default and CURRENT_TIMESTAMP fill zero ID/CreatedAt. pgx encodes the args by the target column OIDs (jsonb, enums, uuid, inet). A non-nil exec writes the row inside the caller's transaction; nil uses the store's own executor.
func (*PostgresStore) UserFilterValues ¶
func (s *PostgresStore) UserFilterValues(ctx context.Context) ([]string, error)
UserFilterValues lists distinct users appearing in the log as "id:username" pairs joined from users.
type Store ¶
type Store interface {
// Record writes one entry. A non-nil exec joins the caller's
// transaction so the audit row commits (or rolls back) with the
// domain write; nil writes standalone.
Record(ctx context.Context, entry *Entry, exec ...datastore.Executor) error
List(ctx context.Context, filters ListFilters, params Page) ([]Entry, int, error)
UserFilterValues(ctx context.Context) ([]string, error)
ClientNameFilterValues(ctx context.Context) ([]string, error)
}
Store abstracts audit persistence: Postgres for production, no memory store. Record assigns Entry.ID (and CreatedAt when zero) on the pointed-to entry. List returns the matching entries (newest first) plus the total row count.
Source Files