Documentation
¶
Overview ¶
Package resourceaudit records reads of managed-resource content as audit events and stamps the durable last-read time on the resource row.
It exists so the three doors that serve a resource's bytes — MCP resources/read, a search `fetch` of an mcp:resource:<id> reference, and the REST content download — produce one event shape from one implementation. A per-surface copy would drift on exactly the fields a curator asks about ("which door was this read through, and when was it last touched"), and the usage rollup reads those fields back by name.
The recorder is the audit-enabled switch for the feature: a deployment with audit disabled wires no recorder, so reads are neither audited nor counted and continue to serve unchanged. Recording never fails a read — a resource whose audit row cannot be written is still a resource the caller asked for.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Recorder ¶
type Recorder struct {
// contains filtered or unexported fields
}
Recorder writes resource read events through an audit logger and stamps the resource's last-read column.
func New ¶
func New(logger middleware.AuditLogger, tracker resource.ReadTracker) *Recorder
New builds a recorder over an audit logger and an optional read tracker.
logger determines the delivery discipline: pass the platform's async logger on the MCP paths, where a synchronous insert would sit in front of an agent's read, and the store-backed logger on the REST path, where the caller is a human clicking Download. A nil logger yields a nil Recorder, which every call site tolerates, so "audit disabled" needs no second switch.
tracker may be nil (a store that does not implement resource.ReadTracker); the events are still written and only the sortable last-read column goes unstamped.
func (*Recorder) RecordRead ¶
RecordRead writes one resource_read audit event and stamps the resource's last-read time. Both failures are logged and swallowed: the content has already been served (or is about to be), and a lost audit row must not become a failed read.
The stamp is a single UPDATE by primary key issued inline rather than from a goroutine: a detached write per read is the unbounded-goroutine shape a stalled database turns into a leak (#884), and the audit write itself is already where the latency budget went.
Source Files