Documentation
¶
Overview ¶
Package audithook bridges Keysmith lifecycle events to an audit trail backend. It defines a local Recorder interface so the package does not import Chronicle directly.
Index ¶
- Constants
- type AuditEvent
- type Extension
- func (e *Extension) Name() string
- func (e *Extension) OnKeyCreateFailed(ctx context.Context, k *key.Key, createErr error) error
- func (e *Extension) OnKeyCreated(ctx context.Context, k *key.Key) error
- func (e *Extension) OnKeyExpired(ctx context.Context, k *key.Key) error
- func (e *Extension) OnKeyRateLimited(ctx context.Context, k *key.Key) error
- func (e *Extension) OnKeyReactivated(ctx context.Context, k *key.Key) error
- func (e *Extension) OnKeyRevoked(ctx context.Context, k *key.Key, reason string) error
- func (e *Extension) OnKeyRotated(ctx context.Context, k *key.Key, rec *rotation.Record) error
- func (e *Extension) OnKeySuspended(ctx context.Context, k *key.Key) error
- func (e *Extension) OnKeyValidated(ctx context.Context, k *key.Key) error
- func (e *Extension) OnKeyValidationFailed(ctx context.Context, _ string, validationErr error) error
- func (e *Extension) OnPolicyCreated(ctx context.Context, pol *policy.Policy) error
- func (e *Extension) OnPolicyDeleted(ctx context.Context, polID id.PolicyID) error
- func (e *Extension) OnPolicyUpdated(ctx context.Context, pol *policy.Policy) error
- type Option
- type Recorder
- type RecorderFunc
Constants ¶
const ( SeverityInfo = "info" SeverityWarning = "warning" SeverityCritical = "critical" )
Severity constants.
const ( OutcomeSuccess = "success" OutcomeFailure = "failure" )
Outcome constants.
const ( ActionKeyCreated = "keysmith.key.created" ActionKeyCreateFailed = "keysmith.key.create_failed" ActionKeyValidated = "keysmith.key.validated" ActionKeyValidationFailed = "keysmith.key.validation_failed" ActionKeyRotated = "keysmith.key.rotated" ActionKeyRevoked = "keysmith.key.revoked" ActionKeySuspended = "keysmith.key.suspended" ActionKeyReactivated = "keysmith.key.reactivated" ActionKeyExpired = "keysmith.key.expired" ActionKeyRateLimited = "keysmith.key.rate_limited" ActionPolicyCreated = "keysmith.policy.created" ActionPolicyUpdated = "keysmith.policy.updated" ActionPolicyDeleted = "keysmith.policy.deleted" )
Action constants.
const ( ResourceKey = "key" ResourcePolicy = "policy" )
Resource constants.
const ( CategoryKeyLifecycle = "key_lifecycle" CategoryKeyValidation = "key_validation" CategoryKeySecurity = "key_security" CategoryPolicyLifecycle = "policy_lifecycle" )
Category constants.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuditEvent ¶
type AuditEvent struct {
Action string `json:"action"`
Resource string `json:"resource"`
Category string `json:"category"`
ResourceID string `json:"resource_id,omitempty"`
Metadata map[string]any `json:"metadata,omitempty"`
Outcome string `json:"outcome"`
Severity string `json:"severity"`
Reason string `json:"reason,omitempty"`
}
AuditEvent is a local representation of an audit event.
type Extension ¶
type Extension struct {
// contains filtered or unexported fields
}
Extension bridges Keysmith lifecycle events to an audit trail backend.
func (*Extension) OnKeyCreateFailed ¶
OnKeyCreateFailed implements plugin.KeyCreateFailed.
func (*Extension) OnKeyCreated ¶
OnKeyCreated implements plugin.KeyCreated.
func (*Extension) OnKeyExpired ¶
OnKeyExpired implements plugin.KeyExpired.
func (*Extension) OnKeyRateLimited ¶
OnKeyRateLimited implements plugin.KeyRateLimited.
func (*Extension) OnKeyReactivated ¶
OnKeyReactivated implements plugin.KeyReactivated.
func (*Extension) OnKeyRevoked ¶
OnKeyRevoked implements plugin.KeyRevoked.
func (*Extension) OnKeyRotated ¶
OnKeyRotated implements plugin.KeyRotated.
func (*Extension) OnKeySuspended ¶
OnKeySuspended implements plugin.KeySuspended.
func (*Extension) OnKeyValidated ¶
OnKeyValidated implements plugin.KeyValidated.
func (*Extension) OnKeyValidationFailed ¶
OnKeyValidationFailed implements plugin.KeyValidationFailed.
func (*Extension) OnPolicyCreated ¶
OnPolicyCreated implements plugin.PolicyCreated.
func (*Extension) OnPolicyDeleted ¶
OnPolicyDeleted implements plugin.PolicyDeleted.
type Option ¶
type Option func(*Extension)
Option configures an Extension.
func WithEnabled ¶
WithEnabled restricts audit recording to the specified actions only. If not called, all actions are recorded.
func WithLogger ¶
WithLogger sets the logger for recording errors.
type Recorder ¶
type Recorder interface {
Record(ctx context.Context, event *AuditEvent) error
}
Recorder is the interface that audit backends must implement.
type RecorderFunc ¶
type RecorderFunc func(ctx context.Context, event *AuditEvent) error
RecorderFunc is an adapter to use a plain function as a Recorder.
func (RecorderFunc) Record ¶
func (f RecorderFunc) Record(ctx context.Context, event *AuditEvent) error
Record implements Recorder.
Source Files