Documentation
¶
Overview ¶
Package audit defines audit events and the Recorder contract that any module uses to record who did what to which resource, and whether it worked. Storage lives in separate modules (for example auditpg).
Audit events are not application logs: they have their own retention, integrity and access rules (ADR-0026).
Stability: stable (ADR-0015, ADR-0054).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Event ¶
type Event struct {
// OccurredAt is set by recorders when zero.
OccurredAt time.Time
ActorKind actor.Kind
ActorID string
ActorLabel string
// Action is a dotted, past-tense name namespaced by module, such as
// "auth.session.revoked". Action names are public API (ADR-0015).
Action string
ResourceType string
ResourceID string
Outcome Outcome
OrgID string
RequestID string
TraceID string
IP string
UserAgent string
// Metadata holds structured detail. Recorders apply redaction rules.
Metadata map[string]any
}
An Event records one audited action.
func FromContext ¶
FromContext returns e with empty actor, organisation, request, trace, IP and user agent fields filled from ctx. The IP address and user agent come from actor.WithClient.
type LogRecorder ¶
type LogRecorder struct {
// contains filtered or unexported fields
}
LogRecorder writes audit events to a structured logger. It is meant for development and apps without an audit store; metadata is not logged.
func NewLogRecorder ¶
func NewLogRecorder(logger *slog.Logger) *LogRecorder
NewLogRecorder returns a recorder logging to logger.
Source Files