audit

Documentation

Index

• Constants
• func MatchFilter(entry Entry, filter QueryFilter) bool
• type Entry
  • func LimitNewest(entries []Entry, limit int) []Entry
• type Logger
  • func NewLogger(config LoggerConfig) *Logger
  • func (l *Logger) Record(entry Entry) error
  • func (l *Logger) Store() Store
• type LoggerConfig
• type MetricsRecorder
• type QueryFilter
• type RPCError
• type Redactor
• type Signer
  • func NewSigner(secret string) *Signer
  • func (s *Signer) Enabled() bool
  • func (s *Signer) Sign(entry Entry) string
• type Stats
  • func BuildStats(entries []Entry) Stats
• type Store
• type ToolStat
• type TraceExporter

Constants

const DirectionClientToServer = "client→server"

DirectionClientToServer names client-to-server audit direction.

const DirectionServerToClient = "server→client"

DirectionServerToClient names server-to-client audit direction.

Functions

func MatchFilter

func MatchFilter(entry Entry, filter QueryFilter) bool

MatchFilter reports whether entry satisfies filter.

Types

type Entry

type Entry struct {
	ID         string          `json:"id"`
	Timestamp  time.Time       `json:"timestamp"`
	Direction  string          `json:"direction"`
	Transport  string          `json:"transport"`
	Method     string          `json:"method"`
	RequestID  string          `json:"request_id,omitempty"`
	ToolName   string          `json:"tool_name,omitempty"`
	Params     json.RawMessage `json:"params,omitempty"`
	Result     json.RawMessage `json:"result,omitempty"`
	Error      *RPCError       `json:"error,omitempty"`
	DurationMs int64           `json:"duration_ms"`
	ClientID   string          `json:"client_id"`
	ServerID   string          `json:"server_id"`
	Signature  string          `json:"signature"`
}

Entry is a single audited JSON-RPC exchange or message.

func LimitNewest

func LimitNewest(entries []Entry, limit int) []Entry

LimitNewest sorts entries newest first and applies limit.

type Logger

type Logger struct {
	// contains filtered or unexported fields
}

Logger records signed audit entries.

func NewLogger

func NewLogger(config LoggerConfig) *Logger

NewLogger creates an audit logger.

func (*Logger) Record

func (l *Logger) Record(entry Entry) error

Record records entry after applying redaction and signing.

func (*Logger) Store

func (l *Logger) Store() Store

Store returns the logger storage backend.

type LoggerConfig

type LoggerConfig struct {
	Store     Store
	Signer    *Signer
	Redactor  Redactor
	Log       *slog.Logger
	Transport string
	ClientID  string
	ServerID  string
	Metrics   MetricsRecorder
	Trace     TraceExporter
}

LoggerConfig configures a Logger.

type MetricsRecorder

type MetricsRecorder interface {
	RecordAuditEntry(entry Entry)
}

MetricsRecorder records audit metrics.

type QueryFilter

type QueryFilter struct {
	Method   string
	ToolName string
	ClientID string
	From     time.Time
	To       time.Time
	Limit    int
}

QueryFilter filters dashboard and API audit queries.

type RPCError

type RPCError struct {
	Code    int             `json:"code"`
	Message string          `json:"message"`
	Data    json.RawMessage `json:"data,omitempty"`
}

RPCError represents a JSON-RPC error object.

type Redactor

type Redactor interface {
	Redact(raw json.RawMessage) json.RawMessage
}

Redactor redacts sensitive values before entries are stored.

type Signer

type Signer struct {
	// contains filtered or unexported fields
}

Signer signs audit entries using HMAC-SHA256.

func NewSigner

func NewSigner(secret string) *Signer

NewSigner returns a signer for secret. Empty secrets disable signing.

func (*Signer) Enabled

func (s *Signer) Enabled() bool

Enabled reports whether the signer has a secret.

func (*Signer) Sign

func (s *Signer) Sign(entry Entry) string

Sign returns the HMAC-SHA256 signature for entry.

type Stats

type Stats struct {
	TotalToday int        `json:"total_today"`
	ErrorRate  float64    `json:"error_rate"`
	TopTools   []ToolStat `json:"top_tools"`
}

Stats contains dashboard aggregate data.

func BuildStats

func BuildStats(entries []Entry) Stats

BuildStats builds dashboard statistics from entries.

type Store

type Store interface {
	Append(entry Entry) error
	Query(filter QueryFilter) ([]Entry, error)
	Stats() (Stats, error)
	Close() error
}

Store persists and queries audit entries.

type ToolStat

type ToolStat struct {
	Name  string `json:"name"`
	Count int    `json:"count"`
}

ToolStat is a count for a tool name.

type TraceExporter

type TraceExporter interface {
	ExportAuditEntry(entry Entry) error
}

TraceExporter exports audit entries to an operational tracing backend.