auditx

Documentation

Overview

Package auditx defines durable audit recording contracts.

auditx is separate from logx. logx emits operational telemetry; auditx writes append-only security records for authentication, authorization and privileged business mutations. Implementations can write to PostgreSQL, Kafka, ClickHouse, object storage or another compliance pipeline.

Package auditx defines Kernel's durable security audit contracts.

Index

• Constants
• func ErrInvalidRecord(message string) error
• func ErrStoreFailed(message string, cause error) error
• func Validate(record Record) error
• type Actor
• type AttributeSet
• type MemoryStore
  • func NewMemoryStore() *MemoryStore
  • func (s *MemoryStore) Query(ctx context.Context, filter QueryFilter) ([]Record, error)
  • func (s *MemoryStore) Record(ctx context.Context, record Record) error
• type QueryFilter
• type Queryer
• type Record
  • func (r Record) WithTime(now time.Time) Record
• type Recorder
  • func Noop() Recorder
• type Resource
• type Store

Constants

const (
	CodeInvalidRecord = errorx.Code("AUDITX_INVALID_RECORD")
	CodeStoreFailed   = errorx.Code("AUDITX_STORE_FAILED")
)

const (
	ResultSuccess = "success"
	ResultDenied  = "denied"
	ResultFailure = "failure"
)

const (
	SeverityInfo     = "info"
	SeverityWarning  = "warning"
	SeverityCritical = "critical"
)

Functions

func ErrInvalidRecord

func ErrInvalidRecord(message string) error

func ErrStoreFailed

func ErrStoreFailed(message string, cause error) error

func Validate

func Validate(record Record) error

Types

type Actor

type Actor struct {
	SubjectID   string
	SubjectType string
	TenantID    string
	OrgID       string
	ProjectID   string
	Name        string
	Email       string
	Attributes  AttributeSet
}

type AttributeSet

type AttributeSet map[string]any

type MemoryStore

type MemoryStore struct {
	// contains filtered or unexported fields
}

func NewMemoryStore

func NewMemoryStore() *MemoryStore

func (*MemoryStore) Query

func (s *MemoryStore) Query(ctx context.Context, filter QueryFilter) ([]Record, error)

func (*MemoryStore) Record

func (s *MemoryStore) Record(ctx context.Context, record Record) error

type QueryFilter

type QueryFilter struct {
	ActorID      string
	ActorType    string
	ResourceType string
	ResourceID   string
	Action       string
	Result       string
	TenantID     string
	OrgID        string
	ProjectID    string
	From         time.Time
	To           time.Time
	Limit        int
}

type Queryer

type Queryer interface {
	Query(ctx context.Context, filter QueryFilter) ([]Record, error)
}

type Record

type Record struct {
	ID        string
	Time      time.Time
	Action    string
	Result    string
	Severity  string
	Reason    string
	Actor     Actor
	Resource  Resource
	RequestID string
	TraceID   string
	ClientIP  string
	UserAgent string
	Metadata  AttributeSet
}

Record is append-only security evidence. Updates/deletes should create new records rather than mutating previous ones.

func (Record) WithTime

func (r Record) WithTime(now time.Time) Record

type Recorder

type Recorder interface {
	Record(ctx context.Context, record Record) error
}

Recorder writes durable audit records. Implementations must be safe for concurrent use. Hot-path code should depend on this interface only.

func Noop

func Noop() Recorder

type Resource

type Resource struct {
	Type       string
	ID         string
	TenantID   string
	OrgID      string
	ProjectID  string
	Attributes AttributeSet
}

type Store

type Store interface {
	Recorder
	Queryer
}