audit

Documentation

Index

• type Action
• type AsyncSink
  • func NewAsyncSink(sink Sink, bufferSize int, onError func(error)) *AsyncSink
  • func (as *AsyncSink) Close() error
  • func (as *AsyncSink) Emit(e AuditEvent) error
• type AuditEvent
  • func NewEvent(actor, role string, action Action, resource string, oldVal, newVal interface{}) AuditEvent
• type JSONSink
  • func NewJSONSink(w io.Writer) *JSONSink
  • func (s *JSONSink) Close() error
  • func (s *JSONSink) Emit(e AuditEvent) error
• type MultiSink
  • func NewMultiSink(sinks ...Sink) *MultiSink
  • func (ms *MultiSink) Close() error
  • func (ms *MultiSink) Emit(e AuditEvent) error
• type Sink

Types

type Action

type Action string

const (
	ActionWrite Action = "WRITE"
	ActionRead  Action = "READ" // Optional for high-security environments
)

type AsyncSink

type AsyncSink struct {
	// contains filtered or unexported fields
}

AsyncSink wraps a Sink with a buffered channel. It ensures that slow sinks do not block the application.

func NewAsyncSink

func NewAsyncSink(sink Sink, bufferSize int, onError func(error)) *AsyncSink

func (*AsyncSink) Close

func (as *AsyncSink) Close() error

func (*AsyncSink) Emit

func (as *AsyncSink) Emit(e AuditEvent) error

type AuditEvent

type AuditEvent struct {
	ID        string            `json:"id"`
	Timestamp time.Time         `json:"timestamp"`
	Actor     string            `json:"actor"`     // User who performed the action
	Role      string            `json:"role"`      // Role of the user
	Action    Action            `json:"action"`    // What happened
	Resource  string            `json:"resource"`  // Variable/Path affected
	OldValue  interface{}       `json:"old_value"` // Snapshot before change
	NewValue  interface{}       `json:"new_value"` // Snapshot after change
	Metadata  map[string]string `json:"metadata,omitempty"`
}

AuditEvent represents a single immutable audit record. It is designed for machine parsability (JSON).

func NewEvent

func NewEvent(actor, role string, action Action, resource string, oldVal, newVal interface{}) AuditEvent

NewEvent creates a standard event with ID and Timestamp pre-filled.

type JSONSink

type JSONSink struct {
	// contains filtered or unexported fields
}

JSONSink writes events as newline-delimited JSON.

func NewJSONSink

func NewJSONSink(w io.Writer) *JSONSink

func (*JSONSink) Close

func (s *JSONSink) Close() error

func (*JSONSink) Emit

func (s *JSONSink) Emit(e AuditEvent) error

type MultiSink

type MultiSink struct {
	// contains filtered or unexported fields
}

MultiSink dispatches events to multiple destinations (Fan-Out).

func NewMultiSink

func NewMultiSink(sinks ...Sink) *MultiSink

func (*MultiSink) Close

func (ms *MultiSink) Close() error

func (*MultiSink) Emit

func (ms *MultiSink) Emit(e AuditEvent) error

type Sink

type Sink interface {
	Emit(e AuditEvent) error
	Close() error
}

Sink is a destination for audit events.