audit

Documentation

Overview

Package audit provides session logging, storage, and observation for intercepted proxy traffic.

Index

• type FileRef
• type InterceptedExchange
• type Logger
  • func NewLogger(format, file string, maxSize int64) (*Logger, error)
  • func (l *Logger) Close() error
  • func (l *Logger) Log(s *Session)
• type MultiSink
  • func NewMultiSink(sinks ...SessionSink) *MultiSink
  • func (m *MultiSink) Log(s *Session)
• type Session
  • func NewSession(clientAddr, targetHost, targetPort string) *Session
  • func (s *Session) Finish()
• type SessionObserver
• type SessionSink
• type SessionStore
  • func NewSessionStore(capacity int) *SessionStore
  • func (s *SessionStore) GetByID(id string) *Session
  • func (s *SessionStore) Log(sess *Session)
  • func (s *SessionStore) OnSession(fn SessionObserver)
  • func (s *SessionStore) Recent(limit int) []*Session
  • func (s *SessionStore) Stats() StoreStats
• type StoreStats

Types

type FileRef

type FileRef struct {
	Path   string `json:"path"`
	Source string `json:"source"` // how it was detected: "json_field", "text_pattern"
}

FileRef represents a file reference detected in an API payload.

type InterceptedExchange

type InterceptedExchange struct {
	Timestamp       time.Time         `json:"timestamp"`
	Method          string            `json:"method"`
	URL             string            `json:"url"`
	RequestHeaders  map[string]string `json:"request_headers,omitempty"`
	RequestBody     string            `json:"request_body,omitempty"`
	DetectedFiles   []FileRef         `json:"detected_files,omitempty"`
	Blocked         bool              `json:"blocked,omitempty"`
	BlockReason     string            `json:"block_reason,omitempty"`
	StatusCode      int               `json:"status_code"`
	ResponseHeaders map[string]string `json:"response_headers,omitempty"`
	ResponseBody    string            `json:"response_body,omitempty"`
}

InterceptedExchange records a single HTTP request/response pair captured via TLS interception.

type Logger

type Logger struct {
	// contains filtered or unexported fields
}

func NewLogger

func NewLogger(format, file string, maxSize int64) (*Logger, error)

func (*Logger) Close

func (l *Logger) Close() error

func (*Logger) Log

func (l *Logger) Log(s *Session)

type MultiSink

type MultiSink struct {
	// contains filtered or unexported fields
}

MultiSink fans out sessions to multiple sinks.

func NewMultiSink

func NewMultiSink(sinks ...SessionSink) *MultiSink

func (*MultiSink) Log

func (m *MultiSink) Log(s *Session)

type Session

type Session struct {
	ID         string                `json:"session_id"`
	StartedAt  time.Time             `json:"started_at"`
	EndedAt    time.Time             `json:"ended_at,omitempty"`
	DurationMs int64                 `json:"duration_ms,omitempty"`
	ClientAddr string                `json:"client_addr"`
	TargetHost string                `json:"target_host"`
	TargetPort string                `json:"target_port"`
	DialStatus string                `json:"dial_status,omitempty"`
	Error      string                `json:"error,omitempty"`
	Exchanges  []InterceptedExchange `json:"exchanges,omitempty"`
}

func NewSession

func NewSession(clientAddr, targetHost, targetPort string) *Session

func (*Session) Finish

func (s *Session) Finish()

type SessionObserver

type SessionObserver func(s *Session)

SessionObserver is called when a new session is logged.

type SessionSink

type SessionSink interface {
	Log(s *Session)
}

SessionSink receives completed sessions for logging or processing.

type SessionStore

type SessionStore struct {
	// contains filtered or unexported fields
}

SessionStore is a thread-safe in-memory ring buffer of recent sessions.

func NewSessionStore

func NewSessionStore(capacity int) *SessionStore

func (*SessionStore) GetByID

func (s *SessionStore) GetByID(id string) *Session

GetByID looks up a session by ID.

func (*SessionStore) Log

func (s *SessionStore) Log(sess *Session)

Log adds a session to the ring buffer and notifies observers.

func (*SessionStore) OnSession

func (s *SessionStore) OnSession(fn SessionObserver)

OnSession registers a callback for new sessions.

func (*SessionStore) Recent

func (s *SessionStore) Recent(limit int) []*Session

Recent returns the most recent N sessions, newest first.

func (*SessionStore) Stats

func (s *SessionStore) Stats() StoreStats

type StoreStats

type StoreStats struct {
	TotalSessions  int `json:"total_sessions"`
	BlockedCount   int `json:"blocked_count"`
	FileDetections int `json:"file_detections"`
}

Stats returns aggregate statistics.