Initial Commit

openspec/changes/enterprise-api-plugin-audit/proposal.md

@@ -0,0 +1,84 @@
+# OpenSpec Change: enterprise-api-plugin-audit
+
+- **Change ID**: enterprise-api-plugin-audit
+- **Package**: `@suaveplan/api-plugin-audit`
+- **Category**: api/data
+- **Target path**: `api/data/api-plugin-audit`
+- **Status**: PROPOSED
+- **Date**: 2026-04-24
+- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/api-plugin-audit.md`
+
+---
+
+## Summary
+
+Deliver `@suaveplan/api-plugin-audit` on the genesis branch from scratch at enterprise quality. Audit logging plugin: wraps `@suaveplan/audit-logging` and persists audit entries to SurrealDB, exposes query APIs (`/audit`), enforces immutability (no update/delete on audit records), configurable retention policy, and an audit middleware factory for other plugins. Routes under `/audit`. Per-table SurrealQL. Events: `audit:entry:created`. Used by every write path across the API tier.
+
+---
+
+## Available workspace deps on genesis
+
+| Package | Role |
+|---|---|
+| `@suaveplan/api` (`workspace:^`) | `definePlugin` |
+| `@suaveplan/api-shared` (`workspace:^`) | Helpers |
+| `@suaveplan/api-plugin-auth` (`workspace:^`) | `requireAuth`, `requireRole` |
+| `@suaveplan/api-plugin-database` (`workspace:^`) | SurrealDB |
+| `@suaveplan/audit-logging` (`workspace:^`) | Audit entry creation |
+| `@suaveplan/events` (`workspace:^`) | Event bus |
+| `@suaveplan/error` (`workspace:^`) | `AuditPluginError` hierarchy |
+| `@suaveplan/rate-limiter` (`workspace:^`) | Rate limits |
+| `hono` + `@hono/zod-openapi` + `zod` | Routes |
+| `@opentelemetry/api` | OTel |
+
+---
+
+## Public API surface
+
+```ts
+function createAuditPlugin(config?: AuditPluginConfig): PluginDescriptor
+
+// Registered service:
+interface AuditPluginService {
+  log(entry: AuditLogInput): Promise<void>
+  query(params: AuditQuery): Promise<AuditEntry[]>
+  middleware(action: string): MiddlewareHandler
+}
+
+interface AuditEntry {
+  id: string; tenantId: string; userId?: string; action: string
+  resource: string; resourceId?: string; changes?: Record<string, unknown>
+  ipAddress?: string; userAgent?: string; timestamp: Date
+}
+```
+
+### Error codes
+
+```ts
+type AuditPluginErrorCode =
+  | "AUDIT_ENTRY_NOT_FOUND"
+  | "AUDIT_WRITE_FAILED"
+  | "AUDIT_QUERY_INVALID"
+```
+
+---
+
+## File layout
+
+```text
+api/data/api-plugin-audit/
+  package.json  tsconfig.json  vitest.config.ts
+  surql/ (audit_entry table — immutable, append-only)
+  src/
+    index.ts  events.ts  types/  errors/
+    services/audit/
+    middleware/audit/
+    routes/audit/
+  tests/integration.test.ts
+```
+
+---
+
+## Impact
+
+Prerequisites: `@suaveplan/api`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/audit-logging`.