# OpenSpec Change: enterprise-api-plugin-audit

- **Change ID**: enterprise-api-plugin-audit
- **Package**: `@suaveplan/api-plugin-audit`
- **Category**: api/data
- **Target path**: `api/data/api-plugin-audit`
- **Status**: PROPOSED
- **Date**: 2026-04-24
- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/api-plugin-audit.md`

---

## Summary

Deliver `@suaveplan/api-plugin-audit` on the genesis branch from scratch at enterprise quality. Audit logging plugin: wraps `@suaveplan/audit-logging` and persists audit entries to SurrealDB, exposes query APIs (`/audit`), enforces immutability (no update/delete on audit records), configurable retention policy, and an audit middleware factory for other plugins. Routes under `/audit`. Per-table SurrealQL. Events: `audit:entry:created`. Used by every write path across the API tier.

---

## Available workspace deps on genesis

| Package | Role |
|---|---|
| `@suaveplan/api` (`workspace:^`) | `definePlugin` |
| `@suaveplan/api-shared` (`workspace:^`) | Helpers |
| `@suaveplan/api-plugin-auth` (`workspace:^`) | `requireAuth`, `requireRole` |
| `@suaveplan/api-plugin-database` (`workspace:^`) | SurrealDB |
| `@suaveplan/audit-logging` (`workspace:^`) | Audit entry creation |
| `@suaveplan/events` (`workspace:^`) | Event bus |
| `@suaveplan/error` (`workspace:^`) | `AuditPluginError` hierarchy |
| `@suaveplan/rate-limiter` (`workspace:^`) | Rate limits |
| `hono` + `@hono/zod-openapi` + `zod` | Routes |
| `@opentelemetry/api` | OTel |

---

## Public API surface

```ts
function createAuditPlugin(config?: AuditPluginConfig): PluginDescriptor

// Registered service:
interface AuditPluginService {
  log(entry: AuditLogInput): Promise<void>
  query(params: AuditQuery): Promise<AuditEntry[]>
  middleware(action: string): MiddlewareHandler
}

interface AuditEntry {
  id: string; tenantId: string; userId?: string; action: string
  resource: string; resourceId?: string; changes?: Record<string, unknown>
  ipAddress?: string; userAgent?: string; timestamp: Date
}
```

### Error codes

```ts
type AuditPluginErrorCode =
  | "AUDIT_ENTRY_NOT_FOUND"
  | "AUDIT_WRITE_FAILED"
  | "AUDIT_QUERY_INVALID"
```

---

## File layout

```text
api/data/api-plugin-audit/
  package.json  tsconfig.json  vitest.config.ts
  surql/ (audit_entry table — immutable, append-only)
  src/
    index.ts  events.ts  types/  errors/
    services/audit/
    middleware/audit/
    routes/audit/
  tests/integration.test.ts
```

---

## Impact

Prerequisites: `@suaveplan/api`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/audit-logging`.