69 lines
4.4 KiB
Markdown
69 lines
4.4 KiB
Markdown
# Tasks — add-api-plugin-audit
|
|
|
|
> Every checkbox MUST reflect work actually done in this change.
|
|
|
|
## 1. Spec authoring
|
|
|
|
- [x] 1.1 Read `../suaveplan/enterprise/api-plugin-audit.md` end-to-end
|
|
- [x] 1.2 Read `openspec/specs/api-plugin-audit/spec.md` (does not exist — net-new)
|
|
- [x] 1.3 Read `openspec/AGENTS.md` Sections 13 and 14
|
|
- [x] 1.4 Draft `proposal.md` from `openspec/templates/proposal.md`
|
|
- [x] 1.5 Fill in `## Source mapping` table — every requirement cites a line range OR appears in the "no source line" table with justification
|
|
- [x] 1.6 Draft `specs/api-plugin-audit/spec.md` from `openspec/templates/spec-delta.md`
|
|
- [x] 1.7 Every requirement in the spec delta carries a `**Verified by:**` line naming concrete `it(...)` titles
|
|
|
|
## 2. Implementation
|
|
|
|
- [x] 2.1 Scaffold `packages/api/api-plugin-audit/` with `package.json`, `tsconfig.json`, `tsconfig.lib.json`, `vite.config.ts`, `vitest.config.ts`, `README.md`
|
|
- [x] 2.2 Error codes — `src/error-codes/error-codes.ts` (`AUDIT_PLUGIN_CODES` + `AuditPluginError`)
|
|
- [x] 2.3 Types — `src/types/types.ts` (`AuditPluginOptions`, `AuditPluginConfig`, `AuditService`, `AuditContext`, `RedactionRules`, etc.)
|
|
- [x] 2.4 Zod schemas — `src/schemas/options.ts`
|
|
- [x] 2.5 Redaction — `src/redact/redact.ts` (`redactPayload`, default lists)
|
|
- [x] 2.6 Audit context — `src/context/audit-context.ts` (factory + Hono `ContextVariableMap` augmentation)
|
|
- [x] 2.7 Audit service — `src/services/audit-service.ts` (wraps `AuditLogger` from `@suaveplan/audit-logging`) + `registry-augmentation.ts`
|
|
- [x] 2.8 OTel — `src/otel/instruments.ts` (counters + histogram, in-memory test exporter wiring)
|
|
- [x] 2.9 Middleware — `src/middleware/audit-middleware.ts` (global request audit, sampling, exclude, never-throw, redact)
|
|
- [x] 2.10 Plugin factory — `src/plugin/plugin.ts` (Zod-validated `createAuditPlugin`, `onInit` lifecycle, sink wiring)
|
|
- [x] 2.11 Barrel `src/index.ts` with side-effect imports (registry + context augmentations) + explicit named re-exports
|
|
|
|
## 3. Tests
|
|
|
|
- [x] 3.1 Unit tests at `src/<feature>/<feature>.test.ts` covering every scenario
|
|
- [x] 3.2 Spec-conformance tests at `src/<feature>/<feature>.spec-conformance.test.ts` pinning type-level / observability / strict-mode / lifecycle scenarios
|
|
- [x] 3.3 Integration tests at `tests/integration/full-boot.test.ts` (real api + plugin + sample route) + `tests/integration/sampling.test.ts` (50% sampling band)
|
|
- [x] 3.4 `tests/dep-graph.test.ts` — sibling `.md`, subpath export resolution
|
|
- [x] 3.5 Every `it(...)` carries `{ timeout: 5000 }` (or 30000 for genuinely async)
|
|
|
|
## 4. Documentation
|
|
|
|
- [x] 4.1 Sibling `.md` for every implementation `.ts` (≥200 words, basic + advanced examples, full API reference)
|
|
- [x] 4.2 README links every co-located `.md` under `## Modules`
|
|
- [x] 4.3 Do NOT touch `CLAUDE.md`, `MANIFEST.md`, `STATUS.md` per task instructions
|
|
|
|
## 5. Pre-archive verification (the 5-gate triple)
|
|
|
|
- [x] 5.1 `bun run check` — Biome 0 errors / 0 warnings / 0 info across the whole monorepo
|
|
- [x] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-audit --force` — green
|
|
- [x] 5.3 `bunx turbo test:coverage --filter=@suaveplan/api-plugin-audit` — 100/100/100/100
|
|
- [x] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/api-plugin-audit` — exit 0
|
|
- [x] 5.5 `bunx turbo build --filter=@suaveplan/api-plugin-audit --force` — green
|
|
- [x] 5.6 `bun scripts/lint/check-test-runner-imports.ts` — exit 0
|
|
|
|
## 6. Pre-archive 9-row checklist (skill SKILL.md)
|
|
|
|
- [x] 6.1 Generics threaded; `expectTypeOf` assertions on every literal-type claim
|
|
- [x] 6.2 Zod schemas wired at every declared boundary
|
|
- [x] 6.3 Every error code in `error-codes.ts` thrown by at least one production path
|
|
- [x] 6.4 Strict-mode behaviors tested both on and off
|
|
- [x] 6.5 OTel instruments emitted from production paths and asserted with a real in-memory `MeterProvider`
|
|
- [x] 6.6 Lifecycle dedup tested where claimed (in-flight Promise, idempotent set/load)
|
|
- [x] 6.7 No retroactive tick — every box above reflects work done in this change
|
|
- [x] 6.8 No `export *` in any feature-module barrel (§6a)
|
|
- [x] 6.9 No direct `vitest` / `bun:test` imports in test files (§7)
|
|
|
|
## 7. Archive
|
|
|
|
- [x] 7.1 Fold spec delta into `openspec/specs/api-plugin-audit/spec.md`
|
|
- [x] 7.2 Move `openspec/changes/add-api-plugin-audit/` → `openspec/archive/2026-05-18-add-api-plugin-audit/`
|
|
- [x] 7.3 Skip MANIFEST.md / STATUS.md refresh per task instructions
|