85 lines
2.5 KiB
Markdown
85 lines
2.5 KiB
Markdown
# OpenSpec Change: enterprise-api-plugin-audit
|
|
|
|
- **Change ID**: enterprise-api-plugin-audit
|
|
- **Package**: `@suaveplan/api-plugin-audit`
|
|
- **Category**: api/data
|
|
- **Target path**: `api/data/api-plugin-audit`
|
|
- **Status**: PROPOSED
|
|
- **Date**: 2026-04-24
|
|
- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/api-plugin-audit.md`
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
Deliver `@suaveplan/api-plugin-audit` on the genesis branch from scratch at enterprise quality. Audit logging plugin: wraps `@suaveplan/audit-logging` and persists audit entries to SurrealDB, exposes query APIs (`/audit`), enforces immutability (no update/delete on audit records), configurable retention policy, and an audit middleware factory for other plugins. Routes under `/audit`. Per-table SurrealQL. Events: `audit:entry:created`. Used by every write path across the API tier.
|
|
|
|
---
|
|
|
|
## Available workspace deps on genesis
|
|
|
|
| Package | Role |
|
|
|---|---|
|
|
| `@suaveplan/api` (`workspace:^`) | `definePlugin` |
|
|
| `@suaveplan/api-shared` (`workspace:^`) | Helpers |
|
|
| `@suaveplan/api-plugin-auth` (`workspace:^`) | `requireAuth`, `requireRole` |
|
|
| `@suaveplan/api-plugin-database` (`workspace:^`) | SurrealDB |
|
|
| `@suaveplan/audit-logging` (`workspace:^`) | Audit entry creation |
|
|
| `@suaveplan/events` (`workspace:^`) | Event bus |
|
|
| `@suaveplan/error` (`workspace:^`) | `AuditPluginError` hierarchy |
|
|
| `@suaveplan/rate-limiter` (`workspace:^`) | Rate limits |
|
|
| `hono` + `@hono/zod-openapi` + `zod` | Routes |
|
|
| `@opentelemetry/api` | OTel |
|
|
|
|
---
|
|
|
|
## Public API surface
|
|
|
|
```ts
|
|
function createAuditPlugin(config?: AuditPluginConfig): PluginDescriptor
|
|
|
|
// Registered service:
|
|
interface AuditPluginService {
|
|
log(entry: AuditLogInput): Promise<void>
|
|
query(params: AuditQuery): Promise<AuditEntry[]>
|
|
middleware(action: string): MiddlewareHandler
|
|
}
|
|
|
|
interface AuditEntry {
|
|
id: string; tenantId: string; userId?: string; action: string
|
|
resource: string; resourceId?: string; changes?: Record<string, unknown>
|
|
ipAddress?: string; userAgent?: string; timestamp: Date
|
|
}
|
|
```
|
|
|
|
### Error codes
|
|
|
|
```ts
|
|
type AuditPluginErrorCode =
|
|
| "AUDIT_ENTRY_NOT_FOUND"
|
|
| "AUDIT_WRITE_FAILED"
|
|
| "AUDIT_QUERY_INVALID"
|
|
```
|
|
|
|
---
|
|
|
|
## File layout
|
|
|
|
```text
|
|
api/data/api-plugin-audit/
|
|
package.json tsconfig.json vitest.config.ts
|
|
surql/ (audit_entry table — immutable, append-only)
|
|
src/
|
|
index.ts events.ts types/ errors/
|
|
services/audit/
|
|
middleware/audit/
|
|
routes/audit/
|
|
tests/integration.test.ts
|
|
```
|
|
|
|
---
|
|
|
|
## Impact
|
|
|
|
Prerequisites: `@suaveplan/api`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/audit-logging`.
|