OpenSpec Change: enterprise-api-plugin-audit

Change ID: enterprise-api-plugin-audit
Package: @suaveplan/api-plugin-audit
Category: api/data
Target path: api/data/api-plugin-audit
Status: PROPOSED
Date: 2026-04-24
Reference spec: /mnt/s/web/suaveplan/enterprise/api-plugin-audit.md

Summary

Deliver @suaveplan/api-plugin-audit on the genesis branch from scratch at enterprise quality. Audit logging plugin: wraps @suaveplan/audit-logging and persists audit entries to SurrealDB, exposes query APIs (/audit), enforces immutability (no update/delete on audit records), configurable retention policy, and an audit middleware factory for other plugins. Routes under /audit. Per-table SurrealQL. Events: audit:entry:created. Used by every write path across the API tier.

Available workspace deps on genesis

Package	Role
`@suaveplan/api` (`workspace:^`)	`definePlugin`
`@suaveplan/api-shared` (`workspace:^`)	Helpers
`@suaveplan/api-plugin-auth` (`workspace:^`)	`requireAuth`, `requireRole`
`@suaveplan/api-plugin-database` (`workspace:^`)	SurrealDB
`@suaveplan/audit-logging` (`workspace:^`)	Audit entry creation
`@suaveplan/events` (`workspace:^`)	Event bus
`@suaveplan/error` (`workspace:^`)	`AuditPluginError` hierarchy
`@suaveplan/rate-limiter` (`workspace:^`)	Rate limits
`hono` + `@hono/zod-openapi` + `zod`	Routes
`@opentelemetry/api`	OTel

Public API surface

function createAuditPlugin(config?: AuditPluginConfig): PluginDescriptor

// Registered service:
interface AuditPluginService {
  log(entry: AuditLogInput): Promise<void>
  query(params: AuditQuery): Promise<AuditEntry[]>
  middleware(action: string): MiddlewareHandler
}

interface AuditEntry {
  id: string; tenantId: string; userId?: string; action: string
  resource: string; resourceId?: string; changes?: Record<string, unknown>
  ipAddress?: string; userAgent?: string; timestamp: Date
}

Error codes

type AuditPluginErrorCode =
  | "AUDIT_ENTRY_NOT_FOUND"
  | "AUDIT_WRITE_FAILED"
  | "AUDIT_QUERY_INVALID"

File layout

api/data/api-plugin-audit/
  package.json  tsconfig.json  vitest.config.ts
  surql/ (audit_entry table — immutable, append-only)
  src/
    index.ts  events.ts  types/  errors/
    services/audit/
    middleware/audit/
    routes/audit/
  tests/integration.test.ts

Impact

Prerequisites: @suaveplan/api, @suaveplan/api-plugin-auth, @suaveplan/api-plugin-database, @suaveplan/audit-logging.

2.5 KiB Raw Blame History