63 lines
2.0 KiB
Python
63 lines
2.0 KiB
Python
"""AuditEvent — append-only security & business audit trail.
|
|
|
|
Audit events are never mutated or deleted. They record WHO did WHAT to
|
|
WHICH entity WHEN and from WHERE.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any, Optional, Dict
|
|
from pydantic import Field
|
|
|
|
from asf_domain.base import (
|
|
ASFBaseModel,
|
|
TenantScopedModel,
|
|
ASFFieldID,
|
|
UTCDatetime,
|
|
AuditAction,
|
|
generate_id,
|
|
)
|
|
|
|
|
|
class AuditEventBase(ASFBaseModel):
|
|
action: AuditAction = Field(..., description="What happened.")
|
|
resource_type: str = Field(
|
|
...,
|
|
max_length=80,
|
|
description="Affected entity kind (organization, project, artifact, job, api_key, …).",
|
|
)
|
|
resource_id: Optional[ASFFieldID] = Field(None, description="Affected entity id if applicable.")
|
|
actor_id: Optional[ASFFieldID] = Field(
|
|
None, description="User id that caused the event, or null for system actions."
|
|
)
|
|
actor_type: str = Field(
|
|
"user",
|
|
max_length=40,
|
|
description="user | system | api_key | service — kind of actor that caused the event.",
|
|
)
|
|
success: bool = True
|
|
reason: Optional[str] = Field(
|
|
None, max_length=500, description="For failed events, why the action was rejected."
|
|
)
|
|
|
|
|
|
class AuditEventCreate(AuditEventBase):
|
|
project_id: Optional[ASFFieldID] = None
|
|
ip_address: Optional[str] = Field(None, max_length=64)
|
|
user_agent: Optional[str] = Field(None, max_length=512)
|
|
correlation_id: Optional[str] = Field(None, max_length=128)
|
|
metadata: Dict[str, Any] = Field(
|
|
default_factory=dict,
|
|
description="Structured detail of the change. NEVER log secrets here.",
|
|
)
|
|
|
|
|
|
class AuditEvent(TenantScopedModel, AuditEventBase):
|
|
id: ASFFieldID = Field(default_factory=generate_id)
|
|
project_id: Optional[ASFFieldID] = None
|
|
ip_address: Optional[str] = None
|
|
user_agent: Optional[str] = None
|
|
correlation_id: Optional[str] = None
|
|
metadata: Dict[str, Any] = Field(default_factory=dict)
|
|
created_at: UTCDatetime = ...
|