auditea 0.1.0.beta.3 → 0.1.0.beta.5

data/lib/auditea/inventory/collector.rb

@@ -3,11 +3,14 @@
 require "digest"
 require "json"
 require_relative "string_bound"
+require_relative "components"
+require_relative "database_server"
 
 module Auditea
   module Inventory
     # Collects a normalized runtime + dependency inventory for AudiTea.
     # Never includes filesystem paths, remote URLs, tokens, or env vars.
+    # rubocop:disable-next Metrics/ModuleLength -- cohesive collector + component promotion
     module Collector
       SCHEMA_VERSION = 1
       MAX_PACKAGES = 400
@@ -15,6 +18,16 @@ module Auditea
       MAX_REQUIREMENT_BYTES = 256
       # Leave headroom under Transport::Limits::SINGLE_MAX_BYTES after envelope/provenance.
       MAX_INVENTORY_BYTES = 110_000
+      PROMOTED_SERVER_GEMS = {
+        "puma" => { "product" => "Puma", "scope" => "application_server" },
+        "unicorn" => { "product" => "Unicorn", "scope" => "application_server" },
+        "passenger" => { "product" => "Phusion Passenger", "scope" => "application_server" }
+      }.freeze
+      PROMOTED_ADAPTER_GEMS = {
+        "pg" => { "product" => "pg (PostgreSQL adapter)", "scope" => "linked_library" },
+        "trilogy" => { "product" => "Trilogy", "scope" => "linked_library" },
+        "mysql2" => { "product" => "mysql2", "scope" => "linked_library" }
+      }.freeze
 
       module_function
 
@@ -41,11 +54,124 @@ module Auditea
         release = Auditea.configuration.release
         inventory["application"] = { "release" => bound_string(release) } if present?(release)
 
+        components = Components.compact_list(
+          runtime_components(inventory) +
+          promoted_gem_components(packages) +
+          [DatabaseServer.collect]
+        )
+        inventory["components"] = components unless components.empty?
+
         inventory = enforce_size_bound(inventory)
         inventory["digest"] = DigestComputer.compute(inventory)
         inventory
       end
 
+      def runtime_components(inventory)
+        list = []
+        runtime = inventory["runtime"] || {}
+        list << Components.build(
+          product: "Ruby",
+          version: runtime["version"],
+          scope: "application_runtime",
+          observation_method: "ruby_constants"
+        )
+
+        framework = inventory["framework"]
+        if framework
+          list << Components.build(
+            product: "Rails",
+            version: framework["version"],
+            scope: "application_runtime",
+            observation_method: "rails_version"
+          )
+        end
+
+        pm = inventory["package_manager"] || {}
+        if present?(pm["rubygems_version"])
+          list << Components.build(
+            product: "RubyGems",
+            version: pm["rubygems_version"],
+            scope: "application_runtime",
+            observation_method: "rubygems_version"
+          )
+        end
+        if present?(pm["bundler_version"])
+          list << Components.build(
+            product: "Bundler",
+            version: pm["bundler_version"],
+            scope: "application_runtime",
+            observation_method: "bundler_version"
+          )
+        end
+
+        openssl = inventory["openssl"] || {}
+        openssl_version = first_present(
+          openssl["library_version"],
+          openssl["build_version"],
+          openssl["extension_version"]
+        )
+        if present?(openssl_version)
+          list << Components.build(
+            product: "OpenSSL",
+            version: openssl_version,
+            scope: "linked_library",
+            observation_method: "ruby_openssl_constants",
+            evidence: {
+              "extension_version" => openssl["extension_version"],
+              "build_version" => openssl["build_version"],
+              "library_version" => openssl["library_version"]
+            }.compact
+          )
+        end
+
+        list
+      end
+
+      def promoted_gem_components(packages)
+        by_name = Array(packages).to_h { |pkg| [pkg["name"].to_s, pkg] }
+        list = []
+
+        PROMOTED_SERVER_GEMS.each do |gem_name, meta|
+          pkg = by_name[gem_name]
+          next unless pkg
+
+          list << Components.build(
+            product: meta["product"],
+            version: pkg["version"],
+            scope: meta["scope"],
+            observation_method: "bundler_package",
+            package: {
+              "ecosystem" => pkg["ecosystem"],
+              "name" => pkg["name"],
+              "version" => pkg["version"]
+            }
+          )
+        end
+
+        PROMOTED_ADAPTER_GEMS.each do |gem_name, meta|
+          pkg = by_name[gem_name]
+          next unless pkg
+
+          list << Components.build(
+            product: meta["product"],
+            version: pkg["version"],
+            scope: meta["scope"],
+            observation_method: "bundler_package",
+            package: {
+              "ecosystem" => pkg["ecosystem"],
+              "name" => pkg["name"],
+              "version" => pkg["version"]
+            }
+          )
+        end
+
+        list
+      end
+
+      def first_present(*values)
+        values.find { |value| present?(value) }
+      end
+
       def runtime_metadata
         {
           "language" => "ruby",

data/lib/auditea/inventory/components.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Inventory
+    # Normalized platform/software component observations (inventory only — not vulnerability).
+    module Components
+      SCOPES = %w[
+        application_runtime
+        application_server
+        database_server
+        linked_library
+        host_os
+        host_component
+        reverse_proxy
+        externally_observed
+      ].freeze
+
+      MAX_COMPONENTS = 40
+      MAX_PRODUCT = 128
+      MAX_VERSION = 128
+      MAX_METHOD = 64
+      MAX_EVIDENCE_VALUE = 64
+      # Strict allowlist — never transmit raw command output, paths, or host details.
+      EVIDENCE_KEYS = %w[command adapter].freeze
+
+      module_function
+
+      def build(product:, version:, scope:, observation_method:, package: nil, evidence: nil)
+        return nil unless SCOPES.include?(scope.to_s)
+        return nil if blank?(product) || blank?(version)
+
+        entry = {
+          "product" => truncate(product, MAX_PRODUCT),
+          "version" => truncate(version, MAX_VERSION),
+          "scope" => scope.to_s,
+          "observation_method" => truncate(observation_method, MAX_METHOD)
+        }
+        entry["package"] = package if package.is_a?(Hash) && !package.empty?
+        sanitized = sanitize_evidence(evidence)
+        entry["evidence"] = sanitized if sanitized
+        entry
+      end
+
+      def sanitize_evidence(value)
+        return nil unless value.is_a?(Hash)
+
+        out = {}
+        value.each do |key, child|
+          key_s = key.to_s
+          next unless EVIDENCE_KEYS.include?(key_s)
+          next if child.nil?
+
+          case child
+          when String
+            next if child.empty?
+
+            out[key_s] = truncate(child, MAX_EVIDENCE_VALUE)
+          when Numeric, TrueClass, FalseClass
+            out[key_s] = child
+          else
+            next
+          end
+        end
+        out.empty? ? nil : out
+      end
+
+      def compact_list(list)
+        Array(list).compact.first(MAX_COMPONENTS)
+      end
+
+      def truncate(value, max)
+        StringBound.truncate(value.to_s, max)
+      end
+
+      def blank?(value)
+        value.nil? || value.to_s.strip.empty?
+      end
+    end
+  end
+end

data/lib/auditea/inventory/database_server.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Inventory
+    # Fail-open database server version collectors.
+    # Never transmits credentials, connection strings, or DB hostnames.
+    module DatabaseServer
+      module_function
+
+      def collect
+        return nil unless defined?(::ActiveRecord::Base)
+        return nil unless ::ActiveRecord::Base.respond_to?(:connection_pool)
+
+        pool = ::ActiveRecord::Base.connection_pool
+        return nil unless pool.respond_to?(:with_connection)
+
+        pool.with_connection do |connection|
+          return nil unless connection
+
+          adapter = connection.adapter_name.to_s.downcase
+          collector = collector_for(adapter)
+          return nil unless collector
+
+          collector.call(connection)
+        end
+      rescue StandardError
+        nil
+      end
+
+      def collector_for(adapter)
+        case adapter
+        when /postgre/
+          method(:postgresql)
+        end
+      end
+
+      def postgresql(connection)
+        version = nil
+        version = connection.select_value("SHOW server_version") if connection.respond_to?(:select_value)
+        version = version.to_s.strip
+        return nil if version.empty?
+
+        Components.build(
+          product: "PostgreSQL",
+          version: version,
+          scope: "database_server",
+          observation_method: "active_record.show_server_version",
+          evidence: {
+            "adapter" => "postgresql"
+          }
+        )
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/auditea/railtie.rb

@@ -24,12 +24,40 @@ module Auditea
     config.after_initialize do
       at_exit { Auditea.shutdown }
       begin
-        # Startup capture is explicit (force) so long-lived refresh can stay gated.
-        Auditea.capture_runtime_inventory! if Auditea.configuration.capture_runtime_inventory?
-        Auditea.capture_host_inventory! if Auditea.configuration.capture_host_inventory?
+        # Schedule via existing single-flight background refresh — never block boot on
+        # detector processes or database inventory work.
+        Auditea::Inventory.schedule_refresh! if Auditea.configuration.capture_runtime_inventory?
+        Auditea::HostInventory.schedule_refresh! if Auditea.configuration.capture_host_inventory?
       rescue StandardError => error
         Auditea.handle_error(error)
       end
+
+      begin
+        # One automatic boot/startup diagnostic observation when configured.
+        # Never crash boot: fully fail-open (swallow, log, continue) regardless of
+        # raise_errors.
+        Auditea::Railtie.emit_boot_diagnostic!
+      rescue StandardError => error
+        Rails.logger&.warn("[auditea] boot diagnostic skipped: #{error.class}: #{error.message.to_s.byteslice(0, 200)}")
+      end
+    end
+
+    # Emits a single automatic boot/startup diagnostic observation when the SDK is
+    # configured and the flag is enabled.
+    #
+    # Emitted only in asynchronous mode. In synchronous mode the automatic
+    # observation is skipped entirely: enqueue would perform inline HTTP (including
+    # retries/timeouts), adding an external-network dependency to Rails startup.
+    # This does NOT weaken explicit user-requested synchronous delivery
+    # (Auditea.emit_diagnostic! / capture with async:false still deliver inline);
+    # it only gates the automatic boot path. The local snapshot
+    # (Auditea.diagnostic) remains available regardless.
+    def self.emit_boot_diagnostic!
+      cfg = Auditea.configuration
+      return unless cfg.configured? && cfg.emit_boot_diagnostic
+      return unless cfg.async?
+
+      Auditea.emit_diagnostic!(flush: false)
     end
   end
 end

data/lib/auditea/sanitizer.rb

@@ -16,8 +16,37 @@ module Auditea
       otp otp_secret session_id credit_card card_number cvv ssn
     ].freeze
 
+    # URI credential forms are stripped from diagnostic value strings (endpoint,
+    # transport errors, warnings). This is a bounded field-specific redaction for
+    # the diagnostic contract, NOT a general secret scanner.
+    URI_USERINFO_RE = %r{(https?://)[^/\s@]+@}i
+    SENSITIVE_QUERY_RE = /
+      ([?&]
+        (?:token|password|passwd|secret|api_?key|access_token|refresh_token|
+           auth|authorization|key|signature|sig|credential)
+        =
+      )
+      [^&\s]*
+    /ix
+
     module_function
 
+    # Scrub URI userinfo (`scheme://user:pass@host`) and sensitive query values
+    # from a free-form diagnostic string, then bound its length.
+    def sanitize_diagnostic_string(value, max_bytes:)
+      return nil if value.nil?
+
+      scrub_uri_credentials(value.to_s).byteslice(0, max_bytes)
+    end
+
+    # Remove `user:password@` from any embedded http(s) URL and redact the value
+    # of sensitive query parameters. Field-specific: only URI credential shapes.
+    def scrub_uri_credentials(text)
+      text.to_s
+          .gsub(URI_USERINFO_RE) { Regexp.last_match(1) }
+          .gsub(SENSITIVE_QUERY_RE) { "#{Regexp.last_match(1)}[REDACTED]" }
+    end
+
     def sanitize_event(event)
       redacted = []
       sanitized = deep_sanitize(event, depth: 0, path: nil, redacted: redacted)
@@ -50,8 +79,18 @@ module Auditea
       path.to_s == "evidence.inventory.packages"
     end
 
+    def inventory_components_path?(path)
+      path.to_s == "evidence.inventory.components"
+    end
+
     def array_limit_for(path)
-      inventory_packages_path?(path) ? INVENTORY_PACKAGES_ARRAY_MAX : DEFAULT_ARRAY_MAX
+      if inventory_packages_path?(path)
+        INVENTORY_PACKAGES_ARRAY_MAX
+      elsif inventory_components_path?(path)
+        40
+      else
+        DEFAULT_ARRAY_MAX
+      end
     end
 
     def deep_sanitize(value, depth:, path:, redacted:)

data/lib/auditea/transport/queue.rb

@@ -18,7 +18,10 @@ module Auditea
         @buffer = []
         @stopped = false
         @dropped = 0
+        @delivered = 0
         @inflight = 0
+        @last_outcome = nil
+        @last_error = nil
         @thread = nil
         @owner_pid = nil
       end
@@ -95,7 +98,22 @@ module Auditea
 
       def stats
         ensure_process!
-        @mutex.synchronize { { size: @buffer.size, dropped: @dropped, inflight: @inflight, pid: @owner_pid } }
+        @mutex.synchronize do
+          {
+            size: @buffer.size,
+            dropped: @dropped,
+            delivered: @delivered,
+            inflight: @inflight,
+            pid: @owner_pid
+          }
+        end
+      end
+
+      # Recent transport health for diagnostics: what happened to the last delivery
+      # attempt (accepted / unauthorized / exhausted / error / …) and, on failure, why.
+      def health
+        ensure_process!
+        @mutex.synchronize { { last_outcome: @last_outcome, last_error: @last_error } }
       end
 
       private
@@ -106,10 +124,15 @@ module Auditea
           if @owner_pid.nil?
             @owner_pid = pid
           elsif @owner_pid != pid
-            # Child after fork: drop inherited buffer/worker; do not deliver parent data.
+            # Child after fork: drop inherited buffer/worker; do not deliver parent
+            # data. Also reset the diagnostic transport counters/state so the child
+            # describes its own process, not the one it forked from.
             @buffer = []
             @inflight = 0
             @dropped = 0
+            @delivered = 0
+            @last_outcome = nil
+            @last_error = nil
             @stopped = false
             @thread = nil
             @owner_pid = pid
@@ -183,9 +206,11 @@ module Auditea
             else
               @http.post_batch(events)
             end
+          record_delivery(result)
           handle_result(events, result)
           result
         rescue StandardError => error
+          record_delivery_error(error)
           @configuration.logger&.warn("[auditea] delivery failed: #{error.class}: #{error.message.to_s.byteslice(0,
                                                                                                                  200)}")
           raise if @configuration.raise_errors
@@ -220,6 +245,57 @@ module Auditea
         nil
       end
 
+      def record_delivery(result)
+        delivered, outcome, error = aggregate_delivery(result)
+        @mutex.synchronize do
+          @last_outcome = outcome
+          @last_error = error
+          @delivered += delivered
+        end
+      end
+
+      def record_delivery_error(error)
+        @mutex.synchronize do
+          @last_outcome = "error"
+          @last_error = Sanitizer.sanitize_diagnostic_string("#{error.class}: #{error.message}", max_bytes: 200)
+        end
+      end
+
+      # Truthful aggregate outcome for a single-event or batch DeliveryResult.
+      # `delivered` counts only events the server accepted/treated as success.
+      def aggregate_delivery(result)
+        return [0, "accepted", nil] unless result.is_a?(DeliveryResult)
+
+        if result.results
+          rows = result.results
+          delivered = rows.count { |row| row["ok"] }
+          [delivered, aggregate_batch_outcome(rows), aggregate_batch_error(rows)]
+        else
+          delivered = result.ok? ? 1 : 0
+          error = result.ok? ? nil : Sanitizer.sanitize_diagnostic_string(result.message, max_bytes: 200)
+          [delivered, result.outcome.to_s, error]
+        end
+      end
+
+      def aggregate_batch_outcome(rows)
+        return "error" if rows.empty?
+
+        ok = rows.count { |row| row["ok"] }
+        return "accepted" if ok == rows.size
+
+        bad_outcomes = rows.reject { |row| row["ok"] }.map { |row| row["outcome"] }.compact.uniq
+        return "partial_failure" if ok.positive?
+
+        # Total failure: surface the single uniform outcome, else a generic error.
+        bad_outcomes.size == 1 ? bad_outcomes.first : "error"
+      end
+
+      def aggregate_batch_error(rows)
+        return nil if rows.all? { |row| row["ok"] }
+
+        Sanitizer.sanitize_diagnostic_string("mixed_batch_results", max_bytes: 200)
+      end
+
       def log_drop(event_id, reason)
         @configuration.logger&.warn("[auditea] event_id=#{event_id} reason=#{reason}")
       end

data/lib/auditea/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Auditea
-  VERSION = "0.1.0.beta.3"
+  VERSION = "0.1.0.beta.5"
 end

data/lib/auditea.rb

@@ -22,6 +22,7 @@ require_relative "auditea/event_builder"
 require_relative "auditea/actor"
 require_relative "auditea/target"
 require_relative "auditea/current_context"
+require_relative "auditea/diagnostic"
 require_relative "auditea/transport/limits"
 require_relative "auditea/transport/delivery_result"
 require_relative "auditea/transport/http"
@@ -142,6 +143,21 @@ module Auditea
       HostInventory.maybe_capture!
     end
 
+    # Machine-readable readiness snapshot (config + transport health + warnings).
+    # Never includes the source token value.
+    def diagnostic
+      Diagnostic.call
+    end
+
+    # Emit the readiness snapshot as a `diagnostic.sdk_ready` event, then flush.
+    # Returns the capture result (fail-open: { ok: false, skipped: true, reason: … }
+    # when disabled or not configured).
+    def emit_diagnostic!(flush: true)
+      result = capture("diagnostic.sdk_ready", category: "diagnostic", severity: "info", metadata: Diagnostic.call)
+      flush(timeout: 10) if flush
+      result
+    end
+
     def flush(timeout: 5)
       client.flush(timeout: timeout)
     rescue StandardError => error

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auditea
 version: !ruby/object:Gem::Version
-  version: 0.1.0.beta.3
+  version: 0.1.0.beta.5
 platform: ruby
 authors:
 - AudiTea
@@ -24,16 +24,21 @@ files:
 - RELEASE.md
 - auditea.gemspec
 - examples/manual_capture.rb
+- examples/support/windows_smoke_gate.rb
+- examples/windows_inventory_smoke.rb
 - lib/auditea.rb
 - lib/auditea/actor.rb
 - lib/auditea/client.rb
 - lib/auditea/configuration.rb
 - lib/auditea/current_context.rb
+- lib/auditea/diagnostic.rb
 - lib/auditea/event_builder.rb
 - lib/auditea/host_inventory.rb
 - lib/auditea/host_inventory/background_refresh.rb
 - lib/auditea/host_inventory/collector.rb
+- lib/auditea/host_inventory/component_detectors.rb
 - lib/auditea/host_inventory/emitter.rb
+- lib/auditea/host_inventory/windows_components.rb
 - lib/auditea/instrumentation/active_job.rb
 - lib/auditea/instrumentation/error_subscriber.rb
 - lib/auditea/instrumentation/exception.rb
@@ -43,6 +48,8 @@ files:
 - lib/auditea/inventory.rb
 - lib/auditea/inventory/background_refresh.rb
 - lib/auditea/inventory/collector.rb
+- lib/auditea/inventory/components.rb
+- lib/auditea/inventory/database_server.rb
 - lib/auditea/inventory/digest.rb
 - lib/auditea/inventory/emitter.rb
 - lib/auditea/inventory/string_bound.rb