standard_audit 0.5.0 → 0.7.0

data/lib/standard_audit.rb

@@ -1,10 +1,14 @@
 require "standard_audit/version"
 require "standard_audit/engine"
 require "standard_audit/configuration"
+require "standard_audit/metadata_filter"
+require "standard_audit/sensitive_keys_dry_run"
 require "standard_audit/subscriber"
 require "standard_audit/event_subscriber"
+require "standard_audit/reference_preloading"
 require "standard_audit/auditable"
 require "standard_audit/audit_scope"
+require "standard_audit/checks/retention"
 
 module StandardAudit
   # Metadata keys owned internally by StandardAudit. Never filtered by
@@ -12,8 +16,30 @@ module StandardAudit
   RESERVED_METADATA_KEYS = %w[_tags _source].freeze
 
   class << self
-    def configure
-      yield(config) if block_given?
+    # Applies configuration to the single mutable Configuration instance.
+    #
+    # `baseline: true` also *remembers* the block, so `reset_configuration!`
+    # replays it. That matters because the config object holds behaviour, not
+    # just data — `before_checksum_hooks` in particular. Without a baseline, a
+    # suite that installs the rspec plugin (which calls `reset_configuration!`
+    # before every example) silently loses write-time hooks after the first
+    # example, and the specs that would notice pass vacuously.
+    #
+    # Idiomatic host usage, in config/initializers/standard_audit.rb:
+    #
+    #   StandardAudit.configure(baseline: true) do |config|
+    #     config.subscribe_to "myapp.**"
+    #     config.before_checksum :backfill_scope
+    #   end
+    #
+    # Only the most recent `baseline: true` block is remembered; call it once,
+    # from the initializer.
+    def configure(baseline: false, &block)
+      return config unless block
+
+      @baseline_configuration = block if baseline
+      block.call(config)
+      config
     end
 
     def config
@@ -25,10 +51,9 @@ module StandardAudit
 
       actor ||= config.current_actor_resolver.call
 
-      # Filter sensitive keys. `_tags` and `_source` are reserved internal
-      # metadata keys owned by EventSubscriber and are never stripped.
-      sensitive = config.sensitive_keys.map(&:to_s) - RESERVED_METADATA_KEYS
-      filtered_metadata = metadata.reject { |k, _| sensitive.include?(k.to_s) }
+      # Redaction lives in MetadataFilter, shared with Subscriber, so the two
+      # write paths cannot drift apart.
+      filtered_metadata = MetadataFilter.call(metadata, config: config)
 
       attrs = {
         event_type: event_type,
@@ -100,8 +125,24 @@ module StandardAudit
       @event_subscriber ||= EventSubscriber.new
     end
 
-    def reset_configuration!
+    # Drops the memoized Configuration. Any block registered with
+    # `configure(baseline: true)` is replayed onto the fresh instance, so a
+    # per-example reset restores the app's real configuration rather than the
+    # gem defaults.
+    def reset_configuration!(replay_baseline: true)
       @configuration = nil
+      @baseline_configuration&.call(config) if replay_baseline
+      config
+    end
+
+    # Forgets the `configure(baseline: true)` block. Mainly for the gem's own
+    # specs and for a host that needs a genuinely pristine configuration.
+    def clear_baseline_configuration!
+      @baseline_configuration = nil
+    end
+
+    def baseline_configured?
+      !@baseline_configuration.nil?
     end
 
     private

data/lib/tasks/standard_audit_tasks.rake

@@ -79,6 +79,47 @@ namespace :standard_audit do
     puts "Backfilled checksums for #{count} audit log records"
   end
 
+  namespace :sensitive_keys do
+    desc "Report which historical metadata keys a redaction rule would strip (read-only)"
+    task :dry_run, [:pattern] => :environment do |_t, args|
+      # Audit rows are append-only, so a redaction rule that swallows real
+      # content cannot be undone. This reads the rows you already have and
+      # reports, per key, what the rule would have stripped.
+      #
+      #   rake standard_audit:sensitive_keys:dry_run
+      #   rake "standard_audit:sensitive_keys:dry_run[secret]"
+      #   NESTED=1 rake "standard_audit:sensitive_keys:dry_run[secret|token]"
+      #
+      # The argument is a Regexp source, matched case-insensitively, and is
+      # applied *in addition to* the app's configured sensitive_keys.
+      # NESTED=1/0 overrides config.filter_nested_metadata for the run.
+      pattern = args[:pattern].presence || ENV["PATTERN"].presence
+      patterns = StandardAudit.config.sensitive_key_patterns.dup
+      patterns << Regexp.new(pattern, Regexp::IGNORECASE) if pattern
+
+      nested =
+        case ENV["NESTED"]
+        when nil, "" then nil
+        when "0", "false" then false
+        else true
+        end
+
+      report = StandardAudit::SensitiveKeysDryRun.call(
+        sensitive_key_patterns: patterns,
+        nested: nested,
+        batch_size: (ENV["BATCH_SIZE"] || 1000).to_i
+      )
+
+      puts "StandardAudit sensitive-key dry run"
+      puts "==================================="
+      puts "Candidate pattern: #{pattern ? Regexp.new(pattern, Regexp::IGNORECASE).inspect : '(none — reporting current config)'}"
+      puts ""
+      puts report
+      puts ""
+      puts "Nothing was written. Rows are append-only; a rule you enable applies only to future writes."
+    end
+  end
+
   desc "Export audit logs for a specific actor (GDPR right to access)"
   task :export_actor, [:actor_gid, :output] => :environment do |_t, args|
     raise "actor_gid is required" unless args[:actor_gid].present?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_audit
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Jaryl Sim
@@ -89,7 +89,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
-- MIT-LICENSE
+- LICENSE
 - README.md
 - Rakefile
 - app/jobs/standard_audit/cleanup_job.rb
@@ -105,10 +105,14 @@ files:
 - lib/standard_audit.rb
 - lib/standard_audit/audit_scope.rb
 - lib/standard_audit/auditable.rb
+- lib/standard_audit/checks/retention.rb
 - lib/standard_audit/configuration.rb
 - lib/standard_audit/engine.rb
 - lib/standard_audit/event_subscriber.rb
+- lib/standard_audit/metadata_filter.rb
+- lib/standard_audit/reference_preloading.rb
 - lib/standard_audit/rspec.rb
+- lib/standard_audit/sensitive_keys_dry_run.rb
 - lib/standard_audit/subscriber.rb
 - lib/standard_audit/version.rb
 - lib/tasks/standard_audit_tasks.rake