@h-ai/audit 0.1.0-alpha.72 → 0.1.0-alpha.74
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.en.md +71 -13
- package/README.ja.md +71 -13
- package/README.md +72 -14
- package/dist/index.d.ts +257 -8
- package/dist/index.js +1085 -149
- package/dist/index.js.map +1 -1
- package/package.json +23 -3
package/dist/index.js
CHANGED
|
@@ -1,9 +1,95 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { core, ok, err } from '@h-ai/core';
|
|
3
|
-
import { validateIdentifiers,
|
|
3
|
+
import { migrateSchema, reldb, validateIdentifiers, schemaColumns, BaseReldbCrudRepository } from '@h-ai/reldb';
|
|
4
|
+
import { createHash } from 'crypto';
|
|
5
|
+
import { AsyncLocalStorage } from 'async_hooks';
|
|
6
|
+
import { Buffer } from 'buffer';
|
|
4
7
|
|
|
5
8
|
// src/audit-config.ts
|
|
6
9
|
var AuditInitConfigSchema = z.object({
|
|
10
|
+
/** 以固定时间窗口统计已提交事件；目标和事件由应用配置，不内置业务角色。 */
|
|
11
|
+
alerts: z.object({
|
|
12
|
+
/** 是否检查异常事件并发送告警；开启前配置至少一条规则和真实 Reach 通道，关闭不影响审计入库。 */
|
|
13
|
+
enabled: z.boolean().default(false),
|
|
14
|
+
/** 每次检查最多尝试的通知数；超过的目标留待后续检查，避免突发告警挤占业务资源。 */
|
|
15
|
+
maxNotificationsPerCheck: z.number().int().min(1).max(1e3).default(100),
|
|
16
|
+
/** 告警规则列表；每条按全站匹配事件的固定窗口累计计数，不是每个账号各自计数。 */
|
|
17
|
+
rules: z.array(z.object({
|
|
18
|
+
/** 稳定且唯一的规则编号，用于共享去重；更改编号会视为新规则。 */
|
|
19
|
+
id: z.string().regex(/^[\w-]{1,64}$/),
|
|
20
|
+
/** 匹配的审计 action 全名，例如 auth.login；从实际记录复制，不支持 auth.* 通配。 */
|
|
21
|
+
actions: z.array(z.string().trim().min(1).max(128)).min(1).max(50),
|
|
22
|
+
/** 只统计此资源类型的事件；省略时不按资源过滤，不填写业务敏感正文。 */
|
|
23
|
+
resource: z.string().trim().min(1).max(256).optional(),
|
|
24
|
+
/** 要统计的执行结果；默认失败和拒绝，空数组表示所有结果均参与计数。 */
|
|
25
|
+
outcomes: z.array(z.enum(["success", "failure", "denied"])).max(3).default(["failure", "denied"]),
|
|
26
|
+
/** 参与计数的事件最低等级；低于此级别的记录仍保留，但不触发这条告警。 */
|
|
27
|
+
minimumSeverity: z.enum(["info", "warning", "error", "critical"]).default("info"),
|
|
28
|
+
/** 发出通知时的告警等级；不修改原始审计事件的等级。 */
|
|
29
|
+
severity: z.enum(["warning", "error", "critical"]).default("warning"),
|
|
30
|
+
/** 同一窗口内累计达到此次数才通知；与 IAM 登录失败锁定阈值分别配置。 */
|
|
31
|
+
threshold: z.number().int().min(1).max(1e9).default(1),
|
|
32
|
+
/** 固定计数窗口长度，单位秒；例如 300 表示按五分钟窗口统计，不追补长期停机历史。 */
|
|
33
|
+
windowSeconds: z.number().int().min(60).max(86400).default(300),
|
|
34
|
+
/** 通知接收目标；每个目标独立记录投递结果，渠道受理不等于人员已读。 */
|
|
35
|
+
targets: z.array(z.object({
|
|
36
|
+
/** 本规则内稳定且唯一的目标编号，用于防止多节点重复投递。 */
|
|
37
|
+
id: z.string().regex(/^[\w-]{1,64}$/),
|
|
38
|
+
/** 已注册的 Reach Provider 名称，例如 email；不是 smtp/api 等 Provider 类型。 */
|
|
39
|
+
provider: z.string().trim().min(1).max(128),
|
|
40
|
+
/** 该通道接受的收件地址，例如邮箱或手机号；填写真实值，开发 Console 不会投递。 */
|
|
41
|
+
to: z.string().trim().min(1).max(1e3)
|
|
42
|
+
})).min(1).max(20).refine((targets) => new Set(targets.map((target) => target.id)).size === targets.length)
|
|
43
|
+
})).max(20).default([]).refine((rules) => new Set(rules.map((rule) => rule.id)).size === rules.length),
|
|
44
|
+
/** 自动告警检查计划；宿主需接入 audit.schedulerPlan，只开启告警功能不会自动轮询。 */
|
|
45
|
+
schedule: z.object({
|
|
46
|
+
/** 是否让 Scheduler 自动检查；需同时开启 alerts.enabled，否则仅保留计划配置。 */
|
|
47
|
+
enabled: z.boolean().default(false),
|
|
48
|
+
/** 检查频率的 Cron 表达式；默认每分钟检查，窗口阈值仍由规则决定。 */
|
|
49
|
+
cron: z.string().trim().min(1).max(128).default("* * * * *"),
|
|
50
|
+
/** Cron 使用的 IANA 时区，例如 Asia/Shanghai；UTC 不等于北京时间。 */
|
|
51
|
+
timezone: z.string().trim().min(1).max(128).default("UTC")
|
|
52
|
+
}).default({ enabled: false, cron: "* * * * *", timezone: "UTC" })
|
|
53
|
+
}).default({ enabled: false, maxNotificationsPerCheck: 100, rules: [], schedule: { enabled: false, cron: "* * * * *", timezone: "UTC" } }).refine((alerts) => !alerts.enabled || alerts.rules.length > 0),
|
|
54
|
+
/** 可选的流式归档；自动执行由宿主现有 Scheduler 装配。 */
|
|
55
|
+
backup: z.object({
|
|
56
|
+
/** 是否允许手动/计划归档审计；需已初始化的私有 Storage，关闭不影响审计采集。 */
|
|
57
|
+
enabled: z.boolean().default(false),
|
|
58
|
+
/** 每批读取的记录数；较小更省内存但请求更多，不改变归档内容。 */
|
|
59
|
+
batchSize: z.number().int().min(1).max(1e3).default(200),
|
|
60
|
+
/** 单条归档记录的 UTF-8 字节上限；默认 1 MiB，超限报错而不截断原审计。 */
|
|
61
|
+
maxRecordBytes: z.number().int().min(1024).max(64 * 1024 * 1024).default(1024 * 1024),
|
|
62
|
+
/** 自动备份计划；与手动备份开关独立，备份不会删除源日志，也不是原子数据库快照。 */
|
|
63
|
+
schedule: z.object({
|
|
64
|
+
/** 是否由 Scheduler 自动备份；还需 backup.enabled=true，关闭后仍可手动备份。 */
|
|
65
|
+
enabled: z.boolean().default(false),
|
|
66
|
+
/** 备份 Cron 表达式；0 2 * * * 表示在下方时区每天 02:00 执行。 */
|
|
67
|
+
cron: z.string().trim().min(1).max(128).default("0 2 * * *"),
|
|
68
|
+
/** 定时备份采用的 IANA 时区；Asia/Shanghai 为北京时间，UTC 的 02:00 对应北京时间 10:00。 */
|
|
69
|
+
timezone: z.string().trim().min(1).max(128).default("UTC")
|
|
70
|
+
}).default({ enabled: false, cron: "0 2 * * *", timezone: "UTC" })
|
|
71
|
+
}).default({ enabled: false, batchSize: 200, maxRecordBytes: 1024 * 1024, schedule: { enabled: false, cron: "0 2 * * *", timezone: "UTC" } }),
|
|
72
|
+
/** 框架入口自动采集；显式 audit.log 不受此开关影响。 */
|
|
73
|
+
capture: z.object({
|
|
74
|
+
/** 是否自动记录已接入框架入口的重要操作、失败和拒绝；关闭不阻止显式 audit.log 写入。 */
|
|
75
|
+
enabled: z.boolean().default(true),
|
|
76
|
+
/** 是否也采集成功读取事件；开启可追溯查询行为，但会显著增加日志量与存储开销。 */
|
|
77
|
+
includeReads: z.boolean().default(false)
|
|
78
|
+
}).default({ enabled: true, includeReads: false }),
|
|
79
|
+
/** 未传时沿用数据库保留设置；显式关闭才解除保护。 */
|
|
80
|
+
retention: z.object({
|
|
81
|
+
/** 是否启用共享数据库的审计修改/删除/覆盖保护；配置会持久化，移除配置不会解除已有保护。 */
|
|
82
|
+
enabled: z.boolean().default(false),
|
|
83
|
+
/** 保护期天数；例如 90 天内 cleanup(0) 也不能删除，到期不会自动清理日志。 */
|
|
84
|
+
minDays: z.number().int().min(1).max(36500).default(90)
|
|
85
|
+
}).optional(),
|
|
86
|
+
/** 凭据始终脱敏；此开关仅控制业务隐私字段。 */
|
|
87
|
+
privacy: z.object({
|
|
88
|
+
/** 是否对业务隐私字段脱敏；关闭也不会暴露密码、token 等凭据，脱敏前的内容不会恢复。 */
|
|
89
|
+
enabled: z.boolean().default(true),
|
|
90
|
+
/** 额外脱敏的详情字段名，不区分大小写；例如 customerPhone，不要将秘密放进 action/resourceId。 */
|
|
91
|
+
fields: z.array(z.string().trim().min(1).max(256)).max(1e3).default([])
|
|
92
|
+
}).default({ enabled: true, fields: [] }),
|
|
7
93
|
/** 用户表名，用于 list 查询时 LEFT JOIN 获取用户名 */
|
|
8
94
|
userTable: z.string().default("hai_iam_users"),
|
|
9
95
|
/** 用户表主键列名，用于 JOIN 条件 */
|
|
@@ -11,57 +97,25 @@ var AuditInitConfigSchema = z.object({
|
|
|
11
97
|
/** 用户表用户名列名，用于 SELECT 输出 */
|
|
12
98
|
userNameColumn: z.string().default("username")
|
|
13
99
|
});
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
}
|
|
18
|
-
return ok(void 0);
|
|
100
|
+
var storage = new AsyncLocalStorage();
|
|
101
|
+
function getAuditContext() {
|
|
102
|
+
return storage.getStore() ?? {};
|
|
19
103
|
}
|
|
20
|
-
function
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
},
|
|
26
|
-
async logout(userId, ip, ua) {
|
|
27
|
-
const result = await logFn({ userId, action: "logout", resource: "auth", ipAddress: ip, userAgent: ua });
|
|
28
|
-
return toVoid(result);
|
|
29
|
-
},
|
|
30
|
-
async register(userId, ip, ua) {
|
|
31
|
-
const result = await logFn({ userId, action: "register", resource: "auth", resourceId: userId, ipAddress: ip, userAgent: ua });
|
|
32
|
-
return toVoid(result);
|
|
33
|
-
},
|
|
34
|
-
async passwordResetRequest(email, ip, ua) {
|
|
35
|
-
const result = await logFn({
|
|
36
|
-
action: "password_reset_request",
|
|
37
|
-
resource: "auth",
|
|
38
|
-
details: { email },
|
|
39
|
-
ipAddress: ip,
|
|
40
|
-
userAgent: ua
|
|
41
|
-
});
|
|
42
|
-
return toVoid(result);
|
|
43
|
-
},
|
|
44
|
-
async passwordResetComplete(userId, ip, ua) {
|
|
45
|
-
const result = await logFn({ userId, action: "password_reset", resource: "auth", ipAddress: ip, userAgent: ua });
|
|
46
|
-
return toVoid(result);
|
|
47
|
-
},
|
|
48
|
-
async crud(input) {
|
|
49
|
-
const result = await logFn({
|
|
50
|
-
userId: input.userId,
|
|
51
|
-
action: input.action,
|
|
52
|
-
resource: input.resource,
|
|
53
|
-
resourceId: input.resourceId,
|
|
54
|
-
details: input.details,
|
|
55
|
-
ipAddress: input.ip,
|
|
56
|
-
userAgent: input.ua
|
|
57
|
-
});
|
|
58
|
-
return toVoid(result);
|
|
59
|
-
}
|
|
60
|
-
};
|
|
104
|
+
function withAuditContext(context, operation) {
|
|
105
|
+
const previous = getAuditContext();
|
|
106
|
+
const actor = Object.hasOwn(context, "actor") ? context.actor : previous.actor;
|
|
107
|
+
const snapshot = actor ? { ...actor, ...actor.roles ? { roles: [...actor.roles] } : {} } : actor;
|
|
108
|
+
return storage.run({ ...previous, ...context, actor: snapshot }, operation);
|
|
61
109
|
}
|
|
62
110
|
|
|
63
111
|
// messages/en-US.json
|
|
64
112
|
var en_US_default = {
|
|
113
|
+
audit_eventFieldsInvalid: "Invalid event fields",
|
|
114
|
+
audit_identityMismatch: "Actor snapshot does not match the event identity",
|
|
115
|
+
audit_queryInvalid: "Invalid filters or dates",
|
|
116
|
+
audit_eventProcessingFailed: "Event processing failed",
|
|
117
|
+
audit_sortInvalid: "Invalid sort field or direction",
|
|
118
|
+
audit_retentionPolicyFailed: "Unable to read or update the audit retention policy",
|
|
65
119
|
$schema: "https://inlang.com/schema/inlang-message-format",
|
|
66
120
|
audit_notInitialized: "Audit module not initialized, call audit.init() first",
|
|
67
121
|
audit_initFailed: "Audit module initialization failed: {error}",
|
|
@@ -72,11 +126,32 @@ var en_US_default = {
|
|
|
72
126
|
audit_invalidStatCount: "Audit count is outside the valid range and cannot be displayed safely",
|
|
73
127
|
audit_configError: "Audit config validation failed: {error}",
|
|
74
128
|
audit_initInProgress: "Audit module initialization is already in progress",
|
|
75
|
-
audit_invalidInput: "Invalid audit input for {field}: {reason}"
|
|
129
|
+
audit_invalidInput: "Invalid audit input for {field}: {reason}",
|
|
130
|
+
audit_backupDisabled: "Audit backup is disabled",
|
|
131
|
+
audit_backupFailed: "Audit backup operation failed",
|
|
132
|
+
audit_backupInvalid: "Invalid audit backup input",
|
|
133
|
+
audit_backupConflict: "This backup ID belongs to a different export request",
|
|
134
|
+
audit_backupStorageRequired: "Audit backups require initialized storage",
|
|
135
|
+
audit_backupPrivateStorageRequired: "Audit backups require private storage; remove the public base URL and restrict archive reads",
|
|
136
|
+
audit_backupVerificationFailed: "Audit archive verification could not complete",
|
|
137
|
+
audit_backupTaskName: "Audit log backup",
|
|
138
|
+
audit_alertsDisabled: "Audit alerts are disabled",
|
|
139
|
+
audit_alertsFailed: "Audit alert check or notification failed",
|
|
140
|
+
audit_alertReachRequired: "Alerts require initialized Reach and valid notification providers",
|
|
141
|
+
audit_alertSubject: "[{severity}] Security alert: {rule}",
|
|
142
|
+
audit_alertTaskName: "Audit anomaly alert check",
|
|
143
|
+
audit_unknownTask: "Unknown audit scheduled task",
|
|
144
|
+
audit_eventTimeUnavailable: "A valid database audit time is unavailable"
|
|
76
145
|
};
|
|
77
146
|
|
|
78
147
|
// messages/ja-JP.json
|
|
79
148
|
var ja_JP_default = {
|
|
149
|
+
audit_eventFieldsInvalid: "\u30A4\u30D9\u30F3\u30C8\u9805\u76EE\u304C\u7121\u52B9\u3067\u3059",
|
|
150
|
+
audit_identityMismatch: "\u8EAB\u5143\u30B9\u30CA\u30C3\u30D7\u30B7\u30E7\u30C3\u30C8\u3068\u64CD\u4F5C\u8005\u304C\u4E00\u81F4\u3057\u307E\u305B\u3093",
|
|
151
|
+
audit_queryInvalid: "\u691C\u7D22\u6761\u4EF6\u307E\u305F\u306F\u65E5\u4ED8\u304C\u7121\u52B9\u3067\u3059",
|
|
152
|
+
audit_eventProcessingFailed: "\u30A4\u30D9\u30F3\u30C8\u51E6\u7406\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
|
|
153
|
+
audit_sortInvalid: "\u4E26\u3079\u66FF\u3048\u9805\u76EE\u307E\u305F\u306F\u65B9\u5411\u304C\u7121\u52B9\u3067\u3059",
|
|
154
|
+
audit_retentionPolicyFailed: "\u76E3\u67FB\u306E\u6700\u4F4E\u4FDD\u6301\u30DD\u30EA\u30B7\u30FC\u3092\u8AAD\u307F\u53D6\u308A\u307E\u305F\u306F\u66F4\u65B0\u3067\u304D\u307E\u305B\u3093",
|
|
80
155
|
$schema: "https://inlang.com/schema/inlang-message-format",
|
|
81
156
|
audit_notInitialized: "\u76E3\u67FB\u30E2\u30B8\u30E5\u30FC\u30EB\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306Baudit.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
|
|
82
157
|
audit_initFailed: "\u76E3\u67FB\u30E2\u30B8\u30E5\u30FC\u30EB\u306E\u521D\u671F\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
|
|
@@ -87,11 +162,32 @@ var ja_JP_default = {
|
|
|
87
162
|
audit_invalidStatCount: "\u76E3\u67FB\u4EF6\u6570\u304C\u6709\u52B9\u7BC4\u56F2\u3092\u8D85\u3048\u3066\u3044\u308B\u305F\u3081\u3001\u5B89\u5168\u306B\u8868\u793A\u3067\u304D\u307E\u305B\u3093",
|
|
88
163
|
audit_configError: "\u76E3\u67FB\u8A2D\u5B9A\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
|
|
89
164
|
audit_initInProgress: "\u76E3\u67FB\u30E2\u30B8\u30E5\u30FC\u30EB\u306E\u521D\u671F\u5316\u306F\u65E2\u306B\u5B9F\u884C\u4E2D\u3067\u3059",
|
|
90
|
-
audit_invalidInput: "{field}\u306E\u76E3\u67FB\u5165\u529B\u304C\u7121\u52B9\u3067\u3059: {reason}"
|
|
165
|
+
audit_invalidInput: "{field}\u306E\u76E3\u67FB\u5165\u529B\u304C\u7121\u52B9\u3067\u3059: {reason}",
|
|
166
|
+
audit_backupDisabled: "\u76E3\u67FB\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u306F\u7121\u52B9\u3067\u3059",
|
|
167
|
+
audit_backupFailed: "\u76E3\u67FB\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u64CD\u4F5C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
|
|
168
|
+
audit_backupInvalid: "\u76E3\u67FB\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u306E\u5165\u529B\u304C\u7121\u52B9\u3067\u3059",
|
|
169
|
+
audit_backupConflict: "\u3053\u306E\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7 ID \u306F\u7570\u306A\u308B\u30A8\u30AF\u30B9\u30DD\u30FC\u30C8\u6761\u4EF6\u3067\u4F7F\u7528\u3055\u308C\u3066\u3044\u307E\u3059",
|
|
170
|
+
audit_backupStorageRequired: "\u76E3\u67FB\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u306B\u306F\u521D\u671F\u5316\u6E08\u307F\u30B9\u30C8\u30EC\u30FC\u30B8\u304C\u5FC5\u8981\u3067\u3059",
|
|
171
|
+
audit_backupPrivateStorageRequired: "\u76E3\u67FB\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u306B\u306F\u975E\u516C\u958B\u30B9\u30C8\u30EC\u30FC\u30B8\u304C\u5FC5\u8981\u3067\u3059\u3002\u516C\u958B URL \u3092\u524A\u9664\u3057\u3001\u30A2\u30FC\u30AB\u30A4\u30D6\u306E\u8AAD\u53D6\u3092\u5236\u9650\u3057\u3066\u304F\u3060\u3055\u3044",
|
|
172
|
+
audit_backupVerificationFailed: "\u76E3\u67FB\u30A2\u30FC\u30AB\u30A4\u30D6\u306E\u691C\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F",
|
|
173
|
+
audit_backupTaskName: "\u76E3\u67FB\u30ED\u30B0\u306E\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7",
|
|
174
|
+
audit_alertsDisabled: "\u76E3\u67FB\u30A2\u30E9\u30FC\u30C8\u306F\u7121\u52B9\u3067\u3059",
|
|
175
|
+
audit_alertsFailed: "\u76E3\u67FB\u30A2\u30E9\u30FC\u30C8\u306E\u78BA\u8A8D\u307E\u305F\u306F\u901A\u77E5\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
|
|
176
|
+
audit_alertReachRequired: "\u521D\u671F\u5316\u6E08\u307F\u306E Reach \u3068\u6709\u52B9\u306A\u901A\u77E5\u30C1\u30E3\u30CD\u30EB\u304C\u5FC5\u8981\u3067\u3059",
|
|
177
|
+
audit_alertSubject: "[{severity}] \u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u30A2\u30E9\u30FC\u30C8\uFF1A{rule}",
|
|
178
|
+
audit_alertTaskName: "\u76E3\u67FB\u7570\u5E38\u30A2\u30E9\u30FC\u30C8\u78BA\u8A8D",
|
|
179
|
+
audit_unknownTask: "\u4E0D\u660E\u306A\u76E3\u67FB\u5B9A\u671F\u30BF\u30B9\u30AF\u3067\u3059",
|
|
180
|
+
audit_eventTimeUnavailable: "\u6709\u52B9\u306A\u76E3\u67FB\u7528 DB \u6642\u523B\u3092\u53D6\u5F97\u3067\u304D\u307E\u305B\u3093"
|
|
91
181
|
};
|
|
92
182
|
|
|
93
183
|
// messages/zh-CN.json
|
|
94
184
|
var zh_CN_default = {
|
|
185
|
+
audit_eventFieldsInvalid: "\u4E8B\u4EF6\u5B57\u6BB5\u65E0\u6548",
|
|
186
|
+
audit_identityMismatch: "\u8EAB\u4EFD\u5FEB\u7167\u4E0E\u64CD\u4F5C\u8005\u4E0D\u4E00\u81F4",
|
|
187
|
+
audit_queryInvalid: "\u7B5B\u9009\u6761\u4EF6\u6216\u65E5\u671F\u65E0\u6548",
|
|
188
|
+
audit_eventProcessingFailed: "\u4E8B\u4EF6\u5904\u7406\u5931\u8D25",
|
|
189
|
+
audit_sortInvalid: "\u6392\u5E8F\u5B57\u6BB5\u6216\u65B9\u5411\u65E0\u6548",
|
|
190
|
+
audit_retentionPolicyFailed: "\u65E0\u6CD5\u8BFB\u53D6\u6216\u66F4\u65B0\u5BA1\u8BA1\u6700\u4F4E\u4FDD\u7559\u7B56\u7565",
|
|
95
191
|
$schema: "https://inlang.com/schema/inlang-message-format",
|
|
96
192
|
audit_notInitialized: "\u5BA1\u8BA1\u6A21\u5757\u5C1A\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 audit.init()",
|
|
97
193
|
audit_initFailed: "\u5BA1\u8BA1\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF1A{error}",
|
|
@@ -102,7 +198,22 @@ var zh_CN_default = {
|
|
|
102
198
|
audit_invalidStatCount: "\u5BA1\u8BA1\u7EDF\u8BA1\u6570\u91CF\u8D85\u51FA\u6709\u6548\u8303\u56F4\uFF0C\u65E0\u6CD5\u5B89\u5168\u663E\u793A",
|
|
103
199
|
audit_configError: "\u5BA1\u8BA1\u914D\u7F6E\u6821\u9A8C\u5931\u8D25\uFF1A{error}",
|
|
104
200
|
audit_initInProgress: "\u5BA1\u8BA1\u6A21\u5757\u6B63\u5728\u521D\u59CB\u5316\u4E2D\uFF0C\u8BF7\u52FF\u5E76\u53D1\u8C03\u7528",
|
|
105
|
-
audit_invalidInput: "\u5BA1\u8BA1\u8F93\u5165\u53C2\u6570\u65E0\u6548\uFF08{field}\uFF09\uFF1A{reason}"
|
|
201
|
+
audit_invalidInput: "\u5BA1\u8BA1\u8F93\u5165\u53C2\u6570\u65E0\u6548\uFF08{field}\uFF09\uFF1A{reason}",
|
|
202
|
+
audit_backupDisabled: "\u5BA1\u8BA1\u5907\u4EFD\u672A\u542F\u7528",
|
|
203
|
+
audit_backupFailed: "\u5BA1\u8BA1\u5907\u4EFD\u64CD\u4F5C\u5931\u8D25",
|
|
204
|
+
audit_backupInvalid: "\u5BA1\u8BA1\u5907\u4EFD\u53C2\u6570\u65E0\u6548",
|
|
205
|
+
audit_backupConflict: "\u6B64\u5907\u4EFD\u7F16\u53F7\u5DF2\u7528\u4E8E\u4E0D\u540C\u7684\u5BFC\u51FA\u6761\u4EF6",
|
|
206
|
+
audit_backupStorageRequired: "\u542F\u7528\u5BA1\u8BA1\u5907\u4EFD\u9700\u8981\u5DF2\u521D\u59CB\u5316\u7684\u5B58\u50A8",
|
|
207
|
+
audit_backupPrivateStorageRequired: "\u5BA1\u8BA1\u5907\u4EFD\u9700\u8981\u79C1\u6709\u5B58\u50A8\uFF0C\u8BF7\u79FB\u9664\u516C\u5F00\u8BBF\u95EE\u57FA\u7840 URL \u5E76\u9650\u5236\u5F52\u6863\u8BFB\u53D6",
|
|
208
|
+
audit_backupVerificationFailed: "\u65E0\u6CD5\u5B8C\u6210\u5BA1\u8BA1\u5F52\u6863\u6821\u9A8C",
|
|
209
|
+
audit_backupTaskName: "\u5BA1\u8BA1\u65E5\u5FD7\u5907\u4EFD",
|
|
210
|
+
audit_alertsDisabled: "\u5BA1\u8BA1\u544A\u8B66\u672A\u542F\u7528",
|
|
211
|
+
audit_alertsFailed: "\u5BA1\u8BA1\u544A\u8B66\u68C0\u67E5\u6216\u901A\u77E5\u5931\u8D25",
|
|
212
|
+
audit_alertReachRequired: "\u544A\u8B66\u9700\u8981\u5DF2\u521D\u59CB\u5316\u7684 Reach \u548C\u6709\u6548\u901A\u77E5\u6E20\u9053",
|
|
213
|
+
audit_alertSubject: "[{severity}] \u5B89\u5168\u544A\u8B66\uFF1A{rule}",
|
|
214
|
+
audit_alertTaskName: "\u5BA1\u8BA1\u5F02\u5E38\u544A\u8B66\u68C0\u67E5",
|
|
215
|
+
audit_unknownTask: "\u672A\u77E5\u5BA1\u8BA1\u5B9A\u65F6\u4EFB\u52A1",
|
|
216
|
+
audit_eventTimeUnavailable: "\u65E0\u6CD5\u53D6\u5F97\u6709\u6548\u7684\u6570\u636E\u5E93\u5BA1\u8BA1\u65F6\u95F4"
|
|
106
217
|
};
|
|
107
218
|
|
|
108
219
|
// src/audit-i18n.ts
|
|
@@ -118,16 +229,713 @@ var AuditErrorInfo = {
|
|
|
118
229
|
STATS_FAILED: "004:500",
|
|
119
230
|
INIT_IN_PROGRESS: "005:409",
|
|
120
231
|
NOT_INITIALIZED: "010:500",
|
|
121
|
-
CONFIG_ERROR: "012:500"
|
|
232
|
+
CONFIG_ERROR: "012:500",
|
|
233
|
+
BACKUP_DISABLED: "020:403",
|
|
234
|
+
BACKUP_FAILED: "021:500",
|
|
235
|
+
BACKUP_INVALID: "022:400",
|
|
236
|
+
BACKUP_CONFLICT: "023:409",
|
|
237
|
+
ALERTS_DISABLED: "024:403",
|
|
238
|
+
ALERTS_FAILED: "025:500"
|
|
122
239
|
};
|
|
123
240
|
var HaiAuditError = core.error.buildHaiErrorsDef("audit", AuditErrorInfo);
|
|
241
|
+
var AUDIT_BACKUP_PREFIX = "hai-private/audit-backups/";
|
|
124
242
|
|
|
125
|
-
// src/audit-
|
|
126
|
-
|
|
243
|
+
// src/audit-database-time.ts
|
|
244
|
+
function auditClockSql() {
|
|
245
|
+
return reldb.config?.type === "sqlite" ? "CAST(ROUND((julianday('now')-2440587.5)*86400000) AS INTEGER)" : reldb.config?.type === "postgresql" ? "CAST(EXTRACT(EPOCH FROM clock_timestamp())*1000 AS BIGINT)" : "CAST(UNIX_TIMESTAMP(CURRENT_TIMESTAMP(3))*1000 AS SIGNED)";
|
|
246
|
+
}
|
|
247
|
+
async function readAuditTime(sql = reldb.sql) {
|
|
248
|
+
const result = await sql.get(`SELECT ${auditClockSql()} AS now_ms`);
|
|
249
|
+
if (!result.success)
|
|
250
|
+
return err(HaiAuditError.LOG_FAILED, auditM("audit_eventTimeUnavailable"), result.error);
|
|
251
|
+
const value = Number(result.data?.now_ms);
|
|
252
|
+
if (!Number.isSafeInteger(value) || value < 0 || !Number.isFinite(new Date(value).getTime()))
|
|
253
|
+
return err(HaiAuditError.LOG_FAILED, auditM("audit_eventTimeUnavailable"));
|
|
254
|
+
return ok(new Date(value));
|
|
255
|
+
}
|
|
256
|
+
|
|
257
|
+
// src/audit-alert-functions.ts
|
|
258
|
+
var logger = core.logger.child({ module: "audit", scope: "alerts" });
|
|
259
|
+
var levels = ["info", "warning", "error", "critical"];
|
|
260
|
+
var table = "hai_audit_alert_claims";
|
|
261
|
+
var hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
|
|
262
|
+
function createAuditAlerts(input) {
|
|
263
|
+
let active = true;
|
|
264
|
+
const controllers = /* @__PURE__ */ new Set();
|
|
265
|
+
const pending = /* @__PURE__ */ new Set();
|
|
266
|
+
async function run(signal) {
|
|
267
|
+
if (!input.config.enabled)
|
|
268
|
+
return err(HaiAuditError.ALERTS_DISABLED, auditM("audit_alertsDisabled"));
|
|
269
|
+
signal.throwIfAborted();
|
|
270
|
+
const type = reldb.config?.type;
|
|
271
|
+
const clock = auditClockSql();
|
|
272
|
+
const time = await readAuditTime();
|
|
273
|
+
if (!time.success)
|
|
274
|
+
return time;
|
|
275
|
+
const now = time.data.getTime();
|
|
276
|
+
const report = { submitted: 0, queued: 0, failed: 0, more: false };
|
|
277
|
+
let attempted = 0;
|
|
278
|
+
for (const rule of input.config.rules) {
|
|
279
|
+
const duration = rule.windowSeconds * 1e3;
|
|
280
|
+
const current = Math.floor(now / duration) * duration;
|
|
281
|
+
for (const start of [current - duration, current]) {
|
|
282
|
+
signal.throwIfAborted();
|
|
283
|
+
const end = Math.min(start + duration, now + 1);
|
|
284
|
+
const actions = [...new Set(rule.actions)].sort();
|
|
285
|
+
const outcomes = [...new Set(rule.outcomes)].sort();
|
|
286
|
+
const severities = levels.slice(levels.indexOf(rule.minimumSeverity));
|
|
287
|
+
const date = (value) => type === "sqlite" ? value : new Date(value);
|
|
288
|
+
const conditions = ["created_at >= ?", "created_at < ?", "resource <> ?", `action IN (${actions.map(() => "?").join(",")})`];
|
|
289
|
+
const params = [date(start), date(end), "audit.alert", ...actions];
|
|
290
|
+
if (outcomes.length) {
|
|
291
|
+
conditions.push(`outcome IN (${outcomes.map(() => "?").join(",")})`);
|
|
292
|
+
params.push(...outcomes);
|
|
293
|
+
}
|
|
294
|
+
if (rule.minimumSeverity !== "info") {
|
|
295
|
+
conditions.push(`severity IN (${severities.map(() => "?").join(",")})`);
|
|
296
|
+
params.push(...severities);
|
|
297
|
+
}
|
|
298
|
+
if (rule.resource) {
|
|
299
|
+
conditions.push("resource = ?");
|
|
300
|
+
params.push(rule.resource);
|
|
301
|
+
}
|
|
302
|
+
const counted = await reldb.sql.get(`SELECT COUNT(*) AS count FROM hai_audit_logs WHERE ${conditions.join(" AND ")}`, params);
|
|
303
|
+
if (!counted.success)
|
|
304
|
+
return counted;
|
|
305
|
+
const count = Number(counted.data?.count);
|
|
306
|
+
if (!Number.isSafeInteger(count) || count < 0)
|
|
307
|
+
return err(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"));
|
|
308
|
+
if (count < rule.threshold)
|
|
309
|
+
continue;
|
|
310
|
+
for (const target of rule.targets) {
|
|
311
|
+
signal.throwIfAborted();
|
|
312
|
+
const id = hash({ rule: { ...rule, actions, outcomes, targets: void 0 }, target, start });
|
|
313
|
+
if (attempted >= input.config.maxNotificationsPerCheck) {
|
|
314
|
+
const existing = await reldb.sql.get(`SELECT id FROM ${table} WHERE id=?`, [id]);
|
|
315
|
+
if (!existing.success)
|
|
316
|
+
return existing;
|
|
317
|
+
if (!existing.data)
|
|
318
|
+
report.more = true;
|
|
319
|
+
continue;
|
|
320
|
+
}
|
|
321
|
+
const selection = `SELECT ?, ?, ?, ?, 'claimed' WHERE ? <= ${clock} AND ? > ${clock}`;
|
|
322
|
+
const statement = type === "mysql" ? `INSERT IGNORE INTO ${table} (id, rule_id, target_id, window_start, status) ${selection}` : `INSERT INTO ${table} (id, rule_id, target_id, window_start, status) ${selection} ON CONFLICT(id) DO NOTHING`;
|
|
323
|
+
const claimed = await reldb.sql.execute(statement, [id, rule.id, target.id, start, start, start + duration * 2]);
|
|
324
|
+
if (!claimed.success)
|
|
325
|
+
return claimed;
|
|
326
|
+
if (claimed.data.changes === 0)
|
|
327
|
+
continue;
|
|
328
|
+
attempted++;
|
|
329
|
+
const details = { ruleId: rule.id, targetId: target.id, count, windowStart: new Date(start).toISOString(), windowEnd: new Date(start + duration).toISOString(), level: rule.severity };
|
|
330
|
+
const recorded = await input.log({ action: "audit.alert.claimed", resource: "audit.alert", resourceId: id, category: "system", severity: rule.severity, outcome: "success", details });
|
|
331
|
+
if (!recorded.success)
|
|
332
|
+
return recorded;
|
|
333
|
+
signal.throwIfAborted();
|
|
334
|
+
const sending = await reldb.sql.execute(`UPDATE ${table} SET status='sending' WHERE id=? AND status='claimed' AND ? > ${clock}`, [id, start + duration * 2]);
|
|
335
|
+
if (!sending.success)
|
|
336
|
+
return sending;
|
|
337
|
+
if (sending.data.changes !== 1)
|
|
338
|
+
continue;
|
|
339
|
+
const sent = await input.reach.send({ provider: target.provider, to: target.to, subject: auditM("audit_alertSubject", { params: { severity: rule.severity, rule: rule.id } }), body: JSON.stringify(details), idempotencyKey: id });
|
|
340
|
+
const accepted = sent.success && sent.data.success;
|
|
341
|
+
const status = accepted ? sent.data.deferred ? "queued" : "submitted" : "unknown";
|
|
342
|
+
const updated = await reldb.sql.execute(`UPDATE ${table} SET status=?, queue_id=?, error_code=? WHERE id=? AND status='sending'`, [status, sent.success && sent.data.deferred ? sent.data.queueId : null, sent.success ? null : sent.error.code, id]);
|
|
343
|
+
if (!updated.success || updated.data.changes !== 1)
|
|
344
|
+
return err(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), updated.success ? void 0 : updated.error);
|
|
345
|
+
if (status === "queued")
|
|
346
|
+
report.queued++;
|
|
347
|
+
else if (status === "submitted")
|
|
348
|
+
report.submitted++;
|
|
349
|
+
else
|
|
350
|
+
report.failed++;
|
|
351
|
+
const outcome = await input.log({ action: "audit.alert.notification", resource: "audit.alert", resourceId: id, category: "system", severity: rule.severity, outcome: accepted ? "success" : "failure", details: { ...details, status, ...sent.success ? {} : { reasonCode: sent.error.code }, ...sent.success && sent.data.deferred ? { queueId: sent.data.queueId } : {} } });
|
|
352
|
+
if (!outcome.success)
|
|
353
|
+
return outcome;
|
|
354
|
+
if (!accepted)
|
|
355
|
+
logger.error("Audit alert notification outcome requires review", { id, ruleId: rule.id, targetId: target.id, errorCode: sent.success ? void 0 : sent.error.code });
|
|
356
|
+
}
|
|
357
|
+
}
|
|
358
|
+
}
|
|
359
|
+
const oldest = now - Math.max(...input.config.rules.map((rule) => rule.windowSeconds * 1e3)) * 3;
|
|
360
|
+
const cleaned = await reldb.sql.execute(`DELETE FROM ${table} WHERE window_start < ? AND status IN ('submitted', 'queued')`, [oldest]);
|
|
361
|
+
return cleaned.success ? ok(report) : cleaned;
|
|
362
|
+
}
|
|
363
|
+
const check = (options) => {
|
|
364
|
+
if (!active)
|
|
365
|
+
return Promise.resolve(err(HaiAuditError.NOT_INITIALIZED, auditM("audit_notInitialized")));
|
|
366
|
+
if (options?.signal !== void 0 && !(options.signal instanceof AbortSignal))
|
|
367
|
+
return Promise.resolve(err(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed")));
|
|
368
|
+
const controller = new AbortController();
|
|
369
|
+
const cancel = () => controller.abort();
|
|
370
|
+
options?.signal?.addEventListener("abort", cancel, { once: true });
|
|
371
|
+
if (options?.signal?.aborted)
|
|
372
|
+
cancel();
|
|
373
|
+
controllers.add(controller);
|
|
374
|
+
const operation = withAuditContext({ actor: { id: "system:audit-alerts", username: "scheduler" }, category: "system" }, () => run(controller.signal)).catch((error) => {
|
|
375
|
+
logger.error("Audit alert check failed", { error });
|
|
376
|
+
return err(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), error);
|
|
377
|
+
});
|
|
378
|
+
pending.add(operation);
|
|
379
|
+
void operation.finally(() => {
|
|
380
|
+
controllers.delete(controller);
|
|
381
|
+
pending.delete(operation);
|
|
382
|
+
options?.signal?.removeEventListener("abort", cancel);
|
|
383
|
+
});
|
|
384
|
+
return operation;
|
|
385
|
+
};
|
|
386
|
+
let schedule = null;
|
|
387
|
+
if (input.config.enabled && input.config.schedule.enabled) {
|
|
388
|
+
schedule = {
|
|
389
|
+
tasks: [{ id: "hai-audit-alerts", name: auditM("audit_alertTaskName"), idempotent: true, cron: input.config.schedule.cron, timezone: input.config.schedule.timezone }],
|
|
390
|
+
hooks: { onTaskExecute: async ({ context, signal }) => {
|
|
391
|
+
if (context.taskId !== "hai-audit-alerts")
|
|
392
|
+
throw core.error.buildHaiErrorInst(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"));
|
|
393
|
+
const result = await check({ signal });
|
|
394
|
+
if (!result.success || result.data.failed > 0)
|
|
395
|
+
throw core.error.buildHaiErrorInst(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), result.success ? void 0 : result.error);
|
|
396
|
+
return result.data;
|
|
397
|
+
} }
|
|
398
|
+
};
|
|
399
|
+
}
|
|
400
|
+
return {
|
|
401
|
+
check,
|
|
402
|
+
schedule,
|
|
403
|
+
async close() {
|
|
404
|
+
active = false;
|
|
405
|
+
controllers.forEach((controller) => controller.abort());
|
|
406
|
+
await Promise.allSettled([...pending]);
|
|
407
|
+
}
|
|
408
|
+
};
|
|
409
|
+
}
|
|
410
|
+
var logger2 = core.logger.child({ module: "audit", scope: "writer" });
|
|
411
|
+
var actorSchema = z.object({ id: z.string().min(1).max(256), username: z.string().max(256).optional(), displayName: z.string().max(256).optional(), roles: z.array(z.string().max(256)).max(1e3).optional() });
|
|
412
|
+
var detailsSchema = z.record(z.string(), z.unknown());
|
|
413
|
+
var inputSchema = z.object({
|
|
414
|
+
userId: z.string().min(1).max(256).nullable().optional(),
|
|
415
|
+
actorSnapshot: actorSchema.nullable().optional(),
|
|
416
|
+
action: z.string().trim().min(1).max(256),
|
|
417
|
+
resource: z.string().trim().min(1).max(256),
|
|
418
|
+
resourceId: z.string().max(256).nullable().optional(),
|
|
419
|
+
category: z.enum(["system", "business"]).nullable().optional(),
|
|
420
|
+
outcome: z.enum(["success", "failure", "denied"]).nullable().optional(),
|
|
421
|
+
severity: z.enum(["info", "warning", "error", "critical"]).nullable().optional(),
|
|
422
|
+
requestId: z.string().max(256).nullable().optional(),
|
|
423
|
+
traceId: z.string().max(256).nullable().optional(),
|
|
424
|
+
scopeId: z.string().max(256).nullable().optional(),
|
|
425
|
+
ipAddress: z.string().max(256).nullable().optional(),
|
|
426
|
+
userAgent: z.string().max(4096).nullable().optional(),
|
|
427
|
+
details: detailsSchema.nullable().optional()
|
|
428
|
+
});
|
|
429
|
+
var querySchema = z.object({
|
|
430
|
+
requestId: z.string().min(1).max(256).optional(),
|
|
431
|
+
traceId: z.string().min(1).max(256).optional(),
|
|
432
|
+
userId: z.string().min(1).max(256).optional(),
|
|
433
|
+
resource: z.string().min(1).max(256).optional(),
|
|
434
|
+
action: z.string().min(1).max(256).optional(),
|
|
435
|
+
scopeId: z.string().min(1).max(256).optional(),
|
|
436
|
+
category: z.enum(["system", "business"]).optional(),
|
|
437
|
+
outcome: z.enum(["success", "failure", "denied"]).optional(),
|
|
438
|
+
severity: z.enum(["info", "warning", "error", "critical"]).optional(),
|
|
439
|
+
sortBy: z.enum(["createdAt", "action", "resource", "category", "outcome", "severity"]).optional(),
|
|
440
|
+
sortDirection: z.enum(["asc", "desc"]).optional(),
|
|
441
|
+
startDate: z.date().optional(),
|
|
442
|
+
endDate: z.date().optional()
|
|
443
|
+
});
|
|
444
|
+
function validAuditQuery(options) {
|
|
445
|
+
return querySchema.safeParse(options ?? {}).success;
|
|
446
|
+
}
|
|
447
|
+
function readAuditActor(value) {
|
|
448
|
+
if (value == null)
|
|
449
|
+
return null;
|
|
450
|
+
const parsed = actorSchema.safeParse(typeof value === "string" ? JSON.parse(value) : value);
|
|
451
|
+
if (!parsed.success)
|
|
452
|
+
throw new Error("Invalid audit actor snapshot");
|
|
453
|
+
return parsed.data;
|
|
454
|
+
}
|
|
455
|
+
function createAuditWriter(repository, config) {
|
|
456
|
+
const fields = new Set(config.privacy.fields.map((field) => field.toLowerCase()));
|
|
457
|
+
const businessPrivacy = /email|phone|mobile|idcard|identitynumber|bankaccount|shippingaddress|billingaddress|realname|identifier|recipient|邮箱|手机|电话|身份证|银行卡|地址|真实姓名|客户姓名/i;
|
|
458
|
+
return async (input, tx) => {
|
|
459
|
+
try {
|
|
460
|
+
const parsed = inputSchema.safeParse(input);
|
|
461
|
+
if (!parsed.success) {
|
|
462
|
+
logger2.error("Audit input rejected", { issues: parsed.error.issues.map((issue) => issue.path.join(".")) });
|
|
463
|
+
return err(HaiAuditError.LOG_FAILED, auditM("audit_invalidInput", { params: { field: "event", reason: auditM("audit_eventFieldsInvalid") } }));
|
|
464
|
+
}
|
|
465
|
+
const value = parsed.data;
|
|
466
|
+
const context = getAuditContext();
|
|
467
|
+
const correlation = core.context.get();
|
|
468
|
+
const actor = Object.hasOwn(value, "actorSnapshot") ? value.actorSnapshot : context.actor;
|
|
469
|
+
const userId = value.userId !== void 0 ? value.userId : actor?.id ?? correlation.userId ?? null;
|
|
470
|
+
if (value.actorSnapshot && value.actorSnapshot.id !== userId) {
|
|
471
|
+
logger2.error("Audit actor snapshot rejected", { reason: auditM("audit_identityMismatch") });
|
|
472
|
+
return err(HaiAuditError.LOG_FAILED, auditM("audit_invalidInput", { params: { field: "actorSnapshot", reason: auditM("audit_identityMismatch") } }));
|
|
473
|
+
}
|
|
474
|
+
const snapshot = actor?.id === userId ? readAuditActor(actor) : userId ? await repository.captureActor(userId, tx) : null;
|
|
475
|
+
const outcome = value.outcome ?? "success";
|
|
476
|
+
const jsonDetails = value.details == null ? null : JSON.parse(JSON.stringify(value.details, (key, entry) => {
|
|
477
|
+
const sensitive = core.sanitize.isSensitiveKey(key) || config.privacy.enabled && (businessPrivacy.test(key) || fields.has(key.toLowerCase()));
|
|
478
|
+
return sensitive ? "[REDACTED]" : entry;
|
|
479
|
+
}));
|
|
480
|
+
const normalizedDetails = jsonDetails == null ? null : detailsSchema.parse(jsonDetails);
|
|
481
|
+
const credentialSafe = normalizedDetails == null ? null : core.sanitize.sanitizeSensitiveFields(normalizedDetails, { replacement: "[REDACTED]" });
|
|
482
|
+
const details = !config.privacy.enabled || credentialSafe == null ? credentialSafe : core.sanitize.sanitizeSensitiveFields(credentialSafe, {
|
|
483
|
+
matcher: (key) => businessPrivacy.test(key) || fields.has(key.toLowerCase()),
|
|
484
|
+
replacement: "[REDACTED]"
|
|
485
|
+
});
|
|
486
|
+
const result = await repository.log({
|
|
487
|
+
...value,
|
|
488
|
+
category: value.category ?? context.category ?? "business",
|
|
489
|
+
outcome,
|
|
490
|
+
severity: value.severity ?? (outcome === "denied" ? "warning" : outcome === "failure" ? "error" : "info"),
|
|
491
|
+
userId,
|
|
492
|
+
actorSnapshot: snapshot,
|
|
493
|
+
requestId: value.requestId ?? context.requestId ?? correlation.requestId ?? null,
|
|
494
|
+
traceId: value.traceId ?? context.traceId ?? correlation.traceId ?? correlation.requestId ?? null,
|
|
495
|
+
scopeId: value.scopeId ?? context.scopeId ?? correlation.scopeId ?? null,
|
|
496
|
+
ipAddress: value.ipAddress ?? context.ipAddress ?? null,
|
|
497
|
+
userAgent: value.userAgent ?? context.userAgent ?? null,
|
|
498
|
+
details
|
|
499
|
+
}, tx);
|
|
500
|
+
if (!result.success)
|
|
501
|
+
logger2.error("Audit event persistence failed", { action: value.action, resource: value.resource, requestId: value.requestId ?? context.requestId, error: result.error });
|
|
502
|
+
return result;
|
|
503
|
+
} catch (error) {
|
|
504
|
+
logger2.error("Audit event processing failed", { requestId: getAuditContext().requestId, error });
|
|
505
|
+
return err(HaiAuditError.LOG_FAILED, auditM("audit_logFailed", { params: { error: auditM("audit_eventProcessingFailed") } }), error);
|
|
506
|
+
}
|
|
507
|
+
};
|
|
508
|
+
}
|
|
509
|
+
|
|
510
|
+
// src/audit-backup-format.ts
|
|
511
|
+
var backupIdSchema = z.string().regex(/^[a-z0-9][\w-]{0,127}$/i);
|
|
512
|
+
var digestSchema = z.string().regex(/^[a-f0-9]{64}$/);
|
|
513
|
+
var backupHeaderSchema = z.object({
|
|
514
|
+
type: z.literal("header"),
|
|
515
|
+
format: z.literal("hai-audit"),
|
|
516
|
+
version: z.literal(1),
|
|
517
|
+
id: backupIdSchema,
|
|
518
|
+
createdAt: z.iso.datetime(),
|
|
519
|
+
cutoff: z.iso.datetime(),
|
|
520
|
+
from: z.iso.datetime().nullable(),
|
|
521
|
+
requestHash: digestSchema
|
|
522
|
+
});
|
|
523
|
+
var footerSchema = z.object({ type: z.literal("footer"), recordCount: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER), sha256: digestSchema });
|
|
524
|
+
var entrySchema = z.object({ type: z.literal("entry"), record: z.object({ id: z.string().min(1), action: z.string().min(1), resource: z.string().min(1), createdAt: z.iso.datetime(), actorSnapshot: z.unknown().optional() }).passthrough() });
|
|
525
|
+
function archiveLine(value, maxRecordBytes) {
|
|
526
|
+
const encoded = Buffer.from(`${JSON.stringify(value)}
|
|
527
|
+
`, "utf8");
|
|
528
|
+
if (encoded.byteLength > maxRecordBytes)
|
|
529
|
+
throw new Error("Audit archive record exceeds size limit");
|
|
530
|
+
return encoded;
|
|
531
|
+
}
|
|
532
|
+
async function* lines(source, maxBytes, signal) {
|
|
533
|
+
let fragments = [];
|
|
534
|
+
let length = 0;
|
|
535
|
+
for await (const chunk of source) {
|
|
536
|
+
signal?.throwIfAborted();
|
|
537
|
+
const buffer = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
|
|
538
|
+
let offset = 0;
|
|
539
|
+
while (offset < buffer.byteLength) {
|
|
540
|
+
const newline = buffer.indexOf(10, offset);
|
|
541
|
+
const end = newline === -1 ? buffer.byteLength : newline + 1;
|
|
542
|
+
const part = buffer.subarray(offset, end);
|
|
543
|
+
length += part.byteLength;
|
|
544
|
+
if (length > maxBytes)
|
|
545
|
+
throw new Error("Audit archive record exceeds size limit");
|
|
546
|
+
fragments.push(part);
|
|
547
|
+
offset = end;
|
|
548
|
+
if (newline !== -1) {
|
|
549
|
+
yield Buffer.concat(fragments, length);
|
|
550
|
+
fragments = [];
|
|
551
|
+
length = 0;
|
|
552
|
+
}
|
|
553
|
+
}
|
|
554
|
+
}
|
|
555
|
+
signal?.throwIfAborted();
|
|
556
|
+
if (length !== 0)
|
|
557
|
+
throw new Error("Audit archive is truncated");
|
|
558
|
+
}
|
|
559
|
+
async function verifyArchive(source, options) {
|
|
560
|
+
const hash2 = createHash("sha256");
|
|
561
|
+
const decoder = new TextDecoder("utf-8", { fatal: true });
|
|
562
|
+
let header;
|
|
563
|
+
let footer;
|
|
564
|
+
let count = 0;
|
|
565
|
+
for await (const line of lines(source, options.maxRecordBytes, options.signal)) {
|
|
566
|
+
if (footer)
|
|
567
|
+
throw new Error("Audit archive has trailing records");
|
|
568
|
+
const value = JSON.parse(decoder.decode(line));
|
|
569
|
+
if (!header) {
|
|
570
|
+
header = backupHeaderSchema.parse(value);
|
|
571
|
+
if (options.key !== `${AUDIT_BACKUP_PREFIX}${header.id}.jsonl`)
|
|
572
|
+
throw new Error("Audit archive identity mismatch");
|
|
573
|
+
hash2.update(line);
|
|
574
|
+
continue;
|
|
575
|
+
}
|
|
576
|
+
const end = footerSchema.safeParse(value);
|
|
577
|
+
if (end.success) {
|
|
578
|
+
footer = end.data;
|
|
579
|
+
if (footer.recordCount !== count || footer.sha256 !== hash2.digest("hex"))
|
|
580
|
+
throw new Error("Audit archive checksum or count mismatch");
|
|
581
|
+
continue;
|
|
582
|
+
}
|
|
583
|
+
const entry = entrySchema.parse(value);
|
|
584
|
+
readAuditActor(entry.record.actorSnapshot);
|
|
585
|
+
if (!Number.isSafeInteger(++count))
|
|
586
|
+
throw new Error("Audit archive record count exceeds safe range");
|
|
587
|
+
hash2.update(line);
|
|
588
|
+
}
|
|
589
|
+
if (!header || !footer)
|
|
590
|
+
throw new Error("Audit archive is incomplete");
|
|
591
|
+
return { info: { id: header.id, key: options.key, recordCount: footer.recordCount, sha256: footer.sha256, createdAt: new Date(header.createdAt), cutoff: new Date(header.cutoff) }, requestHash: header.requestHash };
|
|
592
|
+
}
|
|
593
|
+
|
|
594
|
+
// src/audit-backup-functions.ts
|
|
595
|
+
var logger3 = core.logger.child({ module: "audit", scope: "backup" });
|
|
596
|
+
var optionsSchema = z.object({ id: backupIdSchema.optional(), from: z.date().optional(), to: z.date().optional(), signal: z.instanceof(AbortSignal).optional() });
|
|
597
|
+
function createAuditBackup(input) {
|
|
598
|
+
let active = true;
|
|
599
|
+
const controllers = /* @__PURE__ */ new Set();
|
|
600
|
+
const pending = /* @__PURE__ */ new Set();
|
|
601
|
+
function track(operation, event, parent) {
|
|
602
|
+
if (!active)
|
|
603
|
+
return Promise.resolve(err(HaiAuditError.NOT_INITIALIZED, auditM("audit_notInitialized")));
|
|
604
|
+
const controller = new AbortController();
|
|
605
|
+
const signal = parent ? AbortSignal.any([parent, controller.signal]) : controller.signal;
|
|
606
|
+
controllers.add(controller);
|
|
607
|
+
const promise = Promise.resolve().then(async () => {
|
|
608
|
+
if (!input.config.enabled || !input.storage?.isInitialized)
|
|
609
|
+
return err(HaiAuditError.BACKUP_DISABLED, auditM("audit_backupDisabled"));
|
|
610
|
+
signal.throwIfAborted();
|
|
611
|
+
return operation(signal);
|
|
612
|
+
}).catch((error) => {
|
|
613
|
+
logger3.error("Audit backup operation failed", { error });
|
|
614
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), error);
|
|
615
|
+
}).then(async (result) => {
|
|
616
|
+
const recorded = await input.capture({
|
|
617
|
+
action: event.action,
|
|
618
|
+
resource: "audit",
|
|
619
|
+
resourceId: result.success ? result.data.id : event.resourceId,
|
|
620
|
+
category: "system",
|
|
621
|
+
outcome: result.success ? "success" : result.error.httpStatus === 403 ? "denied" : "failure",
|
|
622
|
+
details: result.success ? { key: result.data.key, recordCount: result.data.recordCount, sha256: result.data.sha256 } : { reasonCode: result.error.code }
|
|
623
|
+
}, { read: event.read });
|
|
624
|
+
if (!recorded.success)
|
|
625
|
+
logger3.error("Audit backup event failed", { action: event.action, error: recorded.error });
|
|
626
|
+
return result;
|
|
627
|
+
}).finally(() => {
|
|
628
|
+
controllers.delete(controller);
|
|
629
|
+
pending.delete(promise);
|
|
630
|
+
});
|
|
631
|
+
pending.add(promise);
|
|
632
|
+
return promise;
|
|
633
|
+
}
|
|
634
|
+
async function read(key, signal) {
|
|
635
|
+
const opened = await input.storage.file.getStream(key, { signal });
|
|
636
|
+
if (!opened.success)
|
|
637
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), opened.error);
|
|
638
|
+
try {
|
|
639
|
+
return ok(await verifyArchive(opened.data, { key, maxRecordBytes: input.config.maxRecordBytes, signal }));
|
|
640
|
+
} catch (error) {
|
|
641
|
+
logger3.error("Audit archive verification failed", { error });
|
|
642
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupVerificationFailed"), error);
|
|
643
|
+
}
|
|
644
|
+
}
|
|
645
|
+
async function reuse(key, requestHash, signal) {
|
|
646
|
+
const previous = await read(key, signal);
|
|
647
|
+
if (!previous.success)
|
|
648
|
+
return previous;
|
|
649
|
+
return previous.data.requestHash === requestHash ? ok(previous.data.info) : err(HaiAuditError.BACKUP_CONFLICT, auditM("audit_backupConflict"));
|
|
650
|
+
}
|
|
651
|
+
const operations = {
|
|
652
|
+
run(options) {
|
|
653
|
+
const parsed = optionsSchema.safeParse(options ?? {});
|
|
654
|
+
if (!parsed.success)
|
|
655
|
+
return Promise.resolve(err(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid")));
|
|
656
|
+
const values = parsed.data;
|
|
657
|
+
const id = values.id ?? core.id.uuid();
|
|
658
|
+
const from = values.from ? new Date(values.from.getTime()) : void 0;
|
|
659
|
+
const key = `${AUDIT_BACKUP_PREFIX}${id}.jsonl`;
|
|
660
|
+
const database = reldb.config;
|
|
661
|
+
const source = database?.type === "sqlite" ? { type: database.type, database: database.database } : { type: database?.type, host: database?.host, port: database?.port, database: database?.database };
|
|
662
|
+
const requestHash = createHash("sha256").update(JSON.stringify({ source, from: from?.toISOString() ?? null, to: values.to?.toISOString() ?? null })).digest("hex");
|
|
663
|
+
return track(async (signal) => {
|
|
664
|
+
const time = await readAuditTime();
|
|
665
|
+
if (!time.success)
|
|
666
|
+
return time;
|
|
667
|
+
const createdAt = time.data;
|
|
668
|
+
const cutoff = new Date(values.to?.getTime() ?? createdAt.getTime());
|
|
669
|
+
if (cutoff > createdAt || from && from > cutoff)
|
|
670
|
+
return err(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid"));
|
|
671
|
+
const exists = await input.storage.file.exists(key);
|
|
672
|
+
if (!exists.success)
|
|
673
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), exists.error);
|
|
674
|
+
if (exists.data)
|
|
675
|
+
return reuse(key, requestHash, signal);
|
|
676
|
+
let completed;
|
|
677
|
+
async function* content() {
|
|
678
|
+
const hash2 = createHash("sha256");
|
|
679
|
+
const header = archiveLine({ type: "header", format: "hai-audit", version: 1, id, createdAt: createdAt.toISOString(), cutoff: cutoff.toISOString(), from: from?.toISOString() ?? null, requestHash }, input.config.maxRecordBytes);
|
|
680
|
+
hash2.update(header);
|
|
681
|
+
yield header;
|
|
682
|
+
let afterId;
|
|
683
|
+
let count = 0;
|
|
684
|
+
while (true) {
|
|
685
|
+
signal.throwIfAborted();
|
|
686
|
+
const page = await input.repository.archivePage({ afterId, from, cutoff, limit: input.config.batchSize });
|
|
687
|
+
if (!page.success)
|
|
688
|
+
throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), page.error);
|
|
689
|
+
for (const record of page.data) {
|
|
690
|
+
signal.throwIfAborted();
|
|
691
|
+
const line = archiveLine({ type: "entry", record }, input.config.maxRecordBytes);
|
|
692
|
+
hash2.update(line);
|
|
693
|
+
yield line;
|
|
694
|
+
if (!Number.isSafeInteger(++count))
|
|
695
|
+
throw new Error("Audit archive record count exceeds safe range");
|
|
696
|
+
afterId = record.id;
|
|
697
|
+
}
|
|
698
|
+
if (page.data.length < input.config.batchSize)
|
|
699
|
+
break;
|
|
700
|
+
}
|
|
701
|
+
const sha256 = hash2.digest("hex");
|
|
702
|
+
yield archiveLine({ type: "footer", recordCount: count, sha256 }, input.config.maxRecordBytes);
|
|
703
|
+
completed = { id, key, recordCount: count, sha256, createdAt, cutoff };
|
|
704
|
+
}
|
|
705
|
+
const stream = content();
|
|
706
|
+
let uploaded;
|
|
707
|
+
try {
|
|
708
|
+
uploaded = await input.storage.file.put(key, stream, { ifNoneMatch: "*", contentType: "application/x-ndjson", cacheControl: "private, no-store", signal });
|
|
709
|
+
} finally {
|
|
710
|
+
await stream.return(void 0);
|
|
711
|
+
}
|
|
712
|
+
if (!uploaded.success) {
|
|
713
|
+
const stored = await input.storage.file.exists(key);
|
|
714
|
+
if (stored.success && stored.data)
|
|
715
|
+
return reuse(key, requestHash, signal);
|
|
716
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), uploaded.error);
|
|
717
|
+
}
|
|
718
|
+
if (!completed)
|
|
719
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"));
|
|
720
|
+
return ok(completed);
|
|
721
|
+
}, { action: "audit.backup", resourceId: id }, values.signal);
|
|
722
|
+
},
|
|
723
|
+
verify(key, options) {
|
|
724
|
+
if (typeof key !== "string" || !key.startsWith(AUDIT_BACKUP_PREFIX) || !key.endsWith(".jsonl") || !backupIdSchema.safeParse(key.slice(AUDIT_BACKUP_PREFIX.length, -6)).success)
|
|
725
|
+
return Promise.resolve(err(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid")));
|
|
726
|
+
const parsed = optionsSchema.pick({ signal: true }).safeParse(options ?? {});
|
|
727
|
+
if (!parsed.success)
|
|
728
|
+
return Promise.resolve(err(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid")));
|
|
729
|
+
return track(async (signal) => {
|
|
730
|
+
const result = await read(key, signal);
|
|
731
|
+
return result.success ? ok(result.data.info) : result;
|
|
732
|
+
}, { action: "audit.backup.verify", read: true }, parsed.data.signal);
|
|
733
|
+
}
|
|
734
|
+
};
|
|
735
|
+
let schedule = null;
|
|
736
|
+
if (input.config.enabled && input.config.schedule.enabled) {
|
|
737
|
+
schedule = {
|
|
738
|
+
tasks: [{ id: "hai-audit-backup", name: auditM("audit_backupTaskName"), idempotent: true, cron: input.config.schedule.cron, timezone: input.config.schedule.timezone }],
|
|
739
|
+
hooks: { onTaskExecute: async ({ context, signal }) => {
|
|
740
|
+
if (context.taskId !== "hai-audit-backup" || !context.occurrenceId)
|
|
741
|
+
throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid"));
|
|
742
|
+
const result = await withAuditContext({ actor: { id: "system:audit-backup", username: "scheduler" }, requestId: context.occurrenceId }, () => operations.run({ id: context.occurrenceId, signal }));
|
|
743
|
+
if (!result.success)
|
|
744
|
+
throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_FAILED, result.error.message, result.error);
|
|
745
|
+
return result.data;
|
|
746
|
+
} }
|
|
747
|
+
};
|
|
748
|
+
}
|
|
749
|
+
return {
|
|
750
|
+
operations,
|
|
751
|
+
schedule,
|
|
752
|
+
async close() {
|
|
753
|
+
active = false;
|
|
754
|
+
for (const controller of controllers)
|
|
755
|
+
controller.abort();
|
|
756
|
+
await Promise.allSettled([...pending]);
|
|
757
|
+
}
|
|
758
|
+
};
|
|
759
|
+
}
|
|
760
|
+
function toVoid(result) {
|
|
761
|
+
if (!result.success) {
|
|
762
|
+
return result;
|
|
763
|
+
}
|
|
764
|
+
return ok(void 0);
|
|
765
|
+
}
|
|
766
|
+
function createHelper(logFn) {
|
|
767
|
+
return {
|
|
768
|
+
async login(userId, ip, ua) {
|
|
769
|
+
const result = await logFn({ userId, category: "system", action: "login", resource: "auth", ipAddress: ip, userAgent: ua });
|
|
770
|
+
return toVoid(result);
|
|
771
|
+
},
|
|
772
|
+
async logout(userId, ip, ua) {
|
|
773
|
+
const result = await logFn({ userId, category: "system", action: "logout", resource: "auth", ipAddress: ip, userAgent: ua });
|
|
774
|
+
return toVoid(result);
|
|
775
|
+
},
|
|
776
|
+
async register(userId, ip, ua) {
|
|
777
|
+
const result = await logFn({ userId, category: "system", action: "register", resource: "auth", resourceId: userId, ipAddress: ip, userAgent: ua });
|
|
778
|
+
return toVoid(result);
|
|
779
|
+
},
|
|
780
|
+
async passwordResetRequest(email, ip, ua) {
|
|
781
|
+
const result = await logFn({
|
|
782
|
+
action: "password_reset_request",
|
|
783
|
+
category: "system",
|
|
784
|
+
resource: "auth",
|
|
785
|
+
details: { email },
|
|
786
|
+
ipAddress: ip,
|
|
787
|
+
userAgent: ua
|
|
788
|
+
});
|
|
789
|
+
return toVoid(result);
|
|
790
|
+
},
|
|
791
|
+
async passwordResetComplete(userId, ip, ua) {
|
|
792
|
+
const result = await logFn({ userId, category: "system", action: "password_reset", resource: "auth", ipAddress: ip, userAgent: ua });
|
|
793
|
+
return toVoid(result);
|
|
794
|
+
},
|
|
795
|
+
async crud(input) {
|
|
796
|
+
const { ip, ua, ...fields } = input;
|
|
797
|
+
const result = await logFn({ ...fields, ipAddress: ip, userAgent: ua });
|
|
798
|
+
return toVoid(result);
|
|
799
|
+
}
|
|
800
|
+
};
|
|
801
|
+
}
|
|
802
|
+
var columns = { category: "VARCHAR(16)", outcome: "VARCHAR(16)", severity: "VARCHAR(16)", request_id: "TEXT", trace_id: "TEXT", scope_id: "TEXT", actor_snapshot: "JSON" };
|
|
803
|
+
var triggers = ["hai_audit_protect_update", "hai_audit_protect_delete", "hai_audit_protect_insert"];
|
|
804
|
+
async function existingTriggers(sql) {
|
|
805
|
+
const result = reldb.config?.type === "sqlite" ? await sql.query("SELECT name FROM sqlite_master WHERE type='trigger' AND tbl_name='hai_audit_logs'") : await sql.query(`SELECT trigger_name AS name FROM information_schema.triggers WHERE trigger_schema=${reldb.config?.type === "mysql" ? "DATABASE()" : "current_schema()"} AND event_object_table='hai_audit_logs'`);
|
|
806
|
+
return result.success ? ok(result.data.map((row) => row.name)) : result;
|
|
807
|
+
}
|
|
808
|
+
var steps = [{
|
|
809
|
+
version: 1,
|
|
810
|
+
name: "event-context-and-identity",
|
|
811
|
+
async needed(sql) {
|
|
812
|
+
const found = await schemaColumns(reldb, "hai_audit_logs", sql);
|
|
813
|
+
return found.success ? ok(found.data.length > 0 && Object.keys(columns).some((name) => !found.data.includes(name))) : found;
|
|
814
|
+
},
|
|
815
|
+
async apply(sql) {
|
|
816
|
+
const found = await schemaColumns(reldb, "hai_audit_logs", sql);
|
|
817
|
+
if (!found.success)
|
|
818
|
+
return found;
|
|
819
|
+
for (const [name, definition] of Object.entries(columns)) {
|
|
820
|
+
if (found.data.includes(name))
|
|
821
|
+
continue;
|
|
822
|
+
const added = await sql.execute(`ALTER TABLE hai_audit_logs ADD COLUMN ${name} ${definition}`);
|
|
823
|
+
if (!added.success)
|
|
824
|
+
return added;
|
|
825
|
+
}
|
|
826
|
+
return ok(void 0);
|
|
827
|
+
}
|
|
828
|
+
}, {
|
|
829
|
+
version: 2,
|
|
830
|
+
name: "persistent-retention-policy",
|
|
831
|
+
async needed(sql) {
|
|
832
|
+
const found = await schemaColumns(reldb, "hai_audit_policy", sql);
|
|
833
|
+
if (!found.success || found.data.length === 0)
|
|
834
|
+
return found.success ? ok(true) : found;
|
|
835
|
+
const row = await sql.get("SELECT id FROM hai_audit_policy WHERE id=1");
|
|
836
|
+
return row.success ? ok(!row.data) : row;
|
|
837
|
+
},
|
|
838
|
+
async apply(sql) {
|
|
839
|
+
const created = await sql.execute("CREATE TABLE IF NOT EXISTS hai_audit_policy (id INTEGER PRIMARY KEY, enabled INTEGER NOT NULL, min_days INTEGER NOT NULL)");
|
|
840
|
+
if (!created.success)
|
|
841
|
+
return created;
|
|
842
|
+
return sql.execute(reldb.config?.type === "mysql" ? "INSERT IGNORE INTO hai_audit_policy (id, enabled, min_days) VALUES (1, 0, 90)" : "INSERT INTO hai_audit_policy (id, enabled, min_days) VALUES (1, 0, 90) ON CONFLICT(id) DO NOTHING");
|
|
843
|
+
}
|
|
844
|
+
}, {
|
|
845
|
+
version: 3,
|
|
846
|
+
name: "retention-write-guards",
|
|
847
|
+
async needed(sql) {
|
|
848
|
+
const table2 = await schemaColumns(reldb, "hai_audit_logs", sql);
|
|
849
|
+
if (!table2.success || !table2.data.length)
|
|
850
|
+
return table2.success ? ok(false) : table2;
|
|
851
|
+
const found = await existingTriggers(sql);
|
|
852
|
+
return found.success ? ok(triggers.some((name) => !found.data.includes(name))) : found;
|
|
853
|
+
},
|
|
854
|
+
async apply(sql) {
|
|
855
|
+
const found = await existingTriggers(sql);
|
|
856
|
+
if (!found.success)
|
|
857
|
+
return found;
|
|
858
|
+
const enabled = "COALESCE((SELECT enabled FROM hai_audit_policy WHERE id=1),1)=1";
|
|
859
|
+
const days = "COALESCE((SELECT min_days FROM hai_audit_policy WHERE id=1),90)";
|
|
860
|
+
const cutoff = reldb.config?.type === "sqlite" ? `CAST((julianday('now')-2440587.5)*86400000 AS INTEGER) - ${days}*86400000` : reldb.config?.type === "postgresql" ? `CURRENT_TIMESTAMP - (${days} * INTERVAL '1 day')` : `TIMESTAMPADD(DAY, -${days}, CURRENT_TIMESTAMP(3))`;
|
|
861
|
+
const existingProtected = `${enabled} AND EXISTS(SELECT 1 FROM hai_audit_logs a WHERE a.id=NEW.id AND a.created_at >= ${cutoff})`;
|
|
862
|
+
if (reldb.config?.type === "postgresql") {
|
|
863
|
+
const fn = await sql.execute(`CREATE OR REPLACE FUNCTION hai_audit_protect() RETURNS trigger AS $$ BEGIN IF TG_OP='INSERT' THEN IF ${existingProtected} THEN RAISE EXCEPTION 'Audit record is protected by retention policy'; END IF; RETURN NEW; END IF; IF ${enabled} AND OLD.created_at >= ${cutoff} THEN RAISE EXCEPTION 'Audit record is protected by retention policy'; END IF; IF TG_OP='DELETE' THEN RETURN OLD; END IF; RETURN NEW; END; $$ LANGUAGE plpgsql`);
|
|
864
|
+
if (!fn.success)
|
|
865
|
+
return fn;
|
|
866
|
+
}
|
|
867
|
+
for (const [index, operation] of ["UPDATE", "DELETE", "INSERT"].entries()) {
|
|
868
|
+
const name = triggers[index];
|
|
869
|
+
if (found.data.includes(name))
|
|
870
|
+
continue;
|
|
871
|
+
const protectedRow = operation === "INSERT" ? existingProtected : `${enabled} AND OLD.created_at >= ${cutoff}`;
|
|
872
|
+
const statement = reldb.config?.type === "sqlite" ? `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs WHEN ${protectedRow} BEGIN SELECT RAISE(ABORT, 'Audit record is protected by retention policy'); END` : reldb.config?.type === "postgresql" ? `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs FOR EACH ROW EXECUTE FUNCTION hai_audit_protect()` : `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs FOR EACH ROW BEGIN IF ${protectedRow} THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Audit record is protected by retention policy'; END IF; END`;
|
|
873
|
+
const created = reldb.config?.type === "mysql" ? await sql.query(statement) : await sql.execute(statement);
|
|
874
|
+
if (!created.success)
|
|
875
|
+
return created;
|
|
876
|
+
}
|
|
877
|
+
return ok(void 0);
|
|
878
|
+
}
|
|
879
|
+
}, {
|
|
880
|
+
version: 4,
|
|
881
|
+
name: "millisecond-event-time",
|
|
882
|
+
async needed(sql) {
|
|
883
|
+
if (reldb.config?.type !== "mysql")
|
|
884
|
+
return ok(false);
|
|
885
|
+
const column = await sql.get("SELECT DATETIME_PRECISION AS fractional_digits FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name=? AND column_name=?", ["hai_audit_logs", "created_at"]);
|
|
886
|
+
return column.success ? ok(Boolean(column.data && Number(column.data.fractional_digits ?? 0) < 3)) : column;
|
|
887
|
+
},
|
|
888
|
+
async apply(sql) {
|
|
889
|
+
const changed = await sql.execute("ALTER TABLE hai_audit_logs MODIFY COLUMN created_at DATETIME(3)");
|
|
890
|
+
return changed.success ? ok(void 0) : changed;
|
|
891
|
+
}
|
|
892
|
+
}, {
|
|
893
|
+
version: 5,
|
|
894
|
+
name: "alert-notification-claims",
|
|
895
|
+
async needed(sql) {
|
|
896
|
+
const found = await schemaColumns(reldb, "hai_audit_alert_claims", sql);
|
|
897
|
+
return found.success ? ok(found.data.length === 0) : found;
|
|
898
|
+
},
|
|
899
|
+
async apply(sql) {
|
|
900
|
+
const created = await sql.execute("CREATE TABLE IF NOT EXISTS hai_audit_alert_claims (id VARCHAR(64) PRIMARY KEY, rule_id VARCHAR(64) NOT NULL, target_id VARCHAR(64) NOT NULL, window_start BIGINT NOT NULL, status VARCHAR(16) NOT NULL, queue_id VARCHAR(64), error_code VARCHAR(128))");
|
|
901
|
+
return created.success ? ok(void 0) : created;
|
|
902
|
+
}
|
|
903
|
+
}, {
|
|
904
|
+
version: 6,
|
|
905
|
+
name: "event-time-index",
|
|
906
|
+
async needed(sql) {
|
|
907
|
+
const table2 = await schemaColumns(reldb, "hai_audit_logs", sql);
|
|
908
|
+
if (!table2.success || !table2.data.length)
|
|
909
|
+
return table2.success ? ok(false) : table2;
|
|
910
|
+
const found = reldb.config?.type === "sqlite" ? await sql.get("SELECT name FROM sqlite_master WHERE type='index' AND name='hai_audit_event_time_idx'") : reldb.config?.type === "postgresql" ? await sql.get("SELECT indexname FROM pg_indexes WHERE schemaname=current_schema() AND tablename='hai_audit_logs' AND indexname='hai_audit_event_time_idx'") : await sql.get("SELECT index_name FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='hai_audit_logs' AND index_name='hai_audit_event_time_idx' LIMIT 1");
|
|
911
|
+
return found.success ? ok(!found.data) : found;
|
|
912
|
+
},
|
|
913
|
+
async apply(sql) {
|
|
914
|
+
const created = await sql.execute("CREATE INDEX hai_audit_event_time_idx ON hai_audit_logs (created_at)");
|
|
915
|
+
return created.success ? ok(void 0) : created;
|
|
916
|
+
}
|
|
917
|
+
}];
|
|
918
|
+
function migrateAudit(options = {}) {
|
|
919
|
+
return migrateSchema(reldb, "audit", steps, options);
|
|
920
|
+
}
|
|
921
|
+
async function configureAuditRetention(policy) {
|
|
922
|
+
if (!policy)
|
|
923
|
+
return ok(void 0);
|
|
924
|
+
const result = await reldb.sql.execute("UPDATE hai_audit_policy SET enabled=?, min_days=? WHERE id=1", [Number(policy.enabled), policy.minDays]);
|
|
925
|
+
return result.success && result.data.changes === 1 ? ok(void 0) : err(HaiAuditError.CONFIG_ERROR, auditM("audit_retentionPolicyFailed"), result.success ? void 0 : result.error);
|
|
926
|
+
}
|
|
927
|
+
async function auditRetentionDays() {
|
|
928
|
+
const result = await reldb.sql.get("SELECT enabled, min_days FROM hai_audit_policy WHERE id=1");
|
|
929
|
+
if (!result.success || !result.data || ![0, 1].includes(Number(result.data.enabled)) || !Number.isInteger(Number(result.data.min_days)) || Number(result.data.min_days) < 1)
|
|
930
|
+
return err(HaiAuditError.CLEANUP_FAILED, auditM("audit_retentionPolicyFailed"));
|
|
931
|
+
return ok(Number(result.data.enabled) === 1 ? Number(result.data.min_days) : 0);
|
|
932
|
+
}
|
|
933
|
+
var logger4 = core.logger.child({ module: "audit", scope: "repository" });
|
|
127
934
|
var AUDIT_TABLE = "hai_audit_logs";
|
|
128
935
|
function normalizeAuditLog(row) {
|
|
129
936
|
return {
|
|
130
937
|
...row,
|
|
938
|
+
actorSnapshot: readAuditActor(row.actorSnapshot),
|
|
131
939
|
userId: row.userId ?? null,
|
|
132
940
|
resourceId: row.resourceId ?? null,
|
|
133
941
|
details: row.details == null ? null : typeof row.details === "string" ? row.details : JSON.stringify(row.details) ?? null,
|
|
@@ -156,6 +964,13 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
156
964
|
{ fieldName: "details", columnName: "details", def: { type: "JSON" }, select: true, create: true, update: false },
|
|
157
965
|
{ fieldName: "ipAddress", columnName: "ip_address", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
158
966
|
{ fieldName: "userAgent", columnName: "user_agent", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
967
|
+
{ fieldName: "category", columnName: "category", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
968
|
+
{ fieldName: "outcome", columnName: "outcome", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
969
|
+
{ fieldName: "severity", columnName: "severity", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
970
|
+
{ fieldName: "requestId", columnName: "request_id", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
971
|
+
{ fieldName: "traceId", columnName: "trace_id", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
972
|
+
{ fieldName: "scopeId", columnName: "scope_id", def: { type: "TEXT" }, select: true, create: true, update: false },
|
|
973
|
+
{ fieldName: "actorSnapshot", columnName: "actor_snapshot", def: { type: "JSON" }, select: true, create: true, update: false },
|
|
159
974
|
{ fieldName: "createdAt", columnName: "created_at", def: { type: "TIMESTAMP" }, select: true, create: true, update: false }
|
|
160
975
|
]
|
|
161
976
|
});
|
|
@@ -181,6 +996,37 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
181
996
|
toDateParam(date) {
|
|
182
997
|
return this.isSqlite ? date.getTime() : date;
|
|
183
998
|
}
|
|
999
|
+
/** 身份映射可选；名称读失败仍写入明确缺少名称的身份，并留下可观察诊断。 */
|
|
1000
|
+
async captureActor(userId, tx) {
|
|
1001
|
+
const quote = this.db.config?.type === "mysql" ? "`" : '"';
|
|
1002
|
+
const identifier = (name) => `${quote}${name}${quote}`;
|
|
1003
|
+
const { userTable, userIdColumn, userNameColumn } = this.repoConfig;
|
|
1004
|
+
const result = await this.sql(tx).get(`SELECT ${identifier(userNameColumn)} AS username FROM ${identifier(userTable)} WHERE ${identifier(userIdColumn)}=?`, [userId]);
|
|
1005
|
+
if (!result.success) {
|
|
1006
|
+
logger4.warn("Audit actor name unavailable", { userId, error: result.error });
|
|
1007
|
+
return { id: userId };
|
|
1008
|
+
}
|
|
1009
|
+
return { id: userId, ...result.data?.username ? { username: result.data.username } : {} };
|
|
1010
|
+
}
|
|
1011
|
+
filters(options) {
|
|
1012
|
+
const conditions = [];
|
|
1013
|
+
const params = [];
|
|
1014
|
+
for (const [field, column] of [["userId", "user_id"], ["action", "action"], ["resource", "resource"], ["category", "category"], ["outcome", "outcome"], ["severity", "severity"], ["scopeId", "scope_id"], ["requestId", "request_id"], ["traceId", "trace_id"]]) {
|
|
1015
|
+
if (options[field] !== void 0) {
|
|
1016
|
+
conditions.push(`a.${column} = ?`);
|
|
1017
|
+
params.push(options[field]);
|
|
1018
|
+
}
|
|
1019
|
+
}
|
|
1020
|
+
if (options.startDate) {
|
|
1021
|
+
conditions.push("a.created_at >= ?");
|
|
1022
|
+
params.push(this.toDateParam(options.startDate));
|
|
1023
|
+
}
|
|
1024
|
+
if (options.endDate) {
|
|
1025
|
+
conditions.push("a.created_at <= ?");
|
|
1026
|
+
params.push(this.toDateParam(options.endDate));
|
|
1027
|
+
}
|
|
1028
|
+
return { conditions, params };
|
|
1029
|
+
}
|
|
184
1030
|
/**
|
|
185
1031
|
* 记录一条审计日志
|
|
186
1032
|
*
|
|
@@ -194,11 +1040,16 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
194
1040
|
* @param input.userAgent - 客户端 User-Agent（可选）
|
|
195
1041
|
* @returns 成功时返回创建的 AuditLog；失败时返回 LOG_FAILED
|
|
196
1042
|
*/
|
|
197
|
-
async log(input) {
|
|
198
|
-
|
|
1043
|
+
async log(input, tx) {
|
|
1044
|
+
logger4.trace("Recording audit log", { action: input.action, resource: input.resource });
|
|
199
1045
|
const id = core.id.withPrefix("audit_");
|
|
200
|
-
const
|
|
1046
|
+
const time = await readAuditTime(this.sql(tx));
|
|
1047
|
+
if (!time.success)
|
|
1048
|
+
return time;
|
|
1049
|
+
const now = time.data;
|
|
1050
|
+
const context = { category: input.category ?? null, outcome: input.outcome ?? null, severity: input.severity ?? null, requestId: input.requestId ?? null, traceId: input.traceId ?? null, scopeId: input.scopeId ?? null, actorSnapshot: input.actorSnapshot ?? null };
|
|
201
1051
|
const data = {
|
|
1052
|
+
...context,
|
|
202
1053
|
id,
|
|
203
1054
|
userId: input.userId ?? null,
|
|
204
1055
|
action: input.action,
|
|
@@ -210,9 +1061,9 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
210
1061
|
createdAt: now
|
|
211
1062
|
};
|
|
212
1063
|
try {
|
|
213
|
-
const createResult = await this.create(data);
|
|
1064
|
+
const createResult = await this.create(data, tx);
|
|
214
1065
|
if (!createResult.success) {
|
|
215
|
-
|
|
1066
|
+
logger4.error("Failed to record audit log", { action: input.action, error: createResult.error.message });
|
|
216
1067
|
return err(
|
|
217
1068
|
HaiAuditError.LOG_FAILED,
|
|
218
1069
|
auditM("audit_logFailed", { params: { error: createResult.error.message } }),
|
|
@@ -220,6 +1071,7 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
220
1071
|
);
|
|
221
1072
|
}
|
|
222
1073
|
const auditLog = {
|
|
1074
|
+
...context,
|
|
223
1075
|
id,
|
|
224
1076
|
userId: input.userId ?? null,
|
|
225
1077
|
action: input.action,
|
|
@@ -230,10 +1082,10 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
230
1082
|
userAgent: input.userAgent ?? null,
|
|
231
1083
|
createdAt: now
|
|
232
1084
|
};
|
|
233
|
-
|
|
1085
|
+
logger4.trace("Audit log recorded", { id, action: input.action, resource: input.resource });
|
|
234
1086
|
return ok(auditLog);
|
|
235
1087
|
} catch (error) {
|
|
236
|
-
|
|
1088
|
+
logger4.error("Failed to record audit log", { action: input.action, error });
|
|
237
1089
|
return err(
|
|
238
1090
|
HaiAuditError.LOG_FAILED,
|
|
239
1091
|
auditM("audit_logFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
|
|
@@ -251,57 +1103,42 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
251
1103
|
const ready = await this.ready();
|
|
252
1104
|
if (!ready.success)
|
|
253
1105
|
return ready;
|
|
254
|
-
|
|
255
|
-
const conditions =
|
|
256
|
-
const params = [];
|
|
1106
|
+
logger4.debug("Querying audit logs", { userId: options.userId, action: options.action, resource: options.resource });
|
|
1107
|
+
const { conditions, params } = this.filters(options);
|
|
257
1108
|
const { userTable, userIdColumn, userNameColumn } = this.repoConfig;
|
|
258
1109
|
const quote = this.db.config?.type === "mysql" ? "`" : '"';
|
|
259
1110
|
const identifier = (name) => `${quote}${name.replaceAll(quote, quote + quote)}${quote}`;
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
conditions.push("a.action = ?");
|
|
266
|
-
params.push(options.action);
|
|
267
|
-
}
|
|
268
|
-
if (options.resource) {
|
|
269
|
-
conditions.push("a.resource = ?");
|
|
270
|
-
params.push(options.resource);
|
|
271
|
-
}
|
|
272
|
-
if (options.startDate) {
|
|
273
|
-
conditions.push("a.created_at >= ?");
|
|
274
|
-
params.push(this.toDateParam(options.startDate));
|
|
275
|
-
}
|
|
276
|
-
if (options.endDate) {
|
|
277
|
-
conditions.push("a.created_at <= ?");
|
|
278
|
-
params.push(this.toDateParam(options.endDate));
|
|
279
|
-
}
|
|
1111
|
+
const sortColumns = { createdAt: "created_at", action: "action", resource: "resource", category: "category", outcome: "outcome", severity: "severity" };
|
|
1112
|
+
const sortBy = options.sortBy ?? "createdAt";
|
|
1113
|
+
const direction = options.sortDirection ?? "desc";
|
|
1114
|
+
if (!Object.hasOwn(sortColumns, sortBy) || !["asc", "desc"].includes(direction))
|
|
1115
|
+
return err(HaiAuditError.QUERY_FAILED, auditM("audit_invalidInput", { params: { field: "sort", reason: auditM("audit_sortInvalid") } }));
|
|
280
1116
|
const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
|
|
281
1117
|
try {
|
|
282
1118
|
const result = await this.sql().queryPage({
|
|
283
1119
|
sql: `SELECT a.id, a.user_id AS ${identifier("userId")}, a.action, a.resource, a.resource_id AS ${identifier("resourceId")},
|
|
284
1120
|
a.details, a.ip_address AS ${identifier("ipAddress")}, a.user_agent AS ${identifier("userAgent")},
|
|
285
|
-
a.created_at AS ${identifier("createdAt")},
|
|
1121
|
+
a.created_at AS ${identifier("createdAt")}, a.category, a.outcome, a.severity,
|
|
1122
|
+
a.request_id AS ${identifier("requestId")}, a.trace_id AS ${identifier("traceId")}, a.scope_id AS ${identifier("scopeId")}, a.actor_snapshot AS ${identifier("actorSnapshot")}, u.${identifier(userNameColumn)} AS username
|
|
286
1123
|
FROM ${AUDIT_TABLE} a
|
|
287
1124
|
LEFT JOIN ${identifier(userTable)} u ON a.user_id = u.${identifier(userIdColumn)}
|
|
288
1125
|
${whereClause}
|
|
289
|
-
ORDER BY a.
|
|
1126
|
+
ORDER BY a.${sortColumns[sortBy]} ${direction.toUpperCase()}, a.id ${direction.toUpperCase()}`,
|
|
290
1127
|
params,
|
|
291
1128
|
pagination: { page: options.page, pageSize: options.pageSize },
|
|
292
1129
|
overrides: { defaultPageSize: 20 }
|
|
293
1130
|
});
|
|
294
1131
|
if (!result.success) {
|
|
295
|
-
|
|
1132
|
+
logger4.error("Failed to query audit logs", { error: result.error.message });
|
|
296
1133
|
return err(
|
|
297
1134
|
HaiAuditError.QUERY_FAILED,
|
|
298
1135
|
auditM("audit_queryFailed", { params: { error: result.error.message } }),
|
|
299
1136
|
result.error
|
|
300
1137
|
);
|
|
301
1138
|
}
|
|
302
|
-
return ok({ ...result.data, items: result.data.items.map((row) => ({ ...normalizeAuditLog(row), username: row.username ?? null })) });
|
|
1139
|
+
return ok({ ...result.data, items: result.data.items.map((row) => ({ ...normalizeAuditLog(row), username: readAuditActor(row.actorSnapshot)?.username ?? (row.actorSnapshot == null ? row.username ?? null : null) })) });
|
|
303
1140
|
} catch (error) {
|
|
304
|
-
|
|
1141
|
+
logger4.error("Failed to query audit logs", { error });
|
|
305
1142
|
return err(
|
|
306
1143
|
HaiAuditError.QUERY_FAILED,
|
|
307
1144
|
auditM("audit_queryFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
|
|
@@ -309,6 +1146,50 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
309
1146
|
);
|
|
310
1147
|
}
|
|
311
1148
|
}
|
|
1149
|
+
/** 归档使用主键游标有界扫描，不关联当前用户名称或改写历史身份。 */
|
|
1150
|
+
async archivePage(options) {
|
|
1151
|
+
const ready = await this.ready();
|
|
1152
|
+
if (!ready.success)
|
|
1153
|
+
return ready;
|
|
1154
|
+
const quote = this.db.config?.type === "mysql" ? "`" : '"';
|
|
1155
|
+
const fields = [
|
|
1156
|
+
["id", "id"],
|
|
1157
|
+
["user_id", "userId"],
|
|
1158
|
+
["action", "action"],
|
|
1159
|
+
["resource", "resource"],
|
|
1160
|
+
["resource_id", "resourceId"],
|
|
1161
|
+
["details", "details"],
|
|
1162
|
+
["ip_address", "ipAddress"],
|
|
1163
|
+
["user_agent", "userAgent"],
|
|
1164
|
+
["created_at", "createdAt"],
|
|
1165
|
+
["category", "category"],
|
|
1166
|
+
["outcome", "outcome"],
|
|
1167
|
+
["severity", "severity"],
|
|
1168
|
+
["request_id", "requestId"],
|
|
1169
|
+
["trace_id", "traceId"],
|
|
1170
|
+
["scope_id", "scopeId"],
|
|
1171
|
+
["actor_snapshot", "actorSnapshot"]
|
|
1172
|
+
].map(([column, alias]) => `${column} AS ${quote}${alias}${quote}`).join(", ");
|
|
1173
|
+
const conditions = ["created_at <= ?"];
|
|
1174
|
+
const params = [this.toDateParam(options.cutoff)];
|
|
1175
|
+
if (options.from) {
|
|
1176
|
+
conditions.push("created_at >= ?");
|
|
1177
|
+
params.push(this.toDateParam(options.from));
|
|
1178
|
+
}
|
|
1179
|
+
if (options.afterId) {
|
|
1180
|
+
conditions.push("id > ?");
|
|
1181
|
+
params.push(options.afterId);
|
|
1182
|
+
}
|
|
1183
|
+
params.push(options.limit);
|
|
1184
|
+
const result = await this.sql().query(`SELECT ${fields} FROM ${AUDIT_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY id ASC LIMIT ?`, params);
|
|
1185
|
+
if (!result.success)
|
|
1186
|
+
return result;
|
|
1187
|
+
try {
|
|
1188
|
+
return ok(result.data.map(normalizeAuditLog));
|
|
1189
|
+
} catch (error) {
|
|
1190
|
+
return err(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), error);
|
|
1191
|
+
}
|
|
1192
|
+
}
|
|
312
1193
|
/**
|
|
313
1194
|
* 获取指定用户的最近活动
|
|
314
1195
|
*
|
|
@@ -317,7 +1198,7 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
317
1198
|
* @returns 成功时返回 AuditLog 数组（按时间倒序）；失败时返回 QUERY_FAILED
|
|
318
1199
|
*/
|
|
319
1200
|
async getUserRecent(userId, limit = 10) {
|
|
320
|
-
|
|
1201
|
+
logger4.debug("Getting user recent activity", { userId, limit });
|
|
321
1202
|
try {
|
|
322
1203
|
const result = await this.findAll({
|
|
323
1204
|
where: "user_id = ?",
|
|
@@ -351,7 +1232,11 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
351
1232
|
const ready = await this.ready();
|
|
352
1233
|
if (!ready.success)
|
|
353
1234
|
return ready;
|
|
354
|
-
|
|
1235
|
+
const minimum = await auditRetentionDays();
|
|
1236
|
+
if (!minimum.success)
|
|
1237
|
+
return minimum;
|
|
1238
|
+
olderThanDays = Math.max(olderThanDays, minimum.data);
|
|
1239
|
+
logger4.debug("Cleaning up old audit logs", { olderThanDays });
|
|
355
1240
|
const cutoff = /* @__PURE__ */ new Date();
|
|
356
1241
|
cutoff.setDate(cutoff.getDate() - olderThanDays);
|
|
357
1242
|
try {
|
|
@@ -360,7 +1245,7 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
360
1245
|
[this.toDateParam(cutoff)]
|
|
361
1246
|
);
|
|
362
1247
|
if (!result.success) {
|
|
363
|
-
|
|
1248
|
+
logger4.error("Failed to cleanup audit logs", { error: result.error.message });
|
|
364
1249
|
return err(
|
|
365
1250
|
HaiAuditError.CLEANUP_FAILED,
|
|
366
1251
|
auditM("audit_cleanupFailed", { params: { error: result.error.message } }),
|
|
@@ -368,10 +1253,13 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
368
1253
|
);
|
|
369
1254
|
}
|
|
370
1255
|
const deleted = result.data.changes;
|
|
371
|
-
|
|
1256
|
+
if (deleted > 0)
|
|
1257
|
+
logger4.info("Audit logs cleaned up", { olderThanDays, deleted });
|
|
1258
|
+
else
|
|
1259
|
+
logger4.trace("Audit cleanup found no expired records", { olderThanDays, deleted });
|
|
372
1260
|
return ok(deleted);
|
|
373
1261
|
} catch (error) {
|
|
374
|
-
|
|
1262
|
+
logger4.error("Failed to cleanup audit logs", { error });
|
|
375
1263
|
return err(
|
|
376
1264
|
HaiAuditError.CLEANUP_FAILED,
|
|
377
1265
|
auditM("audit_cleanupFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
|
|
@@ -385,24 +1273,25 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
385
1273
|
* @param days - 统计天数，默认 7
|
|
386
1274
|
* @returns 成功时返回 AuditStatItem 数组（按 count 倒序）；失败时返回 STATS_FAILED
|
|
387
1275
|
*/
|
|
388
|
-
async getStats(days = 7) {
|
|
1276
|
+
async getStats(days = 7, filters) {
|
|
389
1277
|
const ready = await this.ready();
|
|
390
1278
|
if (!ready.success)
|
|
391
1279
|
return ready;
|
|
392
|
-
|
|
1280
|
+
logger4.debug("Getting audit statistics", { days });
|
|
393
1281
|
const cutoff = /* @__PURE__ */ new Date();
|
|
394
1282
|
cutoff.setDate(cutoff.getDate() - days);
|
|
1283
|
+
const { conditions, params } = this.filters({ ...filters, startDate: cutoff });
|
|
395
1284
|
try {
|
|
396
1285
|
const result = await this.sql().query(
|
|
397
1286
|
`SELECT action, COUNT(*) as count
|
|
398
|
-
FROM ${AUDIT_TABLE}
|
|
399
|
-
WHERE
|
|
1287
|
+
FROM ${AUDIT_TABLE} a
|
|
1288
|
+
WHERE ${conditions.join(" AND ")}
|
|
400
1289
|
GROUP BY action
|
|
401
1290
|
ORDER BY count DESC`,
|
|
402
|
-
|
|
1291
|
+
params
|
|
403
1292
|
);
|
|
404
1293
|
if (!result.success) {
|
|
405
|
-
|
|
1294
|
+
logger4.error("Failed to query audit statistics", { error: result.error.message });
|
|
406
1295
|
return err(
|
|
407
1296
|
HaiAuditError.STATS_FAILED,
|
|
408
1297
|
auditM("audit_statsFailed", { params: { error: result.error.message } }),
|
|
@@ -414,7 +1303,7 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
414
1303
|
return err(HaiAuditError.STATS_FAILED, auditM("audit_invalidStatCount"));
|
|
415
1304
|
return ok(statistics);
|
|
416
1305
|
} catch (error) {
|
|
417
|
-
|
|
1306
|
+
logger4.error("Failed to query audit statistics", { error });
|
|
418
1307
|
return err(
|
|
419
1308
|
HaiAuditError.STATS_FAILED,
|
|
420
1309
|
auditM("audit_statsFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
|
|
@@ -425,25 +1314,16 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
|
|
|
425
1314
|
};
|
|
426
1315
|
|
|
427
1316
|
// src/audit-main.ts
|
|
428
|
-
var
|
|
429
|
-
var MAX_TEXT_LENGTH = 256;
|
|
430
|
-
var REDACTED_AUDIT_DETAIL_VALUE = "[REDACTED]";
|
|
1317
|
+
var logger5 = core.logger.child({ module: "audit", scope: "main" });
|
|
431
1318
|
function isNonEmptyString(value) {
|
|
432
1319
|
return typeof value === "string" && value.trim().length > 0;
|
|
433
1320
|
}
|
|
434
|
-
function isValidTextLength(value, maxLength = MAX_TEXT_LENGTH) {
|
|
435
|
-
return value.length <= maxLength;
|
|
436
|
-
}
|
|
437
|
-
function sanitizeAuditDetails(details) {
|
|
438
|
-
if (!details) {
|
|
439
|
-
return details ?? null;
|
|
440
|
-
}
|
|
441
|
-
return core.sanitize.sanitizeSensitiveFields(details, {
|
|
442
|
-
matcher: core.sanitize.defaultSensitiveKeyRegex,
|
|
443
|
-
replacement: REDACTED_AUDIT_DETAIL_VALUE
|
|
444
|
-
});
|
|
445
|
-
}
|
|
446
1321
|
var currentRepo = null;
|
|
1322
|
+
var currentWriter = null;
|
|
1323
|
+
var capturePolicy = null;
|
|
1324
|
+
var currentBackup = null;
|
|
1325
|
+
var currentAlerts = null;
|
|
1326
|
+
var inFlightWrites = /* @__PURE__ */ new Set();
|
|
447
1327
|
var currentHelper = null;
|
|
448
1328
|
var initInProgress = false;
|
|
449
1329
|
var lifecycleGeneration = 0;
|
|
@@ -452,7 +1332,9 @@ var notInitialized = core.module.createNotInitializedKit(
|
|
|
452
1332
|
() => auditM("audit_notInitialized")
|
|
453
1333
|
);
|
|
454
1334
|
var notInitializedHelper = notInitialized.proxy();
|
|
1335
|
+
var notInitializedBackup = notInitialized.proxy();
|
|
455
1336
|
var audit = {
|
|
1337
|
+
withContext: withAuditContext,
|
|
456
1338
|
/**
|
|
457
1339
|
* 初始化审计模块
|
|
458
1340
|
*
|
|
@@ -473,7 +1355,7 @@ var audit = {
|
|
|
473
1355
|
*/
|
|
474
1356
|
async init(config) {
|
|
475
1357
|
if (initInProgress) {
|
|
476
|
-
|
|
1358
|
+
logger5.warn("Audit init already in progress, skipping concurrent call");
|
|
477
1359
|
return err(
|
|
478
1360
|
HaiAuditError.INIT_IN_PROGRESS,
|
|
479
1361
|
auditM("audit_initInProgress")
|
|
@@ -483,14 +1365,23 @@ var audit = {
|
|
|
483
1365
|
const generation = ++lifecycleGeneration;
|
|
484
1366
|
try {
|
|
485
1367
|
if (currentRepo) {
|
|
486
|
-
|
|
1368
|
+
logger5.warn("Audit module is already initialized, reinitializing");
|
|
487
1369
|
currentRepo = null;
|
|
1370
|
+
currentWriter = null;
|
|
1371
|
+
capturePolicy = null;
|
|
488
1372
|
currentHelper = null;
|
|
1373
|
+
const closingBackup = currentBackup;
|
|
1374
|
+
currentBackup = null;
|
|
1375
|
+
const closingAlerts = currentAlerts;
|
|
1376
|
+
currentAlerts = null;
|
|
1377
|
+
await closingAlerts?.close();
|
|
1378
|
+
await closingBackup?.close();
|
|
1379
|
+
await Promise.allSettled([...inFlightWrites]);
|
|
489
1380
|
}
|
|
490
|
-
|
|
1381
|
+
logger5.info("Initializing audit module");
|
|
491
1382
|
const parseResult = AuditInitConfigSchema.safeParse(config ?? {});
|
|
492
1383
|
if (!parseResult.success) {
|
|
493
|
-
|
|
1384
|
+
logger5.error("Audit config validation failed", { error: parseResult.error.message });
|
|
494
1385
|
return err(
|
|
495
1386
|
HaiAuditError.CONFIG_ERROR,
|
|
496
1387
|
auditM("audit_configError", { params: { error: parseResult.error.message } }),
|
|
@@ -498,15 +1389,24 @@ var audit = {
|
|
|
498
1389
|
);
|
|
499
1390
|
}
|
|
500
1391
|
const parsed = parseResult.data;
|
|
1392
|
+
if (parsed.alerts.enabled && (!config?.reach?.isInitialized || parsed.alerts.rules.some((rule) => rule.targets.some((target) => !config.reach?.config?.providers.some((provider) => provider.name === target.provider)))))
|
|
1393
|
+
return err(HaiAuditError.CONFIG_ERROR, auditM("audit_alertReachRequired"));
|
|
1394
|
+
if (parsed.backup.enabled && !config?.storage?.isInitialized)
|
|
1395
|
+
return err(HaiAuditError.CONFIG_ERROR, auditM("audit_backupStorageRequired"));
|
|
1396
|
+
if (parsed.backup.enabled && config?.storage?.config?.type === "s3" && config.storage.config.publicUrl)
|
|
1397
|
+
return err(HaiAuditError.CONFIG_ERROR, auditM("audit_backupPrivateStorageRequired"));
|
|
501
1398
|
const identifierResult = validateIdentifiers([parsed.userTable, parsed.userIdColumn, parsed.userNameColumn]);
|
|
502
1399
|
if (!identifierResult.success) {
|
|
503
|
-
|
|
1400
|
+
logger5.error("Audit config contains invalid identifiers", { error: identifierResult.error.message });
|
|
504
1401
|
return err(
|
|
505
1402
|
HaiAuditError.CONFIG_ERROR,
|
|
506
1403
|
auditM("audit_configError", { params: { error: identifierResult.error.message } }),
|
|
507
1404
|
identifierResult.error
|
|
508
1405
|
);
|
|
509
1406
|
}
|
|
1407
|
+
const migrated = await migrateAudit();
|
|
1408
|
+
if (!migrated.success)
|
|
1409
|
+
return migrated;
|
|
510
1410
|
const candidate = new AuditLogRepository({
|
|
511
1411
|
userTable: parsed.userTable,
|
|
512
1412
|
userIdColumn: parsed.userIdColumn,
|
|
@@ -516,14 +1416,24 @@ var audit = {
|
|
|
516
1416
|
if (!ready.success) {
|
|
517
1417
|
return err(HaiAuditError.CONFIG_ERROR, auditM("audit_initFailed", { params: { error: ready.error.message } }), ready.error);
|
|
518
1418
|
}
|
|
1419
|
+
const protection = await migrateAudit();
|
|
1420
|
+
if (!protection.success)
|
|
1421
|
+
return protection;
|
|
1422
|
+
const configured = await configureAuditRetention(parsed.retention);
|
|
1423
|
+
if (!configured.success)
|
|
1424
|
+
return configured;
|
|
519
1425
|
if (generation !== lifecycleGeneration)
|
|
520
1426
|
return err(HaiAuditError.NOT_INITIALIZED, auditM("audit_notInitialized"));
|
|
521
1427
|
currentRepo = candidate;
|
|
1428
|
+
currentWriter = createAuditWriter(candidate, parsed);
|
|
1429
|
+
capturePolicy = parsed.capture;
|
|
522
1430
|
currentHelper = createHelper((input) => audit.log(input));
|
|
523
|
-
|
|
1431
|
+
currentBackup = createAuditBackup({ repository: candidate, config: parsed.backup, storage: config?.storage, capture: (input, options) => audit.capture(input, options) });
|
|
1432
|
+
currentAlerts = createAuditAlerts({ config: parsed.alerts, reach: config?.reach, log: currentWriter });
|
|
1433
|
+
logger5.info("Audit module initialized");
|
|
524
1434
|
return ok(void 0);
|
|
525
1435
|
} catch (error) {
|
|
526
|
-
|
|
1436
|
+
logger5.error("Audit module initialization failed", { error });
|
|
527
1437
|
return err(
|
|
528
1438
|
HaiAuditError.CONFIG_ERROR,
|
|
529
1439
|
auditM("audit_initFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
|
|
@@ -543,27 +1453,22 @@ var audit = {
|
|
|
543
1453
|
* @param input - 日志内容（action 和 resource 为必填）
|
|
544
1454
|
* @returns 成功时返回创建的 AuditLog；未初始化时返回 NOT_INITIALIZED
|
|
545
1455
|
*/
|
|
546
|
-
log(input) {
|
|
1456
|
+
log(input, tx) {
|
|
547
1457
|
if (!currentRepo) {
|
|
548
1458
|
return Promise.resolve(notInitialized.result());
|
|
549
1459
|
}
|
|
550
|
-
const
|
|
551
|
-
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
|
|
560
|
-
|
|
561
|
-
|
|
562
|
-
HaiAuditError.LOG_FAILED,
|
|
563
|
-
auditM("audit_invalidInput", { params: { field: "action/resource", reason: "exceeds max length" } })
|
|
564
|
-
));
|
|
565
|
-
}
|
|
566
|
-
return currentRepo.log(sanitizedInput);
|
|
1460
|
+
const operation = currentWriter(input, tx);
|
|
1461
|
+
inFlightWrites.add(operation);
|
|
1462
|
+
void operation.then(() => inFlightWrites.delete(operation), () => inFlightWrites.delete(operation));
|
|
1463
|
+
return operation;
|
|
1464
|
+
},
|
|
1465
|
+
async capture(input, options) {
|
|
1466
|
+
if (!currentRepo)
|
|
1467
|
+
return notInitialized.result();
|
|
1468
|
+
if (!capturePolicy?.enabled || options?.read && !capturePolicy.includeReads && (!input.outcome || input.outcome === "success"))
|
|
1469
|
+
return ok(void 0);
|
|
1470
|
+
const written = await audit.log(input, options?.tx);
|
|
1471
|
+
return written.success ? ok(void 0) : written;
|
|
567
1472
|
},
|
|
568
1473
|
/**
|
|
569
1474
|
* 分页查询审计日志列表（含用户名 LEFT JOIN）
|
|
@@ -575,6 +1480,8 @@ var audit = {
|
|
|
575
1480
|
if (!currentRepo) {
|
|
576
1481
|
return Promise.resolve(notInitialized.result());
|
|
577
1482
|
}
|
|
1483
|
+
if (!validAuditQuery(options))
|
|
1484
|
+
return Promise.resolve(err(HaiAuditError.QUERY_FAILED, auditM("audit_invalidInput", { params: { field: "query", reason: auditM("audit_queryInvalid") } })));
|
|
578
1485
|
if (options?.startDate && options?.endDate && options.startDate > options.endDate) {
|
|
579
1486
|
return Promise.resolve(err(
|
|
580
1487
|
HaiAuditError.QUERY_FAILED,
|
|
@@ -632,17 +1539,19 @@ var audit = {
|
|
|
632
1539
|
* @param days - 统计天数，默认 7
|
|
633
1540
|
* @returns 成功时返回 AuditStatItem 数组；未初始化时返回 NOT_INITIALIZED
|
|
634
1541
|
*/
|
|
635
|
-
getStats(days) {
|
|
1542
|
+
getStats(days, filters) {
|
|
636
1543
|
if (!currentRepo) {
|
|
637
1544
|
return Promise.resolve(notInitialized.result());
|
|
638
1545
|
}
|
|
1546
|
+
if (!validAuditQuery(filters))
|
|
1547
|
+
return Promise.resolve(err(HaiAuditError.STATS_FAILED, auditM("audit_invalidInput", { params: { field: "query", reason: auditM("audit_queryInvalid") } })));
|
|
639
1548
|
if (typeof days === "number" && (!Number.isInteger(days) || days < 0)) {
|
|
640
1549
|
return Promise.resolve(err(
|
|
641
1550
|
HaiAuditError.STATS_FAILED,
|
|
642
1551
|
auditM("audit_invalidInput", { params: { field: "days", reason: "must be a non-negative integer" } })
|
|
643
1552
|
));
|
|
644
1553
|
}
|
|
645
|
-
return currentRepo.getStats(days);
|
|
1554
|
+
return currentRepo.getStats(days, filters);
|
|
646
1555
|
},
|
|
647
1556
|
/**
|
|
648
1557
|
* 便捷记录器
|
|
@@ -655,23 +1564,50 @@ var audit = {
|
|
|
655
1564
|
}
|
|
656
1565
|
return currentHelper;
|
|
657
1566
|
},
|
|
1567
|
+
get backup() {
|
|
1568
|
+
return currentBackup?.operations ?? notInitializedBackup;
|
|
1569
|
+
},
|
|
1570
|
+
checkAlerts(options) {
|
|
1571
|
+
return currentAlerts ? currentAlerts.check(options) : Promise.resolve(notInitialized.result());
|
|
1572
|
+
},
|
|
1573
|
+
get schedulerPlan() {
|
|
1574
|
+
const backup = currentBackup?.schedule;
|
|
1575
|
+
const alerts = currentAlerts?.schedule;
|
|
1576
|
+
if (!backup && !alerts)
|
|
1577
|
+
return null;
|
|
1578
|
+
return {
|
|
1579
|
+
tasks: [...backup?.tasks ?? [], ...alerts?.tasks ?? []].map((task) => ({ ...task })),
|
|
1580
|
+
hooks: { onTaskExecute: async (input) => {
|
|
1581
|
+
if (input.context.taskId === "hai-audit-backup" && backup)
|
|
1582
|
+
return backup.hooks.onTaskExecute(input);
|
|
1583
|
+
if (input.context.taskId === "hai-audit-alerts" && alerts)
|
|
1584
|
+
return alerts.hooks.onTaskExecute(input);
|
|
1585
|
+
throw core.error.buildHaiErrorInst(HaiAuditError.CONFIG_ERROR, auditM("audit_unknownTask"));
|
|
1586
|
+
} }
|
|
1587
|
+
};
|
|
1588
|
+
},
|
|
658
1589
|
/**
|
|
659
1590
|
* 关闭审计模块，释放内部状态
|
|
660
1591
|
*/
|
|
661
1592
|
async close() {
|
|
662
1593
|
lifecycleGeneration++;
|
|
663
|
-
|
|
664
|
-
logger2.info("Audit module already closed, skipping");
|
|
665
|
-
return ok(void 0);
|
|
666
|
-
}
|
|
667
|
-
logger2.info("Closing audit module");
|
|
1594
|
+
logger5.info("Closing audit module");
|
|
668
1595
|
currentRepo = null;
|
|
1596
|
+
currentWriter = null;
|
|
1597
|
+
capturePolicy = null;
|
|
669
1598
|
currentHelper = null;
|
|
670
|
-
|
|
1599
|
+
const closingBackup = currentBackup;
|
|
1600
|
+
currentBackup = null;
|
|
1601
|
+
const closingAlerts = currentAlerts;
|
|
1602
|
+
currentAlerts = null;
|
|
1603
|
+
await closingAlerts?.close();
|
|
1604
|
+
await closingBackup?.close();
|
|
1605
|
+
await Promise.allSettled([...inFlightWrites]);
|
|
1606
|
+
logger5.info("Audit module closed");
|
|
671
1607
|
return ok(void 0);
|
|
672
1608
|
}
|
|
673
1609
|
};
|
|
674
1610
|
|
|
675
|
-
export { AuditInitConfigSchema, HaiAuditError, audit };
|
|
1611
|
+
export { AUDIT_BACKUP_PREFIX, AuditInitConfigSchema, HaiAuditError, audit, migrateAudit };
|
|
676
1612
|
//# sourceMappingURL=index.js.map
|
|
677
1613
|
//# sourceMappingURL=index.js.map
|