@objectstack/spec 0.3.0 → 0.3.1

package/json-schema/system/AuditConfig.json

@@ -0,0 +1,587 @@
+{
+  "$ref": "#/definitions/AuditConfig",
+  "definitions": {
+    "AuditConfig": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z_][a-z0-9_]*$",
+          "maxLength": 64,
+          "description": "Configuration name (snake_case, max 64 chars)"
+        },
+        "label": {
+          "type": "string",
+          "description": "Display label"
+        },
+        "enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Enable audit logging"
+        },
+        "eventTypes": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "data.create",
+              "data.read",
+              "data.update",
+              "data.delete",
+              "data.export",
+              "data.import",
+              "data.bulk_update",
+              "data.bulk_delete",
+              "auth.login",
+              "auth.login_failed",
+              "auth.logout",
+              "auth.session_created",
+              "auth.session_expired",
+              "auth.password_reset",
+              "auth.password_changed",
+              "auth.email_verified",
+              "auth.mfa_enabled",
+              "auth.mfa_disabled",
+              "auth.account_locked",
+              "auth.account_unlocked",
+              "authz.permission_granted",
+              "authz.permission_revoked",
+              "authz.role_assigned",
+              "authz.role_removed",
+              "authz.role_created",
+              "authz.role_updated",
+              "authz.role_deleted",
+              "authz.policy_created",
+              "authz.policy_updated",
+              "authz.policy_deleted",
+              "system.config_changed",
+              "system.plugin_installed",
+              "system.plugin_uninstalled",
+              "system.backup_created",
+              "system.backup_restored",
+              "system.integration_added",
+              "system.integration_removed",
+              "security.access_denied",
+              "security.suspicious_activity",
+              "security.data_breach",
+              "security.api_key_created",
+              "security.api_key_revoked"
+            ]
+          },
+          "description": "Event types to audit"
+        },
+        "excludeEventTypes": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "data.create",
+              "data.read",
+              "data.update",
+              "data.delete",
+              "data.export",
+              "data.import",
+              "data.bulk_update",
+              "data.bulk_delete",
+              "auth.login",
+              "auth.login_failed",
+              "auth.logout",
+              "auth.session_created",
+              "auth.session_expired",
+              "auth.password_reset",
+              "auth.password_changed",
+              "auth.email_verified",
+              "auth.mfa_enabled",
+              "auth.mfa_disabled",
+              "auth.account_locked",
+              "auth.account_unlocked",
+              "authz.permission_granted",
+              "authz.permission_revoked",
+              "authz.role_assigned",
+              "authz.role_removed",
+              "authz.role_created",
+              "authz.role_updated",
+              "authz.role_deleted",
+              "authz.policy_created",
+              "authz.policy_updated",
+              "authz.policy_deleted",
+              "system.config_changed",
+              "system.plugin_installed",
+              "system.plugin_uninstalled",
+              "system.backup_created",
+              "system.backup_restored",
+              "system.integration_added",
+              "system.integration_removed",
+              "security.access_denied",
+              "security.suspicious_activity",
+              "security.data_breach",
+              "security.api_key_created",
+              "security.api_key_revoked"
+            ]
+          },
+          "description": "Event types to exclude"
+        },
+        "minimumSeverity": {
+          "type": "string",
+          "enum": [
+            "debug",
+            "info",
+            "notice",
+            "warning",
+            "error",
+            "critical",
+            "alert",
+            "emergency"
+          ],
+          "default": "info",
+          "description": "Minimum severity level"
+        },
+        "storage": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "database",
+                "elasticsearch",
+                "mongodb",
+                "clickhouse",
+                "s3",
+                "gcs",
+                "azure_blob",
+                "custom"
+              ],
+              "description": "Storage backend type"
+            },
+            "connectionString": {
+              "type": "string",
+              "description": "Connection string"
+            },
+            "config": {
+              "type": "object",
+              "additionalProperties": {},
+              "description": "Storage-specific configuration"
+            },
+            "bufferEnabled": {
+              "type": "boolean",
+              "default": true,
+              "description": "Enable buffering"
+            },
+            "bufferSize": {
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "default": 100,
+              "description": "Buffer size"
+            },
+            "flushIntervalSeconds": {
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "default": 5,
+              "description": "Flush interval in seconds"
+            },
+            "compression": {
+              "type": "boolean",
+              "default": true,
+              "description": "Enable compression"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "additionalProperties": false,
+          "description": "Storage configuration"
+        },
+        "retentionPolicy": {
+          "type": "object",
+          "properties": {
+            "retentionDays": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 180,
+              "description": "Retention period in days"
+            },
+            "archiveAfterRetention": {
+              "type": "boolean",
+              "default": true,
+              "description": "Archive logs after retention period"
+            },
+            "archiveStorage": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "enum": [
+                    "s3",
+                    "gcs",
+                    "azure_blob",
+                    "filesystem"
+                  ],
+                  "description": "Archive storage type"
+                },
+                "endpoint": {
+                  "type": "string",
+                  "description": "Storage endpoint URL"
+                },
+                "bucket": {
+                  "type": "string",
+                  "description": "Storage bucket/container name"
+                },
+                "path": {
+                  "type": "string",
+                  "description": "Storage path prefix"
+                },
+                "credentials": {
+                  "type": "object",
+                  "additionalProperties": {},
+                  "description": "Storage credentials"
+                }
+              },
+              "required": [
+                "type"
+              ],
+              "additionalProperties": false,
+              "description": "Archive storage configuration"
+            },
+            "customRetention": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "integer",
+                "exclusiveMinimum": 0
+              },
+              "description": "Custom retention by event type"
+            },
+            "minimumRetentionDays": {
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "description": "Minimum retention for compliance"
+            }
+          },
+          "additionalProperties": false,
+          "default": {},
+          "description": "Retention policy"
+        },
+        "suspiciousActivityRules": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "description": "Rule identifier"
+              },
+              "name": {
+                "type": "string",
+                "description": "Rule name"
+              },
+              "description": {
+                "type": "string",
+                "description": "Rule description"
+              },
+              "enabled": {
+                "type": "boolean",
+                "default": true,
+                "description": "Rule enabled status"
+              },
+              "eventTypes": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "data.create",
+                    "data.read",
+                    "data.update",
+                    "data.delete",
+                    "data.export",
+                    "data.import",
+                    "data.bulk_update",
+                    "data.bulk_delete",
+                    "auth.login",
+                    "auth.login_failed",
+                    "auth.logout",
+                    "auth.session_created",
+                    "auth.session_expired",
+                    "auth.password_reset",
+                    "auth.password_changed",
+                    "auth.email_verified",
+                    "auth.mfa_enabled",
+                    "auth.mfa_disabled",
+                    "auth.account_locked",
+                    "auth.account_unlocked",
+                    "authz.permission_granted",
+                    "authz.permission_revoked",
+                    "authz.role_assigned",
+                    "authz.role_removed",
+                    "authz.role_created",
+                    "authz.role_updated",
+                    "authz.role_deleted",
+                    "authz.policy_created",
+                    "authz.policy_updated",
+                    "authz.policy_deleted",
+                    "system.config_changed",
+                    "system.plugin_installed",
+                    "system.plugin_uninstalled",
+                    "system.backup_created",
+                    "system.backup_restored",
+                    "system.integration_added",
+                    "system.integration_removed",
+                    "security.access_denied",
+                    "security.suspicious_activity",
+                    "security.data_breach",
+                    "security.api_key_created",
+                    "security.api_key_revoked"
+                  ]
+                },
+                "description": "Event types to monitor"
+              },
+              "condition": {
+                "type": "object",
+                "properties": {
+                  "threshold": {
+                    "type": "integer",
+                    "exclusiveMinimum": 0,
+                    "description": "Event threshold"
+                  },
+                  "windowSeconds": {
+                    "type": "integer",
+                    "exclusiveMinimum": 0,
+                    "description": "Time window in seconds"
+                  },
+                  "groupBy": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Grouping criteria"
+                  },
+                  "filters": {
+                    "type": "object",
+                    "additionalProperties": {},
+                    "description": "Additional filters"
+                  }
+                },
+                "required": [
+                  "threshold",
+                  "windowSeconds"
+                ],
+                "additionalProperties": false,
+                "description": "Detection condition"
+              },
+              "actions": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "alert",
+                    "lock_account",
+                    "block_ip",
+                    "require_mfa",
+                    "log_critical",
+                    "webhook"
+                  ]
+                },
+                "description": "Actions to take"
+              },
+              "alertSeverity": {
+                "type": "string",
+                "enum": [
+                  "debug",
+                  "info",
+                  "notice",
+                  "warning",
+                  "error",
+                  "critical",
+                  "alert",
+                  "emergency"
+                ],
+                "default": "warning",
+                "description": "Alert severity"
+              },
+              "notifications": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "format": "email"
+                    },
+                    "description": "Email recipients"
+                  },
+                  "slack": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "Slack webhook URL"
+                  },
+                  "webhook": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "Custom webhook URL"
+                  }
+                },
+                "additionalProperties": false,
+                "description": "Notification configuration"
+              }
+            },
+            "required": [
+              "id",
+              "name",
+              "eventTypes",
+              "condition",
+              "actions"
+            ],
+            "additionalProperties": false
+          },
+          "default": [],
+          "description": "Suspicious activity rules"
+        },
+        "includeSensitiveData": {
+          "type": "boolean",
+          "default": false,
+          "description": "Include sensitive data"
+        },
+        "redactFields": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "default": [
+            "password",
+            "passwordHash",
+            "token",
+            "apiKey",
+            "secret",
+            "creditCard",
+            "ssn"
+          ],
+          "description": "Fields to redact"
+        },
+        "logReads": {
+          "type": "boolean",
+          "default": false,
+          "description": "Log read operations"
+        },
+        "readSamplingRate": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "default": 0.1,
+          "description": "Read sampling rate"
+        },
+        "logSystemEvents": {
+          "type": "boolean",
+          "default": true,
+          "description": "Log system events"
+        },
+        "customHandlers": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "eventType": {
+                "type": "string",
+                "enum": [
+                  "data.create",
+                  "data.read",
+                  "data.update",
+                  "data.delete",
+                  "data.export",
+                  "data.import",
+                  "data.bulk_update",
+                  "data.bulk_delete",
+                  "auth.login",
+                  "auth.login_failed",
+                  "auth.logout",
+                  "auth.session_created",
+                  "auth.session_expired",
+                  "auth.password_reset",
+                  "auth.password_changed",
+                  "auth.email_verified",
+                  "auth.mfa_enabled",
+                  "auth.mfa_disabled",
+                  "auth.account_locked",
+                  "auth.account_unlocked",
+                  "authz.permission_granted",
+                  "authz.permission_revoked",
+                  "authz.role_assigned",
+                  "authz.role_removed",
+                  "authz.role_created",
+                  "authz.role_updated",
+                  "authz.role_deleted",
+                  "authz.policy_created",
+                  "authz.policy_updated",
+                  "authz.policy_deleted",
+                  "system.config_changed",
+                  "system.plugin_installed",
+                  "system.plugin_uninstalled",
+                  "system.backup_created",
+                  "system.backup_restored",
+                  "system.integration_added",
+                  "system.integration_removed",
+                  "security.access_denied",
+                  "security.suspicious_activity",
+                  "security.data_breach",
+                  "security.api_key_created",
+                  "security.api_key_revoked"
+                ],
+                "description": "Event type to handle"
+              },
+              "handlerId": {
+                "type": "string",
+                "description": "Unique identifier for the handler"
+              }
+            },
+            "required": [
+              "eventType",
+              "handlerId"
+            ],
+            "additionalProperties": false
+          },
+          "description": "Custom event handler references"
+        },
+        "compliance": {
+          "type": "object",
+          "properties": {
+            "standards": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "sox",
+                  "hipaa",
+                  "gdpr",
+                  "pci_dss",
+                  "iso_27001",
+                  "fedramp"
+                ]
+              },
+              "description": "Compliance standards"
+            },
+            "immutableLogs": {
+              "type": "boolean",
+              "default": true,
+              "description": "Enforce immutable logs"
+            },
+            "requireSigning": {
+              "type": "boolean",
+              "default": false,
+              "description": "Require log signing"
+            },
+            "signingKey": {
+              "type": "string",
+              "description": "Signing key"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Compliance configuration"
+        }
+      },
+      "required": [
+        "name",
+        "label",
+        "storage"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}