@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/privacy/findings/evidence-query-string.json

@@ -0,0 +1,29 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b07-1111-7222-8333-000000000007",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "https://records.example.com/evidence/9921?signature=SYNTHETICFIXTUREVALUE&expires=1780000000"
+    }
+  ]
+}

package/examples/privacy/findings/high-entropy-token.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b09-1111-7222-8333-000000000009",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "integrationHandle": "Zq7Z9dK2mR4xT6vB8nH1jL3pW5sY0cF2gJ4kM6"
+  }
+}

package/examples/privacy/findings/jwt-token.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b04-1111-7222-8333-000000000004",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "upstreamAssertion": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzeW50aGV0aWMtZml4dHVyZSIsIm5vdGUiOiJub24tZnVuY3Rpb25hbCBleGFtcGxlIiwiaWF0IjoxNzgwMDAwMDAwfQ.c3ludGhldGljLXNpZ25hdHVyZS1ub3QtdmFsaWQ"
+  }
+}

package/examples/privacy/findings/oversized-change-before.json

@@ -0,0 +1,89 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b10-1111-7222-8333-000000000010",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "change": {
+    "type": "update",
+    "before": {
+      "recordType": "customer-order",
+      "field01": "value-1",
+      "field02": "value-2",
+      "field03": "value-3",
+      "field04": "value-4",
+      "field05": "value-5",
+      "field06": "value-6",
+      "field07": "value-7",
+      "field08": "value-8",
+      "field09": "value-9",
+      "field10": "value-10",
+      "field11": "value-11",
+      "field12": "value-12",
+      "field13": "value-13",
+      "field14": "value-14",
+      "field15": "value-15",
+      "field16": "value-16",
+      "field17": "value-17",
+      "field18": "value-18",
+      "field19": "value-19",
+      "field20": "value-20",
+      "field21": "value-21",
+      "field22": "value-22",
+      "field23": "value-23",
+      "field24": "value-24",
+      "field25": "value-25",
+      "field26": "value-26",
+      "field27": "value-27",
+      "field28": "value-28",
+      "field29": "value-29",
+      "field30": "value-30",
+      "field31": "value-31",
+      "field32": "value-32",
+      "field33": "value-33",
+      "field34": "value-34",
+      "field35": "value-35",
+      "field36": "value-36",
+      "field37": "value-37",
+      "field38": "value-38",
+      "field39": "value-39",
+      "field40": "value-40",
+      "field41": "value-41",
+      "field42": "value-42",
+      "field43": "value-43",
+      "field44": "value-44",
+      "field45": "value-45",
+      "field46": "value-46",
+      "field47": "value-47",
+      "field48": "value-48",
+      "field49": "value-49",
+      "field50": "value-50",
+      "field51": "value-51",
+      "field52": "value-52",
+      "field53": "value-53",
+      "field54": "value-54",
+      "field55": "value-55",
+      "field56": "value-56",
+      "field57": "value-57",
+      "field58": "value-58",
+      "field59": "value-59",
+      "field60": "value-60"
+    }
+  }
+}

package/examples/privacy/findings/password-field.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b01-1111-7222-8333-000000000001",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "migrationSource": "legacy-directory",
+    "password": "synthetic-fixture-value-not-a-real-password"
+  }
+}

package/examples/privacy/findings/private-key.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b05-1111-7222-8333-000000000005",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "attachedPem": "-----BEGIN PRIVATE KEY-----\nSYNTHETIC FIXTURE CONTENT, NOT A REAL KEY\n-----END PRIVATE KEY-----"
+  }
+}

package/examples/privacy/findings/raw-response-body.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b11-1111-7222-8333-000000000011",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "responseBody": "{\"customerId\":\"customer-4471\",\"balance\":10250,\"tier\":\"gold\"}"
+  }
+}

package/examples/privacy/findings/url-userinfo.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b06-1111-7222-8333-000000000006",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "exportLocation": "https://synthetic-user:synthetic-password@files.example.com/exports/4471"
+  }
+}

package/examples/profiles/api-and-integration-management/README.md

@@ -0,0 +1,119 @@
+# API and integration management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[api-and-integration-management profile](../../../profiles/api-and-integration-management/). The
+rules themselves are in
+[profile.json](../../../profiles/api-and-integration-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/api-and-integration-management/valid --profile api-and-integration-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/api-and-integration-management/valid
+auditmodel lint-privacy  examples/profiles/api-and-integration-management/valid
+auditmodel check-profile examples/profiles/api-and-integration-management/valid --profile api-and-integration-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile about
+API credentials that accepted an event carrying one would be worse than no profile.
+
+## Valid fixtures
+
+| File                                    | Event                              | Demonstrates                                                       |
+| --------------------------------------- | ---------------------------------- | ------------------------------------------------------------------ |
+| `api-key-create.json`                   | `api-key.create`                   | Issuance by a person: authentication context, scope and expiry     |
+| `api-key-rotate.json`                   | `api-key.rotate`                   | Machine rotation — `actor.type` is `service`, so no session is due |
+| `api-key-revoke.json`                   | `api-key.revoke`                   | Withdrawal with a justification and a recorded approval            |
+| `webhook-create.json`                   | `webhook.create`                   | A destination classified, not a callback URL recorded              |
+| `webhook-update.json`                   | `webhook.update`                   | Reconfiguration carrying `/change` and changed field names         |
+| `webhook-disable.json`                  | `webhook.disable`                  | Disablement during an outage, justified                            |
+| `webhook-test.json`                     | `webhook.test`                     | A connectivity check — governed, but nothing is withdrawn          |
+| `integration-connect.json`              | `integration.connect`              | Locally declared approval requirement, satisfied                   |
+| `integration-disconnect.json`           | `integration.disconnect`           | An `admin` actor, exercising the second authentication rule        |
+| `integration-configuration-update.json` | `integration.configuration.update` | A prefix-selected settings change carrying `/change`               |
+| `integration-sync-start.json`           | `integration.sync.start`           | A workflow step carrying the correlation identifier                |
+| `integration-sync-cancel.json`          | `integration.sync.cancel`          | Manual override of a running sync, justified                       |
+| `integration-reauthorize-failure.json`  | `integration.reauthorize`          | A failure classified beyond its code                               |
+
+Three of these — `api-key-rotate.json`, `webhook-test.json` and `integration-sync-start.json` —
+produce an `INTEGRATION-CORE-002` **warning** for a missing `/approval`. That is intentional: a
+scheduled rotation, a connectivity check and a nightly sync have no approval to record, and the
+profile recommends rather than requires one. A warning never fails conformance.
+
+The other ten record `approval: { "status": "not-required" }` or a real approval. That is the
+recommended shape: it answers the reviewer's question instead of leaving a hole where the answer
+would be.
+
+## Invalid fixtures
+
+Each removes exactly one profile-required value from a valid fixture, so it fails for one documented
+reason. A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                                          | Violates                 | At                                          |
+| ------------------------------------------------------------- | ------------------------ | ------------------------------------------- |
+| `api-key-create-missing-authorization.json`                   | `INTEGRATION-CORE-001`   | `/authorization`                            |
+| `webhook-create-missing-type.json`                            | `INTEGRATION-CORE-001`   | `/metadata/integration/type`                |
+| `integration-connect-missing-approval-status.json`            | `INTEGRATION-CORE-003`   | `/approval/status`                          |
+| `api-key-create-missing-authentication.json`                  | `INTEGRATION-AUTHN-001`  | `/authentication`                           |
+| `integration-disconnect-missing-authentication.json`          | `INTEGRATION-AUTHN-002`  | `/authentication`                           |
+| `api-key-rotate-missing-credential-reference.json`            | `INTEGRATION-KEY-001`    | `/metadata/integration/credentialReference` |
+| `webhook-disable-missing-reason.json`                         | `INTEGRATION-REVOKE-001` | `/reason`                                   |
+| `webhook-create-missing-endpoint-class.json`                  | `INTEGRATION-HOOK-001`   | `/metadata/integration/endpointClass`       |
+| `webhook-update-missing-change.json`                          | `INTEGRATION-CONFIG-001` | `/change`                                   |
+| `integration-configuration-update-missing-connection-id.json` | `INTEGRATION-CONN-001`   | `/metadata/integration/connectionId`        |
+| `integration-sync-start-missing-correlation-id.json`          | `INTEGRATION-FLOW-001`   | `/request/correlationId`                    |
+| `integration-reauthorize-missing-error-type.json`             | `INTEGRATION-FAIL-001`   | `/event/error/type`                         |
+
+Two of these are worth reading closely.
+
+`integration-connect-missing-approval-status.json` keeps the `/approval` object and removes only its
+`status`. Deleting the whole object would fail two required paths and the fixture would stop showing
+which one it tests.
+
+`api-key-create-missing-authentication.json` and `integration-disconnect-missing-authentication.json`
+remove the same field and fail different rules. The first has `actor.type: "user"` and fails
+`INTEGRATION-AUTHN-001`; the second has `actor.type: "admin"` and fails `INTEGRATION-AUTHN-002`. The
+two rules exist separately because the v0.1 rule language allows one equality condition per rule and
+no disjunction, and this pair is what keeps both halves of that workaround honest.
+
+Several invalid fixtures also produce warnings — `webhook-update-missing-change.json` loses its
+recommended `changedFields` along with `/change`, and `webhook-disable-missing-reason.json` trips
+both the requirement and the recommendation for `/reason`. Warnings are not violations, and the test
+counts only errors.
+
+## Not-applicable fixtures
+
+| File                             | Event                       | Why it is not governed                           |
+| -------------------------------- | --------------------------- | ------------------------------------------------ |
+| `api-request.json`               | `api.request`               | An ordinary data-plane API call                  |
+| `webhook-delivery.json`          | `webhook.delivery.attempt`  | A successful delivery, including any retry of it |
+| `integration-sync-progress.json` | `integration.sync.progress` | A per-page progress event from a polling sync    |
+
+`check-profile` reports each with exit code 3.
+
+These exist to hold the exclusion in place. Every selector in the profile is an exact event name or
+the single narrow prefix `integration.configuration.`; if a future edit widened one to a bare
+`api-key.`, `webhook.` or `integration.` prefix, these fixtures would start conforming instead of
+being skipped, and the test would fail — which is the point, because that edit would silently impose
+an authorization decision and an integration classification on every request, delivery and poll in a
+deployment.
+
+## Vendor neutrality
+
+No fixture names a real product, company, jurisdiction or regulation. Providers are logical
+placeholders (`partner-billing-platform`, `partner-crm-platform`, `partner-logistics-platform`),
+policies and integration types are illustrative strings, and no identifier resolves to anything.
+
+No fixture contains an API key, an access or refresh token, a client secret, a webhook signing
+secret, an authorization header or a callback URL — not even a fake one. `credentialReference` values
+are opaque handles, and destinations appear only as an `endpointClass`. That is the shape the profile
+exists to encourage, so the examples have to show it.

package/examples/profiles/api-and-integration-management/invalid/api-key-create-missing-authentication.json

@@ -0,0 +1,64 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0001-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-08T09:12:44.180Z",
+  "event": {
+    "name": "api-key.create",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Scoped API key issued to a partner billing integration."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "api-key",
+    "id": "api-key-4471",
+    "name": "partner-billing-reader",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "integration-credential-issuance",
+    "policyVersion": "9"
+  },
+  "request": {
+    "requestId": "request-b31d704",
+    "correlationId": "integration-onboarding-4102"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "integration-change-workflow"
+  },
+  "reason": {
+    "code": "partner-onboarding",
+    "text": "Partner billing reconciliation requires read access to settlement records.",
+    "reference": "change-10412"
+  },
+  "controlCategories": ["credential-lifecycle", "third-party-access"],
+  "metadata": {
+    "integration": {
+      "type": "api-credential",
+      "provider": "partner-billing-platform",
+      "credentialReference": "credential-ref-8814",
+      "scope": "settlements-read",
+      "expiresAt": "2026-10-08T09:12:44Z",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/api-and-integration-management/invalid/api-key-create-missing-authorization.json

@@ -0,0 +1,64 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0001-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-08T09:12:44.180Z",
+  "event": {
+    "name": "api-key.create",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Scoped API key issued to a partner billing integration."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "api-key",
+    "id": "api-key-4471",
+    "name": "partner-billing-reader",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "sessionId": "session-6641"
+  },
+  "request": {
+    "requestId": "request-b31d704",
+    "correlationId": "integration-onboarding-4102"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "integration-change-workflow"
+  },
+  "reason": {
+    "code": "partner-onboarding",
+    "text": "Partner billing reconciliation requires read access to settlement records.",
+    "reference": "change-10412"
+  },
+  "controlCategories": ["credential-lifecycle", "third-party-access"],
+  "metadata": {
+    "integration": {
+      "type": "api-credential",
+      "provider": "partner-billing-platform",
+      "credentialReference": "credential-ref-8814",
+      "scope": "settlements-read",
+      "expiresAt": "2026-10-08T09:12:44Z",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/api-and-integration-management/invalid/api-key-rotate-missing-credential-reference.json

@@ -0,0 +1,58 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0002-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-09T02:00:03.940Z",
+  "event": {
+    "name": "api-key.rotate",
+    "category": "security",
+    "type": "rotate",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Scheduled rotation of a partner integration credential."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-credential-rotation-worker"
+  },
+  "resource": {
+    "type": "api-key",
+    "id": "api-key-4471",
+    "name": "partner-billing-reader",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "component": "credential-rotation"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "integration-credential-rotation",
+    "policyVersion": "9"
+  },
+  "request": {
+    "requestId": "request-b31d922",
+    "correlationId": "credential-rotation-4471"
+  },
+  "reason": {
+    "code": "scheduled-rotation",
+    "text": "Automatic rotation at the end of the credential lifetime."
+  },
+  "controlCategories": ["credential-lifecycle"],
+  "metadata": {
+    "integration": {
+      "type": "api-credential",
+      "provider": "partner-billing-platform",
+      "scope": "settlements-read",
+      "expiresAt": "2026-10-09T02:00:03Z",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/api-and-integration-management/invalid/integration-configuration-update-missing-connection-id.json

@@ -0,0 +1,67 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0010-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-17T15:36:09.402Z",
+  "event": {
+    "name": "integration.configuration.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Field mapping and sync direction changed on a connector."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "integration",
+    "id": "connection-3312",
+    "name": "customer-records-connector",
+    "classification": "confidential",
+    "ownerId": "team-revenue",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "third-party-connection-policy",
+    "policyVersion": "5"
+  },
+  "request": {
+    "requestId": "request-b31ed40",
+    "correlationId": "connection-tuning-3312"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "integration-change-workflow"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["syncDirection", "fieldMapping"],
+    "ticketId": "change-10544"
+  },
+  "reason": {
+    "code": "scope-reduction",
+    "text": "Synchronization narrowed to one direction after a data review.",
+    "reference": "change-10544"
+  },
+  "controlCategories": ["third-party-access", "change-approval"],
+  "metadata": {
+    "integration": {
+      "type": "service-connector",
+      "provider": "partner-crm-platform",
+      "endpointClass": "partner-network",
+      "approvalRequired": false
+    }
+  }
+}