Struct AuditEntry 

pub struct AuditEntry {

    pub id: i64,
    pub created_at: i64,
    pub event: String,
    pub outcome: String,
    pub profile: String,
    pub actor_kind: String,
    pub actor_id: Option<String>,
    pub account_id: Option<String>,
    pub order_id: Option<String>,
    pub cert_serial: Option<String>,
    pub identifiers: Vec<String>,
    pub client_ip: Option<String>,
    pub client_ptr: Option<String>,
    pub user_agent: Option<String>,
    pub request_id: Option<String>,
    pub reason: Option<String>,
    pub detail: Option<String>,
}

One stored audit row.

event and actor_kind come back as the strings they were stored as rather than as AuditEvent/ActorKind: a CHECK constraint written before a future variant existed is exactly the thing that would make a read of an older database fail, and a listing that renders an unrecognised event name is a better outcome than one that refuses to load. AuditEntry::event parses it for the callers that want the enum.

Fields

id: i64

created_at: i64

event: String

outcome: String

profile: String

actor_kind: String

actor_id: Option<String>

account_id: Option<String>

order_id: Option<String>

cert_serial: Option<String>

identifiers: Vec<String>

client_ip: Option<String>

client_ptr: Option<String>

user_agent: Option<String>

request_id: Option<String>

reason: Option<String>

detail: Option<String>

Implementations

impl AuditEntry

pub fn event(&self) -> Option<AuditEvent>

The parsed event, or None for a value this build does not know — see the struct comment.

pub async fn insert( record: AuditRecord, database: &Database, ) -> Result<i64, Error>

Appends one row, returning its assigned id.

outcome is taken from AuditEvent::outcome rather than the caller, so the two columns cannot disagree — there is one definition of which events are failures and this is the only place it is read.

pub async fn find_by_id( id: i64, database: &Database, ) -> Result<Option<Self>, Error>

One row by id — what acme-proxy audit show <id> reads.

pub async fn search( query: &AuditQuery, database: &Database, ) -> Result<(Vec<Self>, i64), Error>

One page of rows matching query, newest first, plus the total the same predicate matches unpaged.

pub async fn count_older_than( cutoff: i64, database: &Database, ) -> Result<i64, Error>

How many rows are older than cutoff — what the purge prompt names before deleting anything.

pub async fn cleanup(cutoff: i64, database: &Database) -> Result<u64, Error>

Deletes every row older than cutoff, returning how many went.

The only statement in the crate that removes an audit row, and it takes an absolute cutoff rather than a duration so the CLI’s --older-than and the audit.retention_days sweep run the identical delete.

pub fn to_json(&self) -> Value

The JSON shape the admin API serves.

Absent members rather than null for the optional columns, the shape Account::to_json and Order::to_json already use: a consumer reading client_ip off a CLI-initiated revocation gets nothing, which is what happened.

Trait Implementations

impl Clone for AuditEntry

fn clone(&self) -> AuditEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.