Enum AuditEvent 

#[non_exhaustive]
pub enum AuditEvent<'a> {
    ConnectionEstablished {
        remote_identity: &'a IdentityFingerprint,
        remote_name: Option<&'a str>,
        connection_type: AuditConnectionType,
    },
    SessionRefreshed {
        remote_identity: &'a IdentityFingerprint,
    },
    ConnectionRejected {
        remote_identity: &'a IdentityFingerprint,
    },
    CredentialRequested {
        query: &'a CredentialQuery,
        remote_identity: &'a IdentityFingerprint,
        request_id: &'a str,
    },
    CredentialApproved {
        query: &'a CredentialQuery,
        domain: Option<&'a str>,
        remote_identity: &'a IdentityFingerprint,
        request_id: &'a str,
        credential_id: Option<&'a str>,
        fields: CredentialFieldSet,
    },
    CredentialDenied {
        query: &'a CredentialQuery,
        domain: Option<&'a str>,
        remote_identity: &'a IdentityFingerprint,
        request_id: &'a str,
        credential_id: Option<&'a str>,
    },
}

Audit events emitted by the [UserClient] (trusted device) for security-relevant actions.

Each variant represents a discrete, auditable action in the access protocol. Implementations of AuditLog receive these events and can persist them to files, databases, or external services.

Field conventions

• remote_identity — the IdentityFingerprint of the remote (untrusted) device. This is a stable 32-byte identifier derived from the device’s persistent public key.
• remote_name — optional human-friendly label assigned by the user when pairing (e.g., “Work Laptop”). Only available on connection events.
• request_id — unique per-request correlation token generated by the remote client. Use this to correlate CredentialRequested → CredentialApproved/CredentialDenied.
• query — the CredentialQuery that triggered the lookup.
• domain — the credential’s domain (from the matched vault item), if available.

This enum is #[non_exhaustive] — new variants may be added in future versions. Implementations should include a _ => {} catch-all arm when matching.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

ConnectionEstablished

A new remote device completed the Noise handshake and was accepted as trusted.

Emitted once per new pairing, after the session is cached. For rendezvous connections, this fires only after the user has explicitly approved the fingerprint verification. For PSK connections, trust is implicit via the shared secret.

Fields

remote_identity: &'a IdentityFingerprint

remote_name: Option<&'a str>

connection_type: AuditConnectionType

SessionRefreshed

A previously-paired device reconnected and refreshed its transport keys.

This is a routine reconnection of an already-trusted device — no user approval is needed. The Noise handshake runs again to derive fresh encryption keys, but the device was already verified during the original pairing.

Fields

remote_identity: &'a IdentityFingerprint

ConnectionRejected

A new connection attempt was rejected during fingerprint verification.

The user was shown the handshake fingerprint and chose to reject it, meaning the remote device was not added to the trusted session cache. Only applies to rendezvous connections (PSK connections skip verification).

Fields

remote_identity: &'a IdentityFingerprint

CredentialRequested

A remote device sent a request for credentials.

Emitted when the encrypted request is received and decrypted. At this point the request is pending user approval — no credential data has been shared yet.

Fields

query: &'a CredentialQuery

remote_identity: &'a IdentityFingerprint

request_id: &'a str

CredentialApproved

A credential request was approved and the credential was sent to the remote device.

The fields indicate which credential fields were included (e.g., username, password, TOTP) without revealing the actual values.

Fields

query: &'a CredentialQuery

domain: Option<&'a str>

remote_identity: &'a IdentityFingerprint

request_id: &'a str

credential_id: Option<&'a str>

fields: CredentialFieldSet

CredentialDenied

A credential request was denied by the user.

No credential data was sent to the remote device.

Fields

query: &'a CredentialQuery

domain: Option<&'a str>

remote_identity: &'a IdentityFingerprint

request_id: &'a str

credential_id: Option<&'a str>

Trait Implementations

impl<'a> Clone for AuditEvent<'a>

fn clone(&self) -> AuditEvent<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for AuditEvent<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.