Struct EventQuery 

pub struct EventQuery {
    pub kinds: Vec<EventKind>,
    pub action_id: Option<String>,
    pub proposal_id: Option<String>,
    pub since: Option<DateTime<Utc>>,
    pub until: Option<DateTime<Utc>>,
    pub data_matches: HashMap<String, String>,
    pub limit: Option<usize>,
}

A structured audit query over the event log (EPIC G / G2). Every field is an AND-conjoined filter; empty/None fields don’t constrain. Answers “who ran what tool when, and which approvals applied” by filtering the SessionScope / PermissionDecision / ApprovalRecorded / action trail.

The multi-word fields also accept the camelCase spellings index.d.ts documented (actionId, proposalId, dataMatches). Unknown keys are ignored, so before the aliases a camelCase filter silently matched every event (car#3395).

Fields

kinds: Vec<EventKind>

Restrict to these event kinds (empty = any kind).

action_id: Option<String>

Exact match on action_id.

proposal_id: Option<String>

Exact match on proposal_id.

since: Option<DateTime<Utc>>

Inclusive lower time bound.

until: Option<DateTime<Utc>>

Exclusive upper time bound.

data_matches: HashMap<String, String>

Match events whose data contains ALL these key→value pairs (compared as strings). Covers caller/tenant/tool/gate/decision, which live in data on the audit events.

limit: Option<usize>

Cap the number of results (most-recent-first). None/0 = unlimited.

Implementations

impl EventQuery

pub fn matches(&self, e: &Event) -> bool

Does e satisfy every constraint in this query?

Trait Implementations

impl Clone for EventQuery

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EventQuery

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EventQuery

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for EventQuery

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for EventQuery

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.