astrid_audit/lib.rs
1//! Astrid Audit - Chain-linked cryptographic audit logging.
2//!
3//! This crate provides:
4//! - Cryptographically signed audit entries
5//! - Chain-linked entries (each contains hash of previous)
6//! - Persistent storage with `SurrealKV`
7//! - Chain integrity verification
8//!
9//! # Security Model
10//!
11//! Every audit entry is:
12//! - Signed by the runtime's ed25519 key
13//! - Linked to the previous entry via content hash
14//! - Timestamped
15//! - Indexed by session
16//!
17//! The chain linking provides tamper evidence - any modification
18//! to historical entries breaks the chain and is detectable.
19//!
20//! # Example
21//!
22//! ```
23//! use astrid_audit::{AuditLog, AuditAction, AuditOutcome, AuthorizationProof};
24//! use astrid_core::SessionId;
25//! use astrid_crypto::KeyPair;
26//!
27//! // Create an in-memory audit log
28//! let runtime_key = KeyPair::generate();
29//! let user_id = runtime_key.key_id();
30//! let log = AuditLog::in_memory(runtime_key);
31//!
32//! // Start a session
33//! let session_id = SessionId::new();
34//!
35//! // Record an action
36//! let entry_id = log.append(
37//! session_id.clone(),
38//! AuditAction::SessionStarted {
39//! user_id,
40//! platform: "cli".to_string(),
41//! },
42//! AuthorizationProof::System {
43//! reason: "session start".to_string(),
44//! },
45//! AuditOutcome::success(),
46//! ).unwrap();
47//!
48//! // Verify chain integrity
49//! let result = log.verify_chain(&session_id).unwrap();
50//! assert!(result.valid);
51//! ```
52
53#![deny(unsafe_code)]
54#![deny(missing_docs)]
55#![deny(clippy::all)]
56#![deny(unreachable_pub)]
57#![deny(clippy::unwrap_used)]
58#![cfg_attr(test, allow(clippy::unwrap_used))]
59
60pub mod prelude;
61
62mod entry;
63mod error;
64mod log;
65mod storage;
66
67pub use entry::{ApprovalScope, AuditAction, AuditEntry, AuditOutcome, AuthorizationProof};
68pub use error::{AuditError, AuditResult};
69pub use log::{AuditLog, ChainIssue, ChainVerificationResult};
70
71// Re-export AuditEntryId from capabilities for convenience
72pub use astrid_capabilities::AuditEntryId;