systemprompt_security/authz/audit/
mod.rs

1//! Audit sink for authorization decisions.
2//!
3//! Every decision made *inside core* (webhook fault, default deny,
4//! unrestricted allow) flows through an [`AuthzAuditSink`] so it lands in the
5//! same `governance_decisions` table the extension's `POST /govern/authz`
6//! handler writes to. Successful webhook round-trips are audited by the
7//! extension itself (single writer per code path); core's sink only records
8//! decisions the extension never sees.
9//!
10//! [`NullAuditSink`] is the bootstrap default — it exists so unit tests and
11//! pre-database bootstrap stages can install hooks without a `DbPool`.
12//! Production replaces it with [`DbAuditSink`] once the database is available.
13
14mod db_sink;
15mod repository;
16
17use async_trait::async_trait;
18
19use super::types::{AuthzDecision, AuthzRequest};
20
21pub use db_sink::DbAuditSink;
22pub use repository::{
23    AUDIT_WRITE_FAILED_TOTAL, GovernanceDecisionRecord, GovernanceDecisionRepository,
24    insert_governance_decision,
25};
26
27#[derive(Debug, Clone, Copy, PartialEq, Eq)]
28pub enum AuthzSource {
29    WebhookFault,
30    DenyAllDefault,
31    AllowAllUnrestricted,
32}
33
34impl AuthzSource {
35    pub const fn policy(self) -> &'static str {
36        match self {
37            Self::WebhookFault => "authz_hook_fault",
38            Self::DenyAllDefault => "authz_default_deny",
39            Self::AllowAllUnrestricted => "authz_unrestricted",
40        }
41    }
42}
43
44/// `#[async_trait]`: this trait is consumed as `Arc<dyn AuthzAuditSink>` by
45/// every hook implementation, so it must be `dyn`-compatible — native
46/// `async fn` in traits is not yet object-safe.
47#[async_trait]
48pub trait AuthzAuditSink: Send + Sync + std::fmt::Debug {
49    async fn record(&self, req: &AuthzRequest, decision: &AuthzDecision, source: AuthzSource);
50}
51
52#[derive(Debug, Default, Clone, Copy)]
53pub struct NullAuditSink;
54
55#[async_trait]
56impl AuthzAuditSink for NullAuditSink {
57    async fn record(&self, _req: &AuthzRequest, _decision: &AuthzDecision, _source: AuthzSource) {}
58}
systemprompt_security/authz/audit/mod.rs

systemprompt_security/authz/audit/
mod.rs
