systemprompt_security/authz/audit/
mod.rs

1//! Audit sink for authorization decisions.
2//!
3//! Every decision made *inside core* (webhook fault, default deny,
4//! unrestricted allow) flows through an [`AuthzAuditSink`] so it lands in the
5//! same `governance_decisions` table the extension's `POST /govern/authz`
6//! handler writes to. Successful webhook round-trips are audited by the
7//! extension itself (single writer per code path); core's sink only records
8//! decisions the extension never sees.
9//!
10//! [`NullAuditSink`] is the bootstrap default — it exists so unit tests and
11//! pre-database bootstrap stages can install hooks without a `DbPool`.
12//! Production replaces it with [`DbAuditSink`] once the database is available.
13//!
14//! Copyright (c) systemprompt.io — Business Source License 1.1.
15//! See <https://systemprompt.io> for licensing details.
16
17mod db_sink;
18mod repository;
19
20use async_trait::async_trait;
21
22use super::types::{AuthzDecision, AuthzRequest};
23
24pub use db_sink::DbAuditSink;
25pub use repository::{
26    AUDIT_WRITE_FAILED_TOTAL, GovernanceDecisionRecord, GovernanceDecisionRepository,
27    insert_governance_decision,
28};
29
30#[derive(Debug, Clone, Copy, PartialEq, Eq)]
31pub enum AuthzSource {
32    WebhookFault,
33    DenyAllDefault,
34    AllowAllUnrestricted,
35    ExtensionHook,
36    RuleBased,
37}
38
39impl AuthzSource {
40    pub const fn policy(self) -> &'static str {
41        match self {
42            Self::WebhookFault => "authz_hook_fault",
43            Self::DenyAllDefault => "authz_default_deny",
44            Self::AllowAllUnrestricted => "authz_unrestricted",
45            Self::ExtensionHook => "authz_extension_hook",
46            Self::RuleBased => "authz_rule_based",
47        }
48    }
49}
50
51/// `#[async_trait]`: this trait is consumed as `Arc<dyn AuthzAuditSink>` by
52/// every hook implementation, so it must be `dyn`-compatible — native
53/// `async fn` in traits is not yet object-safe.
54#[async_trait]
55pub trait AuthzAuditSink: Send + Sync + std::fmt::Debug {
56    async fn record(&self, req: &AuthzRequest, decision: &AuthzDecision, source: AuthzSource);
57}
58
59#[derive(Debug, Default, Clone, Copy)]
60pub struct NullAuditSink;
61
62#[async_trait]
63impl AuthzAuditSink for NullAuditSink {
64    async fn record(&self, _req: &AuthzRequest, _decision: &AuthzDecision, _source: AuthzSource) {}
65}
systemprompt_security/authz/audit/mod.rs

systemprompt_security/authz/audit/
mod.rs
