feat(audit): expose authorized browsing and scoped verification - #150
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add protected audit status, event browsing and scoped chain verification endpoints under
/api/v1/forge/audit, closing #149. Platform administrators can inspect the deployment-wide audit store, page through a fixed sequence snapshot and request bounded integrity checks with explicit valid, broken, incomplete or unavailable outcomes.The routes reuse acton-service 0.42.0's active storage handle and bounded query/verification contract, including the suffix anchoring fix from 0.40.1 and a measured timestamp-precision fix for newly sealed events. Event responses expose an approved eight-field projection with UUIDv7-backed
mtiaudit TypeIDs. Historical UUID IDs preserve their original bits and hashes. The dependency also fixes SurrealDB 3 persistence and native record-ID decoding. Permission flags and the API reference describe tenant restrictions, retention, asynchronous persistence and the limits of a locally stored anchor.Release versions: SchemaForge CLI 0.42.0 and integration crate 0.41.0. Synthetic HTTP regressions cover authorization, concurrent appends, missing retained data, corruption, field projection and request limits/deadlines. The full workspace suite passed 2,470 tests (eight existing skips); separate SQL Server unit tests passed three tests (two integration skips). The 11 HTTP contract tests include canonical TypeID and UUIDv7 assertions. All three backend Clippy configurations passed with zero lint warnings. The candidate SurrealDB server smoke test passed with 24 persisted TypeID events and valid full/suffix verification. The final crates.io dependency passed the default all-target Clippy check and all 11 HTTP contract tests. Downloaded release binary smoke tests will follow publication.
Closes #149.