@vfarcic/dot-ai
Version:
AI-powered development productivity platform that enhances software development workflows through intelligent automation and AI-driven assistance
64 lines (63 loc) • 2.11 kB
JavaScript
"use strict";
/**
* RBAC Audit Logger (PRD #392 Milestone 5)
*
* Logs all authorization decisions and user management operations
* for traceability. Uses a dedicated "RBAC-Audit" component name
* so entries can be filtered with grep/jq in pod logs.
*/
Object.defineProperty(exports, "__esModule", { value: true });
exports.logToolAccessDecision = logToolAccessDecision;
exports.logUserManagementOperation = logUserManagementOperation;
const error_handling_1 = require("../error-handling");
const auditLogger = new error_handling_1.ConsoleLogger('RBAC-Audit', error_handling_1.LogLevel.DEBUG);
/**
* Log a tool access authorization decision (allowed or denied).
*
* Called automatically from checkToolAccess() for every RBAC evaluation.
* Token user access is logged at DEBUG level to reduce noise.
*/
function logToolAccessDecision(identity, params, result) {
const event = result.allowed ? 'tool.access.allowed' : 'tool.access.denied';
const data = {
event,
userId: identity?.userId,
email: identity?.email,
source: identity?.source,
tool: params.toolName,
resource: params.resource || 'tools',
verb: params.verb || 'execute',
};
if (params.namespace) {
data.namespace = params.namespace;
}
if (result.reason) {
data.reason = result.reason;
}
if (result.evaluationError) {
data.evaluationError = result.evaluationError;
}
// Token users log at debug level to avoid noise
if (identity?.source === 'token') {
auditLogger.debug(event, data);
}
else {
auditLogger.info(event, data);
}
}
/**
* Log a successful user management operation (create or delete).
*
* Called from REST API handlers after the operation completes successfully.
*/
function logUserManagementOperation(identity, operation, targetEmail) {
const event = `user.${operation}`;
auditLogger.info(event, {
event,
userId: identity?.userId,
email: identity?.email,
source: identity?.source,
operation,
targetEmail,
});
}