Skip to content

feat(core): process finalized audit emissions - #3817

Open
strantalis wants to merge 3 commits into
codex/pep-5181-audit-recorderfrom
codex/pep-5181-audit-processor
Open

feat(core): process finalized audit emissions#3817
strantalis wants to merge 3 commits into
codex/pep-5181-audit-recorderfrom
codex/pep-5181-audit-processor

Conversation

@strantalis

@strantalis strantalis commented Aug 3, 2026

Copy link
Copy Markdown
Member

Proposed Changes

  • process finalized typed events after cancellation handling and JWT enrichment
  • support explicit zero (Drop), one, or ordered many slog emissions for downstream partitioning
  • fall back to the unchanged default OpenTDF audit record on processor error, panic, invalid empty output, or filtered levels
  • keep authoritative pre-enrichment event fields separate from the enriched output map for ownership decisions
  • inject one concurrency-safe processor through server.WithAuditProcessor and retain it across scoped and namespace-rebuilt loggers
  • document the public recorder/processor contract and ownership boundary

This is PR 2 of 2 for PEP-5181 and is based on PR #3816.

Design and compatibility

  • the default processor preserves level:"AUDIT", msg:<verb>, and audit:{...}
  • processors run outside transaction locks and receive isolated snapshots
  • conversion failures produce an operational diagnostic and exactly one default fallback event
  • JWT claims may enrich actor/request context but must not establish resource ownership
  • lowercase audit level serialization remains a downstream handler concern; processors can emit the required message attribute without importing downstream models upstream

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

  • cd service && go test -race ./logger/audit ./pkg/config ./pkg/server ./internal/server
  • cd service && golangci-lint run --new-from-rev=origin/main ./logger/audit/... ./logger/... ./pkg/server/...
  • cd sdk && go test -run TestREADMECodeBlocks
  • git diff --check origin/main...HEAD

Repository-wide make lint is blocked locally by an invalid Buf API token. Repository-wide make test reaches environment-dependent Keycloak/Docker suites that are unavailable locally; the focused race suites above pass.

Add instance-scoped audit processors with explicit zero, one, or many emission semantics. Fall back to the unchanged default record on processor errors, panics, or invalid output, and propagate the processor through startup and namespace logger construction.\n\nRefs: PEP-5181

Signed-off-by: strantalis <strantalis@virtru.com>
@strantalis
strantalis requested a review from a team as a code owner August 3, 2026 15:50
@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c33c3d67-ef4a-48d2-ad76-fd9eb22d1ace

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the size/m label Aug 3, 2026
@strantalis strantalis changed the title codex/pep 5181 audit processor feat(audit): process finalized event emissions Aug 3, 2026
@strantalis strantalis changed the title feat(audit): process finalized event emissions feat(core): process finalized audit emissions Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 258.03381ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 127.588332ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 410.745552ms
Throughput 243.46 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 51.154448337s
Average Latency 509.912073ms
Throughput 97.74 requests/second

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

  • examples
  • otdfctl
  • sdk
  • service
  • lib/fixtures
  • tests-bdd

See the workflow run for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant