Joseph Doherty
b95ee5a658
Owner decisions recorded: the archive destination stays a directory/UNC (no object-storage client; share + permissions named at enablement), parquet-tools-only reading (no re-import), unsigned like the chain (#107). AuditLog:Archive:RetentionDays (default 0 = never delete; else must exceed AuditLog:RetentionDays, counted from the archived month's end) and DeleteSupersededStaleArchives (default true) run after every purge tick. A retried purge's stale Archived archive is deleted only when a later, verifying, Purged archive of the same partition provably holds every row: same prior anchor and the stale chain-end hash at its chain-end sequence (row or tombstone), every unchained row present by EventId; otherwise it is reported KeptStale. A sole copy left at Archived is never touched. Deletion removes only the archive name's own three files in its folder, manifest first, never a manifest-supplied path. `audit archive cleanup [--dry-run]` = CleanupAuditArchives (Administrator). AuditLogArchiveCleanupTests (MSSQL) cover retried purge, kept stale copy, sole copy, retention and the path guard; each safety rule mutation-checked. Follow-ups filed: #113, #114, #115. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
69 lines
3.6 KiB
C#
69 lines
3.6 KiB
C#
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Audit;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Types.Audit;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
|
|
|
|
public record QueryAuditLogCommand(
|
|
string? User = null, string? EntityType = null, string? Action = null,
|
|
DateTimeOffset? From = null, DateTimeOffset? To = null,
|
|
int Page = 1, int PageSize = 50);
|
|
|
|
/// <summary>
|
|
/// Result wrapper for <see cref="QueryAuditLogCommand"/>.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// This record exists specifically so the handler does not return the repository's
|
|
/// <c>(IReadOnlyList<AuditLogEntry> Entries, int TotalCount)</c> ValueTuple directly.
|
|
/// A ValueTuple exposes <c>Item1</c>/<c>Item2</c> as public <em>fields</em>, and
|
|
/// <see cref="System.Text.Json"/> serializes only properties unless
|
|
/// <c>JsonSerializerOptions.IncludeFields</c> is set — so a tuple result serialized to
|
|
/// the literal string <c>{}</c> and every <c>audit-config query</c> looked empty no
|
|
/// matter how many rows the query matched (deferred-work register row 46). Mirrors the
|
|
/// <c>SecuredWriteListResult</c> shape used by the other paged management query.
|
|
/// </remarks>
|
|
/// <param name="Entries">The page of configuration-change audit entries.</param>
|
|
/// <param name="TotalCount">Total number of rows matching the filters (unpaged).</param>
|
|
public record AuditLogQueryResult(IReadOnlyList<AuditLogEntry> Entries, int TotalCount);
|
|
|
|
/// <summary>
|
|
/// Verifies the central AuditLog hash chain for one UTC calendar month (audit roadmap T1,
|
|
/// ScadaBridge#41). Read-only; gated on the OperationalAudit roles and refused for a
|
|
/// site-scoped caller, because a month's chain spans every site.
|
|
/// </summary>
|
|
/// <param name="Month">The month to verify, <c>YYYY-MM</c>.</param>
|
|
public record VerifyAuditChainCommand(string Month);
|
|
|
|
/// <summary>
|
|
/// Checks AuditLog chain heads exported off-box (<c>AuditLog:HashChain:HeadExport</c>,
|
|
/// ScadaBridge#107 item 1) against the database chain: does the database still carry each
|
|
/// exported hash at its exported sequence? Read-only; same gate as
|
|
/// <see cref="VerifyAuditChainCommand"/>. The CLI reads the records from the export files.
|
|
/// </summary>
|
|
/// <param name="Records">The exported head records (at most 50,000; duplicates are collapsed).</param>
|
|
public record VerifyAuditChainHeadsCommand(IReadOnlyList<AuditChainHeadRecord> Records);
|
|
|
|
/// <summary>
|
|
/// Lists the AuditLog Parquet cold archives under the configured archive directory (audit
|
|
/// roadmap T2, ScadaBridge#42). Read-only; OperationalAudit roles, refused for a site-scoped
|
|
/// caller because an archive holds every site's rows.
|
|
/// </summary>
|
|
public record ListAuditArchivesCommand;
|
|
|
|
/// <summary>
|
|
/// Verifies one AuditLog Parquet archive (ScadaBridge#42): file integrity against its
|
|
/// manifest, the hash chain recomputed over the archived rows, and the chain end against the
|
|
/// checkpoint anchor the partition purge left. Read-only; same gate as
|
|
/// <see cref="ListAuditArchivesCommand"/>.
|
|
/// </summary>
|
|
/// <param name="Name">The archive name, as <c>audit archive list</c> reports it.</param>
|
|
public record VerifyAuditArchiveCommand(string Name);
|
|
|
|
/// <summary>
|
|
/// Runs the AuditLog archive cleanup (ScadaBridge#109) now: deletes superseded stale archives
|
|
/// a retried purge left behind and archives past <c>AuditLog:Archive:RetentionDays</c> — or,
|
|
/// with <paramref name="DryRun"/>, only reports what it would delete. The purge actor runs the
|
|
/// same pass after every purge tick. Administrator only (it deletes files).
|
|
/// </summary>
|
|
/// <param name="DryRun">Report only; delete nothing.</param>
|
|
public record CleanupAuditArchivesCommand(bool DryRun);
|