feat(audit): ExecutionId filter in the CLI and ManagementService

tests/ScadaLink.CLI.Tests/Commands/AuditQueryCommandTests.cs

@@ -65,6 +65,7 @@ public class AuditQueryCommandTests
             Target = "weather-api",
             Actor = "multi-role",
             CorrelationId = "abc-123",
+            ExecutionId = "def-456",
             ErrorsOnly = false,
             PageSize = 250,
         };
@@ -81,6 +82,7 @@ public class AuditQueryCommandTests
         Assert.Equal("weather-api", parsed["target"]);
         Assert.Equal("multi-role", parsed["actor"]);
         Assert.Equal("abc-123", parsed["correlationId"]);
+        Assert.Equal("def-456", parsed["executionId"]);
         Assert.Equal("250", parsed["pageSize"]);
         Assert.Equal("2026-05-20T11:00:00.0000000+00:00", parsed["fromUtc"]);
         Assert.Equal("2026-05-20T12:00:00.0000000+00:00", parsed["toUtc"]);
@@ -155,9 +157,22 @@ public class AuditQueryCommandTests
         Assert.Null(parsed["channel"]);
         Assert.Null(parsed["status"]);
         Assert.Null(parsed["fromUtc"]);
+        Assert.Null(parsed["correlationId"]);
+        Assert.Null(parsed["executionId"]);
         Assert.Equal("100", parsed["pageSize"]);
     }
 
+    [Fact]
+    public void BuildQueryString_ExecutionId_EmitsExecutionIdParameter()
+    {
+        // --execution-id is a single-value Guid filter — mirrors --correlation-id.
+        var now = DateTimeOffset.UtcNow;
+        var args = new AuditQueryArgs { ExecutionId = "11111111-1111-1111-1111-111111111111" };
+        var qs = AuditQueryHelpers.BuildQueryString(args, now, null, null);
+        var parsed = HttpUtility.ParseQueryString(qs.TrimStart('?'));
+        Assert.Equal("11111111-1111-1111-1111-111111111111", parsed["executionId"]);
+    }
+
     // ---- HTTP execution / paging ------------------------------------------
 
     private sealed class RecordingHandler : HttpMessageHandler
@@ -281,6 +296,18 @@ public class AuditQueryCommandTests
         Assert.Empty(parse.Errors);
     }
 
+    [Fact]
+    public void Query_ExecutionIdOption_IsAccepted()
+    {
+        // --execution-id is a single-value option — mirrors --correlation-id.
+        var root = AuditCommandTestHarness.BuildRoot();
+        var parse = root.Parse(new[]
+        {
+            "audit", "query", "--execution-id", "11111111-1111-1111-1111-111111111111",
+        });
+        Assert.Empty(parse.Errors);
+    }
+
     // ---- Enum-name validation (fast-fail) ----------------------------------
 
     [Fact]

tests/ScadaLink.CentralUI.Tests/Audit/AuditExportEndpointsTests.cs

@@ -138,6 +138,7 @@ public class AuditExportEndpointsTests
         using (host)
         {
             var correlationId = Guid.NewGuid().ToString();
+            var executionId = Guid.NewGuid().ToString();
             var url =
                 "/api/centralui/audit/export?" +
                 "channel=ApiOutbound&" +
@@ -147,6 +148,7 @@ public class AuditExportEndpointsTests
                 "target=PaymentApi&" +
                 "actor=apikey-1&" +
                 $"correlationId={correlationId}&" +
+                $"executionId={executionId}&" +
                 "from=2026-05-20T00:00:00Z&" +
                 "to=2026-05-20T23:59:59Z";
 
@@ -167,6 +169,7 @@ public class AuditExportEndpointsTests
                     f.Target == "PaymentApi" &&
                     f.Actor == "apikey-1" &&
                     f.CorrelationId == Guid.Parse(correlationId) &&
+                    f.ExecutionId == Guid.Parse(executionId) &&
                     f.FromUtc == new DateTime(2026, 5, 20, 0, 0, 0, DateTimeKind.Utc) &&
                     f.ToUtc == new DateTime(2026, 5, 20, 23, 59, 59, DateTimeKind.Utc)),
                 Arg.Any<AuditLogPaging>(),
@@ -195,6 +198,7 @@ public class AuditExportEndpointsTests
                     f.Target == null &&
                     f.Actor == null &&
                     f.CorrelationId == null &&
+                    f.ExecutionId == null &&
                     f.FromUtc == null &&
                     f.ToUtc == null),
                 Arg.Any<AuditLogPaging>(),
@@ -222,6 +226,25 @@ public class AuditExportEndpointsTests
         }
     }
 
+    [Fact]
+    public async Task ExportEndpoint_UnparseableExecutionId_SilentlyDropped()
+    {
+        // Lax-parse contract: an unparseable executionId is dropped (no 400) —
+        // mirrors the correlationId parse.
+        var (client, repo, host) = await BuildHostAsync();
+        using (host)
+        {
+            var response = await client.GetAsync("/api/centralui/audit/export?executionId=not-a-guid");
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            _ = await response.Content.ReadAsStringAsync();
+
+            await repo.Received().QueryAsync(
+                Arg.Is<AuditLogQueryFilter>(f => f.ExecutionId == null),
+                Arg.Any<AuditLogPaging>(),
+                Arg.Any<CancellationToken>());
+        }
+    }
+
     /// <summary>
     /// Test-only authentication handler that signs every request in as an Admin.
     /// Admin is in <c>AuditExportRoles</c>, so the endpoint's AuditExport policy

tests/ScadaLink.ManagementService.Tests/AuditEndpointsTests.cs

@@ -428,6 +428,38 @@ public class AuditEndpointsTests
         Assert.Null(filter.Statuses);
     }
 
+    [Fact]
+    public void ParseFilter_ExecutionId_ParsesIntoSingleValueGuid()
+    {
+        // executionId is a single-value Guid? filter — mirrors correlationId.
+        var executionId = Guid.NewGuid();
+        var query = new Microsoft.AspNetCore.Http.QueryCollection(
+            new Dictionary<string, Microsoft.Extensions.Primitives.StringValues>
+            {
+                ["executionId"] = executionId.ToString(),
+            });
+
+        var filter = AuditEndpoints.ParseFilter(query);
+
+        Assert.Equal(executionId, filter.ExecutionId);
+    }
+
+    [Fact]
+    public void ParseFilter_UnparseableExecutionId_IsDroppedSilently()
+    {
+        // Lax-parse contract: an unparseable executionId is dropped (no 400) —
+        // mirrors the correlationId parse.
+        var query = new Microsoft.AspNetCore.Http.QueryCollection(
+            new Dictionary<string, Microsoft.Extensions.Primitives.StringValues>
+            {
+                ["executionId"] = "not-a-guid",
+            });
+
+        var filter = AuditEndpoints.ParseFilter(query);
+
+        Assert.Null(filter.ExecutionId);
+    }
+
     [Fact]
     public async Task Query_RepeatedChannelParams_ReachRepositoryAsMultiValueFilter()
     {