Enum AuditEvent 

pub enum AuditEvent {
    Authentication {
        outcome: AuditOutcome,
        mechanism: String,
        principal: AuditPrincipal,
        source: AuditEndpoint,
        reason: Option<String>,
        time_ms: i64,
    },
    AuthorizationDenied {
        principal: AuditPrincipal,
        source: AuditEndpoint,
        resource_type: String,
        resource_name: String,
        operation: String,
        time_ms: i64,
    },
    AdminOperation {
        outcome: AuditOutcome,
        principal: AuditPrincipal,
        source: AuditEndpoint,
        operation: String,
        resources: Vec<AuditResource>,
        time_ms: i64,
    },
    PrivilegedAction {

        outcome: AuditOutcome,
        phase: PrivilegedPhase,
        action: String,
        target: String,
        proposal_id: String,
        principal: AuditPrincipal,
        counterparties: Vec<AuditPrincipal>,
        approver_set_fingerprint: String,
        key_id: String,
        signature: Vec<u8>,
        signature_verified: bool,
        signed_at_ms: i64,
        source: AuditEndpoint,
        reason: String,
        time_ms: i64,
    
},
    Lifecycle {
        kind: LifecycleKind,
        node_id: i64,
        time_ms: i64,
    },
}

A single auditable security event.

The caller supplies the times as epoch-millis, so the crate stays pure and deterministically testable.

Variants

Authentication

Fields

outcome: AuditOutcome

mechanism: String

principal: AuditPrincipal

source: AuditEndpoint

reason: Option<String>

time_ms: i64

AuthorizationDenied

Fields

principal: AuditPrincipal

source: AuditEndpoint

resource_type: String

resource_name: String

operation: String

time_ms: i64

AdminOperation

Fields

outcome: AuditOutcome

principal: AuditPrincipal

source: AuditEndpoint

operation: String

resources: Vec<AuditResource>

time_ms: i64

PrivilegedAction

A privileged action, with the evidence that authorised it.

A topic freeze, a thaw, an unclean leader election, and every other action behind the two-person rule write this variant. It is not named for break-glass, because a freeze is not a break-glass act and still carries the same evidence.

The record keeps the detached signature itself, not only signature_verified. The audit log is hash-chained and its checkpoints are Ed25519-signed, so an auditor who trusts the audit chain and holds the operator public keys can re-verify who set every freeze from the audit topic alone, with no broker and no raft log. That is a second, independent copy of the proof.

proposal_id is empty when the action needed no proposal, such as a freeze. counterparties holds the approvers and is empty for the same case. key_id and signature are empty when the action was unsigned. approver_set_fingerprint is the SHA-256 hex of the sorted configured approver list, evaluated at approval time, so a later divergence of that list is visible after the fact.

Fields

outcome: AuditOutcome

phase: PrivilegedPhase

action: String

target: String

proposal_id: String

principal: AuditPrincipal

counterparties: Vec<AuditPrincipal>

approver_set_fingerprint: String

key_id: String

signature: Vec<u8>

signature_verified: bool

signed_at_ms: i64

The timestamp that the operator’s detached signature covers.

For a topic freeze this is the record’s set_at_ms, which sits inside the signed preimage. It is carried here because time_ms is taken when the event is emitted, which is a different instant: an auditor rebuilding the preimage from this record needs the stamp the operator signed, not the one the broker logged.

0 where the event carries no signature over a timestamp, which is every unsigned action and every break-glass act – a break-glass approval signs the proposal’s created_at_ms and expires_at_ms instead, and neither is a single stamp this field could hold.

source: AuditEndpoint

reason: String

time_ms: i64

Lifecycle

Fields

kind: LifecycleKind

node_id: i64

time_ms: i64

Implementations

impl AuditEvent

pub fn class(&self) -> AuditEventClass

The OCSF class this event maps to.

Trait Implementations

impl Clone for AuditEvent

fn clone(&self) -> AuditEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AuditEvent

impl PartialEq for AuditEvent

fn eq(&self, other: &AuditEvent) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AuditEvent