| | | 1 | | using System.Collections.ObjectModel; |
| | | 2 | | using AsiBackbone.Core.Actors; |
| | | 3 | | using AsiBackbone.Core.Serialization; |
| | | 4 | | using SigningMetadataValue = AsiBackbone.Core.Signing.SigningMetadata; |
| | | 5 | | |
| | | 6 | | namespace AsiBackbone.Core.Audit; |
| | | 7 | | |
| | | 8 | | /// <summary> |
| | | 9 | | /// Represents a persistence-ready audit ledger record captured from AsiBackbone audit residue. |
| | | 10 | | /// </summary> |
| | | 11 | | public sealed class AuditLedgerRecord : IAsiBackboneAuditResidue |
| | | 12 | | { |
| | 4 | 13 | | private static readonly ReadOnlyCollection<string> EmptyReasonCodes = |
| | 4 | 14 | | Array.AsReadOnly(Array.Empty<string>()); |
| | | 15 | | |
| | 4 | 16 | | private static readonly IReadOnlyDictionary<string, string> EmptyMetadata = |
| | 4 | 17 | | new ReadOnlyDictionary<string, string>( |
| | 4 | 18 | | new Dictionary<string, string>(StringComparer.Ordinal)); |
| | | 19 | | |
| | 84 | 20 | | private AuditLedgerRecord( |
| | 84 | 21 | | string recordId, |
| | 84 | 22 | | string? schemaVersion, |
| | 84 | 23 | | string eventId, |
| | 84 | 24 | | string? auditResidueId, |
| | 84 | 25 | | DateTimeOffset occurredUtc, |
| | 84 | 26 | | DateTimeOffset recordedUtc, |
| | 84 | 27 | | string actorId, |
| | 84 | 28 | | AsiBackboneActorType actorType, |
| | 84 | 29 | | string? actorDisplayName, |
| | 84 | 30 | | string operationName, |
| | 84 | 31 | | string outcome, |
| | 84 | 32 | | IReadOnlyList<string> reasonCodes, |
| | 84 | 33 | | string? correlationId, |
| | 84 | 34 | | string? traceId, |
| | 84 | 35 | | string? spanId, |
| | 84 | 36 | | string? parentSpanId, |
| | 84 | 37 | | long? decisionLatencyMs, |
| | 84 | 38 | | string? constraintSetHash, |
| | 84 | 39 | | int? constraintCount, |
| | 84 | 40 | | double? riskScore, |
| | 84 | 41 | | string? policyScope, |
| | 84 | 42 | | string? tenantHash, |
| | 84 | 43 | | string? organizationHash, |
| | 84 | 44 | | string? emitterStatus, |
| | 84 | 45 | | string? emitterProvider, |
| | 84 | 46 | | long? outboxSequence, |
| | 84 | 47 | | string? gatewayExecutionId, |
| | 84 | 48 | | string? decisionStage, |
| | 84 | 49 | | string? policyVersion, |
| | 84 | 50 | | string? policyHash, |
| | 84 | 51 | | string? handshakeId, |
| | 84 | 52 | | string? acknowledgmentId, |
| | 84 | 53 | | string? capabilityTokenId, |
| | 84 | 54 | | string? previousRecordHash, |
| | 84 | 55 | | string? recordHash, |
| | 84 | 56 | | string? signatureKeyId, |
| | 84 | 57 | | string? signatureAlgorithm, |
| | 84 | 58 | | string? signatureValue, |
| | 84 | 59 | | string? signingHash, |
| | 84 | 60 | | string? signatureKeyVersion, |
| | 84 | 61 | | string? signatureProvider, |
| | 84 | 62 | | DateTimeOffset? signedUtc, |
| | 84 | 63 | | IReadOnlyDictionary<string, string> metadata) |
| | | 64 | | { |
| | 84 | 65 | | ArgumentException.ThrowIfNullOrWhiteSpace(recordId); |
| | 84 | 66 | | ArgumentException.ThrowIfNullOrWhiteSpace(eventId); |
| | 83 | 67 | | ArgumentException.ThrowIfNullOrWhiteSpace(actorId); |
| | 82 | 68 | | ArgumentException.ThrowIfNullOrWhiteSpace(operationName); |
| | 81 | 69 | | ArgumentException.ThrowIfNullOrWhiteSpace(outcome); |
| | | 70 | | |
| | 80 | 71 | | RecordId = recordId.Trim(); |
| | 80 | 72 | | SchemaVersion = AsiBackboneSchemaVersions.Normalize(schemaVersion); |
| | 80 | 73 | | EventId = eventId.Trim(); |
| | 80 | 74 | | AuditResidueId = NormalizeOptional(auditResidueId) ?? EventId; |
| | 80 | 75 | | OccurredUtc = occurredUtc.ToUniversalTime(); |
| | 80 | 76 | | RecordedUtc = recordedUtc.ToUniversalTime(); |
| | 80 | 77 | | ActorId = actorId.Trim(); |
| | 80 | 78 | | ActorType = actorType; |
| | 80 | 79 | | ActorDisplayName = NormalizeOptional(actorDisplayName); |
| | 80 | 80 | | OperationName = operationName.Trim(); |
| | 80 | 81 | | Outcome = outcome.Trim(); |
| | 80 | 82 | | ReasonCodes = reasonCodes; |
| | 80 | 83 | | CorrelationId = NormalizeOptional(correlationId); |
| | 80 | 84 | | TraceId = NormalizeOptional(traceId); |
| | 80 | 85 | | SpanId = NormalizeOptional(spanId); |
| | 80 | 86 | | ParentSpanId = NormalizeOptional(parentSpanId); |
| | 80 | 87 | | DecisionLatencyMs = NormalizeNonNegative(decisionLatencyMs, nameof(decisionLatencyMs)); |
| | 80 | 88 | | ConstraintSetHash = NormalizeOptional(constraintSetHash); |
| | 80 | 89 | | ConstraintCount = NormalizeNonNegative(constraintCount, nameof(constraintCount)); |
| | 80 | 90 | | RiskScore = NormalizeRiskScore(riskScore); |
| | 80 | 91 | | PolicyScope = NormalizeOptional(policyScope); |
| | 80 | 92 | | TenantHash = NormalizeOptional(tenantHash); |
| | 80 | 93 | | OrganizationHash = NormalizeOptional(organizationHash); |
| | 80 | 94 | | EmitterStatus = NormalizeOptional(emitterStatus); |
| | 80 | 95 | | EmitterProvider = NormalizeOptional(emitterProvider); |
| | 80 | 96 | | OutboxSequence = NormalizeNonNegative(outboxSequence, nameof(outboxSequence)); |
| | 80 | 97 | | GatewayExecutionId = NormalizeOptional(gatewayExecutionId); |
| | 80 | 98 | | DecisionStage = NormalizeOptional(decisionStage); |
| | 80 | 99 | | PolicyVersion = NormalizeOptional(policyVersion); |
| | 80 | 100 | | PolicyHash = NormalizeOptional(policyHash); |
| | 80 | 101 | | HandshakeId = NormalizeOptional(handshakeId); |
| | 80 | 102 | | AcknowledgmentId = NormalizeOptional(acknowledgmentId); |
| | 80 | 103 | | CapabilityTokenId = NormalizeOptional(capabilityTokenId); |
| | 80 | 104 | | PreviousRecordHash = NormalizeOptional(previousRecordHash); |
| | 80 | 105 | | RecordHash = NormalizeOptional(recordHash); |
| | 80 | 106 | | SignatureKeyId = NormalizeOptional(signatureKeyId); |
| | 80 | 107 | | SignatureAlgorithm = NormalizeOptional(signatureAlgorithm); |
| | 80 | 108 | | SignatureValue = NormalizeOptional(signatureValue); |
| | 80 | 109 | | SigningHash = NormalizeOptional(signingHash); |
| | 80 | 110 | | SignatureKeyVersion = NormalizeOptional(signatureKeyVersion); |
| | 80 | 111 | | SignatureProvider = NormalizeOptional(signatureProvider); |
| | 80 | 112 | | SignedUtc = signedUtc?.ToUniversalTime(); |
| | 80 | 113 | | SigningMetadata = SigningMetadataValue.Create( |
| | 80 | 114 | | SigningHash, |
| | 80 | 115 | | null, |
| | 80 | 116 | | SignatureValue, |
| | 80 | 117 | | SignatureAlgorithm, |
| | 80 | 118 | | SignatureKeyId, |
| | 80 | 119 | | SignatureKeyVersion, |
| | 80 | 120 | | SignatureProvider, |
| | 80 | 121 | | SignedUtc); |
| | 80 | 122 | | Metadata = metadata; |
| | 80 | 123 | | } |
| | | 124 | | |
| | 82 | 125 | | public string RecordId { get; } |
| | | 126 | | |
| | 43 | 127 | | public string SchemaVersion { get; } |
| | | 128 | | |
| | 34 | 129 | | public string EventId { get; } |
| | | 130 | | |
| | 28 | 131 | | public string AuditResidueId { get; } |
| | | 132 | | |
| | 32 | 133 | | public DateTimeOffset OccurredUtc { get; } |
| | | 134 | | |
| | 45 | 135 | | public DateTimeOffset RecordedUtc { get; } |
| | | 136 | | |
| | 35 | 137 | | public string ActorId { get; } |
| | | 138 | | |
| | 32 | 139 | | public AsiBackboneActorType ActorType { get; } |
| | | 140 | | |
| | 33 | 141 | | public string? ActorDisplayName { get; } |
| | | 142 | | |
| | 32 | 143 | | public string OperationName { get; } |
| | | 144 | | |
| | 32 | 145 | | public string Outcome { get; } |
| | | 146 | | |
| | 58 | 147 | | public IReadOnlyList<string> ReasonCodes { get; } |
| | | 148 | | |
| | 37 | 149 | | public string? CorrelationId { get; } |
| | | 150 | | |
| | 37 | 151 | | public string? TraceId { get; } |
| | | 152 | | |
| | 28 | 153 | | public string? SpanId { get; } |
| | | 154 | | |
| | 28 | 155 | | public string? ParentSpanId { get; } |
| | | 156 | | |
| | 28 | 157 | | public long? DecisionLatencyMs { get; } |
| | | 158 | | |
| | 28 | 159 | | public string? ConstraintSetHash { get; } |
| | | 160 | | |
| | 28 | 161 | | public int? ConstraintCount { get; } |
| | | 162 | | |
| | 28 | 163 | | public double? RiskScore { get; } |
| | | 164 | | |
| | 28 | 165 | | public string? PolicyScope { get; } |
| | | 166 | | |
| | 28 | 167 | | public string? TenantHash { get; } |
| | | 168 | | |
| | 28 | 169 | | public string? OrganizationHash { get; } |
| | | 170 | | |
| | 28 | 171 | | public string? EmitterStatus { get; } |
| | | 172 | | |
| | 28 | 173 | | public string? EmitterProvider { get; } |
| | | 174 | | |
| | 28 | 175 | | public long? OutboxSequence { get; } |
| | | 176 | | |
| | 28 | 177 | | public string? GatewayExecutionId { get; } |
| | | 178 | | |
| | 28 | 179 | | public string? DecisionStage { get; } |
| | | 180 | | |
| | 33 | 181 | | public string? PolicyVersion { get; } |
| | | 182 | | |
| | 33 | 183 | | public string? PolicyHash { get; } |
| | | 184 | | |
| | 33 | 185 | | public string? HandshakeId { get; } |
| | | 186 | | |
| | 33 | 187 | | public string? AcknowledgmentId { get; } |
| | | 188 | | |
| | 34 | 189 | | public string? CapabilityTokenId { get; } |
| | | 190 | | |
| | 33 | 191 | | public string? PreviousRecordHash { get; } |
| | | 192 | | |
| | 23 | 193 | | public string? RecordHash { get; } |
| | | 194 | | |
| | 84 | 195 | | public string? SigningHash { get; } |
| | | 196 | | |
| | 103 | 197 | | public string? SignatureKeyId { get; } |
| | | 198 | | |
| | 84 | 199 | | public string? SignatureKeyVersion { get; } |
| | | 200 | | |
| | 103 | 201 | | public string? SignatureAlgorithm { get; } |
| | | 202 | | |
| | 103 | 203 | | public string? SignatureValue { get; } |
| | | 204 | | |
| | 83 | 205 | | public string? SignatureProvider { get; } |
| | | 206 | | |
| | 83 | 207 | | public DateTimeOffset? SignedUtc { get; } |
| | | 208 | | |
| | 5 | 209 | | public SigningMetadataValue SigningMetadata { get; } |
| | | 210 | | |
| | 78 | 211 | | public IReadOnlyDictionary<string, string> Metadata { get; } |
| | | 212 | | |
| | 6 | 213 | | public bool HasReasonCodes => ReasonCodes.Count > 0; |
| | | 214 | | |
| | 10 | 215 | | public bool HasMetadata => Metadata.Count > 0; |
| | | 216 | | |
| | | 217 | | public static AuditLedgerRecord FromResidue( |
| | | 218 | | IAsiBackboneAuditResidue residue, |
| | | 219 | | string? recordId = null, |
| | | 220 | | DateTimeOffset? recordedUtc = null, |
| | | 221 | | string? handshakeId = null, |
| | | 222 | | string? acknowledgmentId = null, |
| | | 223 | | string? capabilityTokenId = null, |
| | | 224 | | string? previousRecordHash = null, |
| | | 225 | | string? recordHash = null, |
| | | 226 | | string? signatureKeyId = null, |
| | | 227 | | string? signatureAlgorithm = null, |
| | | 228 | | string? signatureValue = null, |
| | | 229 | | string? signingHash = null, |
| | | 230 | | string? signatureKeyVersion = null, |
| | | 231 | | string? signatureProvider = null, |
| | | 232 | | DateTimeOffset? signedUtc = null, |
| | | 233 | | IReadOnlyDictionary<string, string>? metadata = null, |
| | | 234 | | string? schemaVersion = null) |
| | | 235 | | { |
| | 85 | 236 | | ArgumentNullException.ThrowIfNull(residue); |
| | | 237 | | |
| | 84 | 238 | | return new AuditLedgerRecord( |
| | 84 | 239 | | NormalizeIdentifier(recordId), |
| | 84 | 240 | | schemaVersion ?? residue.SchemaVersion, |
| | 84 | 241 | | residue.EventId, |
| | 84 | 242 | | residue.AuditResidueId, |
| | 84 | 243 | | residue.OccurredUtc, |
| | 84 | 244 | | recordedUtc ?? DateTimeOffset.UtcNow, |
| | 84 | 245 | | residue.ActorId, |
| | 84 | 246 | | residue.ActorType, |
| | 84 | 247 | | residue.ActorDisplayName, |
| | 84 | 248 | | residue.OperationName, |
| | 84 | 249 | | residue.Outcome, |
| | 84 | 250 | | NormalizeReasonCodes(residue.ReasonCodes), |
| | 84 | 251 | | residue.CorrelationId, |
| | 84 | 252 | | residue.TraceId, |
| | 84 | 253 | | residue.SpanId, |
| | 84 | 254 | | residue.ParentSpanId, |
| | 84 | 255 | | residue.DecisionLatencyMs, |
| | 84 | 256 | | residue.ConstraintSetHash, |
| | 84 | 257 | | residue.ConstraintCount, |
| | 84 | 258 | | residue.RiskScore, |
| | 84 | 259 | | residue.PolicyScope, |
| | 84 | 260 | | residue.TenantHash, |
| | 84 | 261 | | residue.OrganizationHash, |
| | 84 | 262 | | residue.EmitterStatus, |
| | 84 | 263 | | residue.EmitterProvider, |
| | 84 | 264 | | residue.OutboxSequence, |
| | 84 | 265 | | residue.GatewayExecutionId, |
| | 84 | 266 | | residue.DecisionStage, |
| | 84 | 267 | | residue.PolicyVersion, |
| | 84 | 268 | | residue.PolicyHash, |
| | 84 | 269 | | handshakeId, |
| | 84 | 270 | | acknowledgmentId, |
| | 84 | 271 | | capabilityTokenId, |
| | 84 | 272 | | previousRecordHash, |
| | 84 | 273 | | recordHash, |
| | 84 | 274 | | signatureKeyId, |
| | 84 | 275 | | signatureAlgorithm, |
| | 84 | 276 | | signatureValue, |
| | 84 | 277 | | signingHash, |
| | 84 | 278 | | signatureKeyVersion, |
| | 84 | 279 | | signatureProvider, |
| | 84 | 280 | | signedUtc, |
| | 84 | 281 | | NormalizeMetadata(residue.Metadata, metadata)); |
| | | 282 | | } |
| | | 283 | | |
| | | 284 | | private static string NormalizeIdentifier(string? identifier) |
| | | 285 | | { |
| | 84 | 286 | | return string.IsNullOrWhiteSpace(identifier) |
| | 84 | 287 | | ? Guid.NewGuid().ToString("N") |
| | 84 | 288 | | : identifier.Trim(); |
| | | 289 | | } |
| | | 290 | | |
| | | 291 | | private static string? NormalizeOptional(string? value) |
| | | 292 | | { |
| | 2160 | 293 | | return string.IsNullOrWhiteSpace(value) |
| | 2160 | 294 | | ? null |
| | 2160 | 295 | | : value.Trim(); |
| | | 296 | | } |
| | | 297 | | |
| | | 298 | | private static long? NormalizeNonNegative(long? value, string parameterName) |
| | | 299 | | { |
| | 160 | 300 | | return value < 0 |
| | 160 | 301 | | ? throw new ArgumentOutOfRangeException(parameterName, value, "Value must be greater than or equal to zero." |
| | 160 | 302 | | : value; |
| | | 303 | | } |
| | | 304 | | |
| | | 305 | | private static int? NormalizeNonNegative(int? value, string parameterName) |
| | | 306 | | { |
| | 80 | 307 | | return value < 0 |
| | 80 | 308 | | ? throw new ArgumentOutOfRangeException(parameterName, value, "Value must be greater than or equal to zero." |
| | 80 | 309 | | : value; |
| | | 310 | | } |
| | | 311 | | |
| | | 312 | | private static double? NormalizeRiskScore(double? riskScore) |
| | | 313 | | { |
| | 80 | 314 | | return riskScore is null |
| | 80 | 315 | | ? null |
| | 80 | 316 | | : double.IsNaN(riskScore.Value) || double.IsInfinity(riskScore.Value) || riskScore.Value < 0 |
| | 80 | 317 | | ? throw new ArgumentOutOfRangeException(nameof(riskScore), riskScore, "Risk score must be a finite value gre |
| | 80 | 318 | | : riskScore; |
| | | 319 | | } |
| | | 320 | | |
| | | 321 | | private static ReadOnlyCollection<string> NormalizeReasonCodes(IEnumerable<string>? reasonCodes) |
| | | 322 | | { |
| | 84 | 323 | | string[] normalizedReasonCodes = reasonCodes? |
| | 56 | 324 | | .Where(reasonCode => !string.IsNullOrWhiteSpace(reasonCode)) |
| | 53 | 325 | | .Select(reasonCode => reasonCode.Trim()) |
| | 84 | 326 | | .ToArray() ?? []; |
| | | 327 | | |
| | 84 | 328 | | return normalizedReasonCodes.Length == 0 |
| | 84 | 329 | | ? EmptyReasonCodes |
| | 84 | 330 | | : Array.AsReadOnly(normalizedReasonCodes); |
| | | 331 | | } |
| | | 332 | | |
| | | 333 | | private static IReadOnlyDictionary<string, string> NormalizeMetadata( |
| | | 334 | | params IReadOnlyDictionary<string, string>?[] metadataSets) |
| | | 335 | | { |
| | 84 | 336 | | Dictionary<string, string> normalizedMetadata = new(StringComparer.Ordinal); |
| | | 337 | | |
| | 504 | 338 | | foreach (IReadOnlyDictionary<string, string>? metadata in metadataSets) |
| | | 339 | | { |
| | 168 | 340 | | if (metadata is null || metadata.Count == 0) |
| | | 341 | | { |
| | | 342 | | continue; |
| | | 343 | | } |
| | | 344 | | |
| | 188 | 345 | | foreach (KeyValuePair<string, string> item in metadata) |
| | | 346 | | { |
| | 54 | 347 | | if (string.IsNullOrWhiteSpace(item.Key)) |
| | | 348 | | { |
| | | 349 | | continue; |
| | | 350 | | } |
| | | 351 | | |
| | 51 | 352 | | normalizedMetadata[item.Key.Trim()] = item.Value?.Trim() ?? string.Empty; |
| | | 353 | | } |
| | | 354 | | } |
| | | 355 | | |
| | 84 | 356 | | return normalizedMetadata.Count == 0 |
| | 84 | 357 | | ? EmptyMetadata |
| | 84 | 358 | | : new ReadOnlyDictionary<string, string>(normalizedMetadata); |
| | | 359 | | } |
| | | 360 | | } |