04faa079e2
New packages: - @lab/core: Resource types, Output<T> (Pulumi), audit event types, auth types, environment/account types, resource kind registry New Prisma schema (mcpctl pattern): - User (email/password/bcrypt), Session (bearer tokens), Group, GroupMember - ServiceAccount, RbacDefinition (JSON subjects + roleBindings) - AuditEvent (correlation IDs, causal chains, fire-and-forget batching) - Environment, Account (driver config, Infisical secret path), Binding - Resource (generic, kind/name/env unique, origin/managedBy tracking) - Secret, Fleet, FleetMember, GitSource - Keeps v1.0 models: Server, Agent, Bastion, Cluster, JoinToken New services: - AuthService: bearer token login, bootstrap (first login creates admin), session management with 30-day expiry - RbacService: environment-scoped permission checks, group membership, role hierarchy (admin > edit > view) - AuditService: fire-and-forget event collection, batch 50 / flush 5s, correlation IDs for causal chains - ResourceStore: CRUD with origin/managedBy, RBAC-enforced routes New routes: - POST /api/auth/login, POST /api/auth/logout (bearer token auth) - GET/POST/PUT/DELETE /api/resources (RBAC-enforced CRUD) - GET/POST /api/environments, GET/POST /api/accounts - POST /api/accounts/bind, GET /api/bindings - GET /api/events (audit query with --last, --kind, --env, --correlation) New middleware: - Bearer token auth (validates Authorization header, resolves user identity) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
76 lines
1.6 KiB
TypeScript
76 lines
1.6 KiB
TypeScript
// Audit event types for the labctl platform.
|
|
// Every mutation is tracked with correlation IDs for causal chains.
|
|
|
|
export type AuditEventKind =
|
|
| "resource_created"
|
|
| "resource_updated"
|
|
| "resource_deleted"
|
|
| "resource_state_change"
|
|
| "plan_generated"
|
|
| "apply_started"
|
|
| "apply_step"
|
|
| "apply_completed"
|
|
| "driver_translate"
|
|
| "driver_execute"
|
|
| "driver_error"
|
|
| "fleet_discovery"
|
|
| "fleet_classification"
|
|
| "fleet_approval"
|
|
| "fleet_auto_approve"
|
|
| "pipeline_started"
|
|
| "pipeline_step_started"
|
|
| "pipeline_step_completed"
|
|
| "pipeline_completed"
|
|
| "deploy_started"
|
|
| "deploy_completed"
|
|
| "deploy_failed"
|
|
| "drift_detected"
|
|
| "drift_corrected"
|
|
| "sync_triggered"
|
|
| "sync_completed"
|
|
| "auth_login"
|
|
| "auth_logout"
|
|
| "auth_bootstrap"
|
|
| "rbac_decision"
|
|
| "impersonation"
|
|
| "server_started"
|
|
| "controller_started"
|
|
| "agent_connected"
|
|
| "agent_disconnected"
|
|
| "bastion_registered";
|
|
|
|
export type AuditSource =
|
|
| "cli"
|
|
| "labd"
|
|
| "agent"
|
|
| "driver"
|
|
| "fleet-controller"
|
|
| "sync-controller";
|
|
|
|
export type AuditResult = "success" | "failure" | "denied" | "skipped";
|
|
|
|
export interface AuditEvent {
|
|
id: string;
|
|
timestamp: Date;
|
|
eventKind: AuditEventKind;
|
|
source: AuditSource;
|
|
verified: boolean;
|
|
|
|
userId?: string;
|
|
userName?: string;
|
|
sessionId?: string;
|
|
environmentName?: string;
|
|
accountName?: string;
|
|
|
|
resourceKind?: string;
|
|
resourceName?: string;
|
|
|
|
correlationId: string;
|
|
parentEventId?: string;
|
|
|
|
details: Record<string, unknown>;
|
|
result: AuditResult;
|
|
error?: string;
|
|
durationMs?: number;
|
|
}
|