Claude Fable 5
ed2225bb77
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 5m5s
CI / Build container images (pull_request) Successful in 2m48s
CI / Auth e2e pack (pull_request) Successful in 7m50s
CI / Import/export fidelity gate (pull_request) Successful in 56s
CD / Build and push images (push) Successful in 15s
CD / Deploy to Test (push) Successful in 16s
CD / Smoke tests against Test (push) Successful in 1m20s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 5m11s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 7m38s
CI / Import/export fidelity gate (push) Successful in 56s
audit.retentionDays (instance setting, default 365) bounds the audit_log: the daily audit-retention job deletes entries past the period and records the deletion itself (audit.pruned with count, cutoff and period) so a gap in the trail is always explainable. Lives in its own AuditRetentionService because the settings service audits its writes - folding retention into AuditService would close a constructor cycle. The read-access trail (#222-#225) is deliberately not covered; it gets its own period. security.md gains the Logging section the schema has cited for a while; the maintenance-job fence moves 6 -> 7 (the deliberate new row). Refs #196 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
41 lines
1.3 KiB
TypeScript
41 lines
1.3 KiB
TypeScript
import { Global, Module, OnModuleInit } from '@nestjs/common';
|
|
|
|
import { CommonModule } from '../common/common.module';
|
|
import { SchedulerModule } from '../scheduler/scheduler.module';
|
|
import { SchedulerService } from '../scheduler/scheduler.service';
|
|
import { SettingsModule } from '../settings/settings.module';
|
|
|
|
import { AuditRetentionService } from './audit-retention.service';
|
|
import { AuditService } from './audit.service';
|
|
|
|
/** Daily, per operations.md's maintenance-jobs table (issue #196). */
|
|
const AUDIT_RETENTION_CADENCE_SECONDS = 24 * 60 * 60;
|
|
|
|
/**
|
|
* Global because the audit trail cuts across nearly every feature module
|
|
* (auth, grants, members, admin, plugins, setup) — like PrismaModule, one
|
|
* import list entry per consumer would only add noise.
|
|
*/
|
|
@Global()
|
|
@Module({
|
|
imports: [CommonModule, SchedulerModule, SettingsModule],
|
|
providers: [AuditService, AuditRetentionService],
|
|
exports: [AuditService],
|
|
})
|
|
export class AuditModule implements OnModuleInit {
|
|
constructor(
|
|
private readonly scheduler: SchedulerService,
|
|
private readonly retention: AuditRetentionService,
|
|
) {}
|
|
|
|
onModuleInit(): void {
|
|
this.scheduler.register({
|
|
name: 'audit-retention',
|
|
cadenceSeconds: AUDIT_RETENTION_CADENCE_SECONDS,
|
|
run: async () => {
|
|
await this.retention.pruneExpired();
|
|
},
|
|
});
|
|
}
|
|
}
|