Audit — the module and its seams

Audit — the module and its seams An architecture diagram generated by Archify. tenant · Deps.Tenants: jobs.TenantLister · Deps · other modules' contracts/ · Deps tenant Deps.Tenants: jobs.TenantLister Deps admin shell · module.Nav · no Resource · consumers · consumer admin shell module.Nav · no Resource consumer contracts/ · Event · no events · 1 permission · Service · modules/audit contracts/ Event · no events · 1 permission · Service module.go · Deps{Tenants, RetentionDays} · SubscribeAll · modules/audit module.go Deps{Tenants, RetentionDays} · SubscribeAll internal/ · Service: Record · List · Get · Retention · routes · modules/audit internal/ Service: Record · List · Get · Retention · routes httpx.Register · no rest.Spec · /api/v1/audit/events · GET list · GET {id} · kit/ seams httpx.Register · no rest.Spec /api/v1/audit/events · GET list · GET {id} admin screens · none · no Resource registered · kit/ seams admin screens none · no Resource registered events · publishes none · SubscribeAll → Record · kit/ seams events publishes none · SubscribeAll → Record jobs · audit-retention · hourly · kit/ seams jobs audit-retention · hourly migrations/000010_audit · audit_events · FORCE RLS · 000015 · kit/ seams migrations/000010_audit audit_events · FORCE RLS · 000015 PermissionAuditRead NewService Routes: RegisterRoutes SQL by hand over Tx[Tenant] Record · publishes none Retention none Deps Nav only modules/audit kit/ seams Deps · other modules' contracts/ consumers Legend Frontend Backend Database Message bus

Promises

  • • audit:read guards the list, the read and the nav entry; no second permission, because nothing writes through a route
  • • Publishes nothing — an audit of audits is a loop; Record is idempotent on (tenant_id, event_id): one row per event

Needs

  • • Deps.Tenants is jobs.TenantLister, the tenant module's Active lister in main; RetentionDays is audit.retention_days, zero a year
  • • SubscribeAll: one nameless subscription, expanded into one per declared event after every manifest is read

Proof

  • • contracts/audittest: the fake and the real service pass one suite; internal tests prove tenant ownership and retention
  • • No browser journey: e2e/admin-tasks.spec.ts never touches the trail; the two routes have no handler test