cmind/audit/audit.proto

Package: cmind.audit

Messages

MethodAudit

MethodAudit overrides what protoc-gen-cm-audit derives for a method. Every field is optional. Without the option a method is classified by its idempotency_level, then by its name prefix, and anything that still looks like a mutation is registered for auditing. Reads are left unregistered and so are only audited when they fail authorization.

Field	Type	Number	Description
mode	MethodAudit.Mode	1
verb	string	2	verb overrides the derived verb: "create", "update", "delete", "invoke" or "read".
resourceType	string	3	resource_type overrides the type derived from the service name (ModelAliasService -> model_alias).
resourceIdField	string	4	resource_id_field names the request field carrying the resource id. Set it when the id is not <resource_type>_id, "name" or "id".

MethodAudit.Mode

Mode forces the audit decision instead of deriving it.

Value	Number	Description
MODE_UNSPECIFIED	0	Derive from idempotency_level, then the method name prefix.
MODE_ALWAYS	1	Audit even though the method reads. For reads that return data sensitive enough that access to it is itself worth recording.
MODE_NEVER	2	Never audit, even though the method mutates.