Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

alembic/versions/0005_audit_events.py

@@ -0,0 +1,99 @@
+"""Create append-only, redacted audit event storage."""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0005_audit_events"
+down_revision = "0004_space_data_policy"
+branch_labels = None
+depends_on = None
+
+_TRIGGER_FUNCTION = "prevent_audit_event_mutation"
+_ROW_TRIGGER = "trg_audit_events_append_only_row"
+_TRUNCATE_TRIGGER = "trg_audit_events_append_only_truncate"
+
+
+def upgrade() -> None:
+    """Create audit storage and reject database-level mutation attempts."""
+
+    op.execute(sa.text("CREATE SCHEMA IF NOT EXISTS audit"))
+    op.create_table(
+        "audit_events",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("workspace_id", sa.Uuid(), nullable=False),
+        sa.Column("event_type", sa.String(128), nullable=False),
+        sa.Column("occurred_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("trace_id", sa.String(128), nullable=False),
+        sa.Column("correlation_id", sa.String(128), nullable=True),
+        sa.Column("actor_id", sa.Uuid(), nullable=True),
+        sa.Column("application_id", sa.Uuid(), nullable=True),
+        sa.Column("resource_type", sa.String(128), nullable=True),
+        sa.Column("resource_id", sa.Uuid(), nullable=True),
+        sa.Column("details", sa.JSON(), nullable=False),
+        sa.ForeignKeyConstraint(
+            ["workspace_id"], ["control.workspaces.id"], ondelete="RESTRICT"
+        ),
+        schema="audit",
+    )
+    op.create_index(
+        "ix_audit_events_workspace_occurred",
+        "audit_events",
+        ["workspace_id", "occurred_at"],
+        schema="audit",
+    )
+    op.create_index(
+        "ix_audit_events_workspace_type",
+        "audit_events",
+        ["workspace_id", "event_type"],
+        schema="audit",
+    )
+    op.execute(
+        sa.text(
+            f"""
+            CREATE FUNCTION audit.{_TRIGGER_FUNCTION}()
+            RETURNS trigger
+            LANGUAGE plpgsql
+            AS $$
+            BEGIN
+                RAISE EXCEPTION 'audit events are append-only';
+            END;
+            $$
+            """
+        )
+    )
+    op.execute(
+        sa.text(
+            f"""
+            CREATE TRIGGER {_ROW_TRIGGER}
+            BEFORE UPDATE OR DELETE ON audit.audit_events
+            FOR EACH ROW EXECUTE FUNCTION audit.{_TRIGGER_FUNCTION}()
+            """
+        )
+    )
+    op.execute(
+        sa.text(
+            f"""
+            CREATE TRIGGER {_TRUNCATE_TRIGGER}
+            BEFORE TRUNCATE ON audit.audit_events
+            FOR EACH STATEMENT EXECUTE FUNCTION audit.{_TRIGGER_FUNCTION}()
+            """
+        )
+    )
+
+
+def downgrade() -> None:
+    """Remove only the audit objects introduced by this migration."""
+
+    op.execute(sa.text(f"DROP TRIGGER IF EXISTS {_TRUNCATE_TRIGGER} ON audit.audit_events"))
+    op.execute(sa.text(f"DROP TRIGGER IF EXISTS {_ROW_TRIGGER} ON audit.audit_events"))
+    op.drop_index(
+        "ix_audit_events_workspace_type", table_name="audit_events", schema="audit"
+    )
+    op.drop_index(
+        "ix_audit_events_workspace_occurred", table_name="audit_events", schema="audit"
+    )
+    op.drop_table("audit_events", schema="audit")
+    op.execute(sa.text(f"DROP FUNCTION IF EXISTS audit.{_TRIGGER_FUNCTION}()"))
+    op.execute(sa.text("DROP SCHEMA IF EXISTS audit"))