@@ -44,6 +44,12 @@ type EnrichmentEntity struct {
4444 Identifier string `json:"identifier"`
4545}
4646
47+ // AdditionalInfoEntry is a typed extra-info bag; publish may emit an empty marker that enrichment fills.
48+ type AdditionalInfoEntry struct {
49+ Type AuditInfoType `json:"type"`
50+ Data map [string ]interface {} `json:"data,omitempty"`
51+ }
52+
4753// AuditLogEvent is the canonical NATS payload published on AUDIT_LOG_TOPIC.
4854// It is shared between the publisher (orchestrator) and the consumer
4955// (audit-log service) so both agree on the contract.
@@ -61,6 +67,8 @@ type AuditLogEvent struct {
6167 ResponseTime time.Duration `json:"responseTime"` // request handling duration (nanoseconds)
6268 Payload map [string ]interface {} `json:"payload"` // the actual request body of the audited call, always present
6369 EnrichmentContext map [string ]EnrichmentEntity `json:"enrichmentContext,omitempty"`
70+ Role string `json:"role,omitempty"` // display name of the acting user's role scoped to the resource acted upon (e.g. "Super Admin", "Manager")
71+ AdditionalInfo []AdditionalInfoEntry `json:"additionalInfo,omitempty"` // typed extra info (e.g. config diff coordinates), filled at enrich time
6472}
6573
6674// NewAuditLogEvent constructs an event with the structural metadata parsed
@@ -114,6 +122,13 @@ func (e *AuditLogEvent) WithAction(action string) *AuditLogEvent {
114122 return e
115123}
116124
125+ // WithRole sets the display name of the acting user's role scoped to the resource
126+ // acted upon (e.g. "Super Admin", "Manager").
127+ func (e * AuditLogEvent ) WithRole (role string ) * AuditLogEvent {
128+ e .Role = role
129+ return e
130+ }
131+
117132// WithPayloadField adds a single key/value to the payload bag.
118133func (e * AuditLogEvent ) WithPayloadField (key string , value interface {}) * AuditLogEvent {
119134 if e .Payload == nil {
@@ -137,6 +152,12 @@ func (e *AuditLogEvent) WithEnrichment(entity, identifier string) *AuditLogEvent
137152 return e
138153}
139154
155+ // WithAdditionalInfo appends a typed extra-info entry (publish stamps an empty marker; enrichment fills it).
156+ func (e * AuditLogEvent ) WithAdditionalInfo (infoType AuditInfoType , data map [string ]interface {}) * AuditLogEvent {
157+ e .AdditionalInfo = append (e .AdditionalInfo , AdditionalInfoEntry {Type : infoType , Data : data })
158+ return e
159+ }
160+
140161// Marshal serializes the event to a JSON string for PubSubClientService.Publish.
141162func (e * AuditLogEvent ) Marshal () (string , error ) {
142163 data , err := json .Marshal (e )
0 commit comments