mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-02 11:29:17 +00:00
overtrue
dbfe3519af
`OperationContext` carried identity and correlation data that nothing ever constructed or read, so key creation, rotation and deletion left no trace of who requested them. Give every management operation a `*_with_context` entry point that builds a `KmsAuditRecord` and hands it to an installed `KmsAuditSink`. The record answers who acted on which key, against which backend, with what outcome and error class, and how long it took. Existing entry points delegate with an explicitly internal principal, so an unattributed call is distinguishable from an identity that was lost. The backend trait is untouched: auditing sits at the layer that has an identity, mirroring how metrics sit at the backend choke point. The sink is optional and no records are built without one, so a deployment that does not consume them is unaffected. Records also cover the background sweep that destroys expired key material, which is otherwise the least observable operation in the crate. Redaction is structural rather than advisory: a record has no field that can hold key material, and caller-supplied encryption context passes through an allowlist that digests everything it does not recognise. Tenant attribution is deliberately left out until tenancy is modelled. Refs rustfs/backlog#1583 (part of rustfs/backlog#1562)