42 lines
2 KiB
SQL
42 lines
2 KiB
SQL
-- Postgres schema for the scoble_policy_audit log.
|
|
-- Mirrors the audit shape that OPA produces.
|
|
-- Time-partitioned (assumes pg_partman or a manual monthly partition
|
|
-- rotation script; for personal-cluster scale a single table is fine).
|
|
--
|
|
-- MIGRATION NOTE (2026-06-07): the previous table (with a decision_id/actor/action/
|
|
-- resource/verdict/metadata shape) was dropped and replaced with this shape.
|
|
-- The audit-sink Integration (audit-sink-integration.yaml) has always targeted
|
|
-- this shape (agent_id/kamelet_ref/decision/reasons/rule_id/request_id).
|
|
-- Run as the `postgres` superuser or a role that owns the table.
|
|
|
|
CREATE TABLE IF NOT EXISTS scoble_policy_audit (
|
|
id BIGSERIAL PRIMARY KEY,
|
|
timestamp TIMESTAMPTZ NOT NULL,
|
|
agent_id TEXT NOT NULL,
|
|
kamelet_ref TEXT NOT NULL,
|
|
decision TEXT NOT NULL CHECK (decision IN ('allow', 'deny', 'needs_l1', 'pending', 'escalated')),
|
|
reasons JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
rule_id TEXT,
|
|
request_id TEXT NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
|
|
-- Index for "what did agent X do in the last hour" queries.
|
|
CREATE INDEX IF NOT EXISTS scoble_policy_audit_agent_time
|
|
ON scoble_policy_audit (agent_id, timestamp DESC);
|
|
|
|
-- Index for "all denies in the last 24h" queries.
|
|
CREATE INDEX IF NOT EXISTS scoble_policy_audit_decision_time
|
|
ON scoble_policy_audit (decision, timestamp DESC)
|
|
WHERE decision = 'deny';
|
|
|
|
-- Index for traceability by request_id (correlation across services).
|
|
CREATE UNIQUE INDEX IF NOT EXISTS scoble_policy_audit_request_id
|
|
ON scoble_policy_audit (request_id);
|
|
|
|
-- Grant INSERT (and SELECT for readback) to the audit-sink role.
|
|
-- The CNPG managed.roles controller will only set the password, not the
|
|
-- GRANTs. These are durable as long as the role exists and the table
|
|
-- doesn't get dropped.
|
|
GRANT SELECT, INSERT ON scoble_policy_audit TO scoble_audit_writer;
|
|
GRANT USAGE, SELECT ON SEQUENCE scoble_policy_audit_id_seq TO scoble_audit_writer;
|