alt/packages/domain/trading/audit.go

package trading

// AuditEventType identifies the kind of live operation audit event. The
// vocabulary is additive: new types can be introduced without changing the
// type definition or requiring a migration.
type AuditEventType string

const (
	AuditEventTypeSubmitConfirmed    AuditEventType = "submit_confirmed"
	AuditEventTypeBrokerAccepted     AuditEventType = "broker_accepted"
	AuditEventTypeBrokerRejected     AuditEventType = "broker_rejected"
	AuditEventTypeCancelConfirmed    AuditEventType = "cancel_confirmed"
	AuditEventTypeRiskBlocked        AuditEventType = "risk_blocked"
	AuditEventTypeKillSwitchSet      AuditEventType = "kill_switch_set"
	AuditEventTypeAccountSyncSuccess AuditEventType = "account_sync_success"
	AuditEventTypeAccountSyncFailure AuditEventType = "account_sync_failure"
)

// AuditFilter selects a subset of live audit events for a list query. A
// zero-value AuditFilter matches all events with no further restriction.
type AuditFilter struct {
	AccountID string
	OrderID   string
	EventType AuditEventType
	Limit     int
}

// blockedPayloadKeys is the set of map keys that must never appear in an audit
// event payload. Raw secrets, tokens, and provider-specific identifiers are
// forbidden at the domain boundary.
var blockedPayloadKeys = []string{
	"token", "access_token", "secret", "password",
	"raw_account_number", "api_key", "authorization", "raw_body",
}

// HasRawSecretKey returns true if payload contains a key from the blocked
// list. Callers that build audit payloads must reject payloads that fail this
// check before appending to storage.
func HasRawSecretKey(payload map[string]string) bool {
	for _, blocked := range blockedPayloadKeys {
		if _, ok := payload[blocked]; ok {
			return true
		}
	}
	return false
}