OpenClaw Audit Logging Setup

// moltbot/lib/audit-logger.ts
import { db } from './db';

interface AuditEvent {
  event_type: 'auth.login' | 'auth.logout' | 'auth.failed' | 'data.read' | 'data.write' | 'data.delete' | 'admin.action' | 'security.alert';
  actor_id: string;
  actor_type: 'user' | 'api_key' | 'system';
  resource_type: string;
  resource_id: string;
  action: string;
  ip_address: string;
  user_agent: string;
  result: 'success' | 'failure' | 'blocked';
  metadata?: Record<string, unknown>;
}

export async function logAuditEvent(event: AuditEvent): Promise<void> {
  const entry = {
    ...event,
    timestamp: new Date().toISOString(),
    server_id: process.env.SERVER_ID ?? 'unknown',
    version: '1.0',
  };

  // Parallel: DB + Syslog (für externe SIEM-Integration)
  await Promise.all([
    db.query(
      'INSERT INTO audit_log (event_type, actor_id, actor_type, resource_type, resource_id, action, ip, user_agent, result, metadata, created_at) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,NOW())',
      [entry.event_type, entry.actor_id, entry.actor_type, entry.resource_type, entry.resource_id, entry.action, entry.ip_address, entry.user_agent, entry.result, JSON.stringify(entry.metadata)]
    ),
    // Structured syslog (für Splunk/Datadog/ELK)
    process.stdout.write(JSON.stringify({ level: 'audit', ...entry }) + '\n'),
  ]);
}