feat(audit): локальный журнал и push в auth-portal

Таблица audit_log, recordAudit на CRUD, GET /api/v1/audit и dual-write source_app=cfdm.

Co-authored-by: Cursor <[email protected]>

packages/shared/dist/index.js

@@ -601,7 +601,69 @@ var vpsTrackerEventSchema = z3.object({
   ),
   timestamp: z3.string().datetime().optional()
 });
+
+// src/audit.ts
+import { z as z4 } from "zod";
+var AUDIT_SEVERITIES = ["info", "warning", "critical"];
+var auditSeveritySchema = z4.enum(AUDIT_SEVERITIES);
+var AUDIT_SOURCE_APPS = [
+  "portal",
+  "vps",
+  "cfdm",
+  "bgp",
+  "fw"
+];
+var auditSourceAppSchema = z4.enum(AUDIT_SOURCE_APPS);
+var AUDIT_TARGET_TYPES = [
+  "user",
+  "settings",
+  "session",
+  "system",
+  "app_resource"
+];
+var auditTargetTypeSchema = z4.enum(AUDIT_TARGET_TYPES);
+var auditLogEntrySchema = z4.object({
+  id: z4.string(),
+  event_id: z4.string().nullable(),
+  source_app: auditSourceAppSchema,
+  action: z4.string(),
+  severity: auditSeveritySchema,
+  actor_user_id: z4.string().nullable(),
+  actor_email: z4.string().nullable(),
+  actor_name: z4.string().nullable(),
+  target_type: auditTargetTypeSchema.nullable(),
+  target_id: z4.string().nullable(),
+  summary: z4.string(),
+  details: z4.record(z4.string(), z4.unknown()).nullable(),
+  ip: z4.string().nullable(),
+  created_at: z4.string()
+});
+var auditListQuerySchema = z4.object({
+  action: z4.string().optional(),
+  severity: auditSeveritySchema.optional(),
+  user_id: z4.string().optional(),
+  source_app: auditSourceAppSchema.optional(),
+  limit: z4.coerce.number().int().min(1).max(500).default(200)
+});
+var ingestAuditEventSchema = z4.object({
+  event_id: z4.string().min(1).max(128),
+  source_app: z4.enum(["vps", "cfdm", "bgp", "fw"]),
+  action: z4.string().min(1).max(200),
+  severity: auditSeveritySchema.optional(),
+  actor_user_id: z4.string().nullable().optional(),
+  actor_email: z4.string().email().nullable().optional(),
+  actor_name: z4.string().nullable().optional(),
+  target_type: auditTargetTypeSchema.nullable().optional(),
+  target_id: z4.string().nullable().optional(),
+  summary: z4.string().min(1).max(500),
+  details: z4.record(z4.string(), z4.unknown()).nullable().optional(),
+  ip: z4.string().nullable().optional(),
+  created_at: z4.string().optional()
+});
 export {
+  AUDIT_SEVERITIES,
+  AUDIT_SOURCE_APPS,
+  AUDIT_TARGET_TYPES,
   CERT_ERROR,
   CERT_EXPIRED,
   CERT_MONITORING_VALUES,
@@ -621,6 +683,11 @@ export {
   appSwitcherConfigSchema,
   appSwitcherEntrySchema,
   appSwitcherIconSchema,
+  auditListQuerySchema,
+  auditLogEntrySchema,
+  auditSeveritySchema,
+  auditSourceAppSchema,
+  auditTargetTypeSchema,
   bindingToFqdn,
   bulkUpdateDomainsSchema,
   certMonitoringSchema,
@@ -653,6 +720,7 @@ export {
   healthCheckScopeSchema,
   healthCheckTypeSchema,
   healthStatusQuerySchema,
+  ingestAuditEventSchema,
   ipHealthStateSchema,
   ipHealthStatusSchema,
   isValidIpv4,