// @bun
// src/components/docs/safety/SafetyAuditingPage.tsx
import Link from "@contractspec/lib.ui-link";
import { ChevronRight } from "lucide-react";
import { jsx, jsxs } from "react/jsx-runtime";
function SafetyAuditingPage() {
  return /* @__PURE__ */ jsxs("div", {
    className: "space-y-8",
    children: [
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h1", {
            className: "text-4xl font-bold",
            children: "Audit Logs"
          }),
          /* @__PURE__ */ jsxs("p", {
            className: "text-muted-foreground",
            children: [
              "An ",
              /* @__PURE__ */ jsx("strong", {
                children: "audit log"
              }),
              " (also called an audit trail) is a chronological record of system activities. According to",
              " ",
              /* @__PURE__ */ jsx("a", {
                href: "https://www.sumologic.com/glossary/audit-log/",
                target: "_blank",
                rel: "noopener noreferrer",
                className: "text-violet-400 hover:text-violet-300",
                children: "Sumo Logic"
              }),
              ', audit logs "provide a detailed record of events and changes within a system, enabling organizations to track user actions, system changes, and access to sensitive data."'
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Why audit logs matter"
          }),
          /* @__PURE__ */ jsxs("div", {
            className: "space-y-3",
            children: [
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Accountability"
                  }),
                  /* @__PURE__ */ jsx("p", {
                    className: "text-muted-foreground",
                    children: 'Audit logs answer the question "who did what, when?" This is essential for holding users and administrators accountable for their actions. If data is deleted or modified, the audit log shows exactly who made the change.'
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Security"
                  }),
                  /* @__PURE__ */ jsx("p", {
                    className: "text-muted-foreground",
                    children: "Audit logs help detect and investigate security incidents. For example, if an attacker gains unauthorized access, the logs reveal which resources they accessed and what actions they performed. This information is critical for incident response and forensics."
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Compliance"
                  }),
                  /* @__PURE__ */ jsx("p", {
                    className: "text-muted-foreground",
                    children: "Many regulations (GDPR, HIPAA, SOC 2, PCI DSS) require organizations to maintain audit logs. These logs must be tamper-evident, retained for a specified period, and available for inspection by auditors."
                  })
                ]
              }),
              /* @__PURE__ */ jsxs("div", {
                children: [
                  /* @__PURE__ */ jsx("h3", {
                    className: "text-lg font-semibold",
                    children: "Debugging"
                  }),
                  /* @__PURE__ */ jsx("p", {
                    className: "text-muted-foreground",
                    children: "When something goes wrong in production, audit logs provide a detailed timeline of events leading up to the failure. This makes it much easier to diagnose and fix issues."
                  })
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "What ContractSpec logs"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "ContractSpec automatically logs every significant operation, including:"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "API calls"
                  }),
                  " \u2013 Every invocation of a capability, including inputs, outputs, and the user who made the call."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Policy decisions"
                  }),
                  " \u2013 Every decision made by the",
                  " ",
                  /* @__PURE__ */ jsx(Link, {
                    href: "/docs/safety/pdp",
                    className: "text-violet-400 hover:text-violet-300",
                    children: "Policy Decision Point"
                  }),
                  ", including the rule that matched and the reason for the decision."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Data access"
                  }),
                  " \u2013 Every query to a data view, including which fields were accessed and whether any were redacted."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Workflow execution"
                  }),
                  " \u2013 Every step in a workflow, including retries, compensations, and failures."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Administrative actions"
                  }),
                  " \u2013 Spec deployments, configuration changes, user role assignments, and other privileged operations."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Authentication events"
                  }),
                  " \u2013 Login attempts, password resets, and session expirations."
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Audit log format"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Each audit log entry is a structured JSON object containing:"
          }),
          /* @__PURE__ */ jsx("div", {
            className: "bg-background/50 border-border text-muted-foreground overflow-x-auto rounded-lg border p-4 font-mono text-sm",
            children: /* @__PURE__ */ jsx("pre", {
              children: `{
  "timestamp": "2025-11-13T14:32:15.123Z",
  "eventId": "evt_abc123",
  "eventType": "capability.invoked",
  "actor": {
    "userId": "user_xyz789",
    "role": "admin",
    "ipAddress": "203.0.113.42"
  },
  "resource": {
    "type": "capability",
    "id": "transferFunds",
    "version": "1.2.0"
  },
  "action": "execute",
  "result": "success",
  "metadata": {
    "inputs": {
      "recipient": "user_def456",
      "amount": 100.00
    },
    "outputs": {
      "transactionId": "txn_ghi789",
      "timestamp": "2025-11-13T14:32:15.456Z"
    }
  },
  "policyDecision": {
    "decision": "PERMIT",
    "ruleId": "allow-admin-transfers",
    "reason": "User has admin role"
  }
}`
            })
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Storage and retention"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "Audit logs are stored in a tamper-evident append-only log. Once written, entries cannot be modified or deleted. This ensures the integrity of the audit trail."
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "ContractSpec supports multiple storage backends:"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Local file system"
                  }),
                  " \u2013 For development and testing."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Cloud object storage"
                  }),
                  " \u2013 S3, GCS, or Azure Blob Storage for production."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "SIEM integration"
                  }),
                  " \u2013 Forward logs to Splunk, Datadog, or other security information and event management systems."
                ]
              })
            ]
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "You can configure retention policies to automatically archive or delete old logs after a specified period (e.g., 7 years for GDPR compliance)."
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Querying audit logs"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: "ContractSpec provides a query API for searching audit logs. You can filter by:"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsx("li", {
                children: "Time range"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Event type"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Actor (user ID, role, IP address)"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Resource (capability, data view, workflow)"
              }),
              /* @__PURE__ */ jsx("li", {
                children: "Result (success, failure, denied)"
              })
            ]
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground",
            children: 'Example query: "Show all failed login attempts from IP address 203.0.113.42 in the last 24 hours."'
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Best practices"
          }),
          /* @__PURE__ */ jsxs("ul", {
            className: "text-muted-foreground list-inside list-disc space-y-2",
            children: [
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Review logs regularly"
                  }),
                  " \u2013 Set up alerts for suspicious activity (e.g., repeated failed login attempts, unauthorized access attempts)."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Protect log access"
                  }),
                  " \u2013 Only authorized personnel should be able to view audit logs. Use role-based access control to restrict access."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Retain logs long enough"
                  }),
                  " \u2013 Check your compliance requirements and configure retention policies accordingly."
                ]
              }),
              /* @__PURE__ */ jsxs("li", {
                children: [
                  /* @__PURE__ */ jsx("strong", {
                    children: "Test log integrity"
                  }),
                  " \u2013 Periodically verify that logs have not been tampered with by checking cryptographic signatures."
                ]
              })
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "flex items-center gap-4 pt-4",
        children: [
          /* @__PURE__ */ jsx(Link, {
            href: "/docs/safety/pdp",
            className: "btn-ghost",
            children: "Previous: Policy Decision Points"
          }),
          /* @__PURE__ */ jsxs(Link, {
            href: "/docs/safety/migrations",
            className: "btn-primary",
            children: [
              "Next: Migrations ",
              /* @__PURE__ */ jsx(ChevronRight, {
                size: 16
              })
            ]
          })
        ]
      })
    ]
  });
}
export {
  SafetyAuditingPage
};
