Module audit 

Audit trail of every mutating operation, produced to Kafka.

manta-server is the single chokepoint for every backend call, so it is where auditing lives — the CLI emits nothing. The pieces:

• audit_requests — router middleware that turns every mutating /v2/* request (any method except GET/HEAD/OPTIONS) and every console attach into one event::AuditEvent, emitted after the response is known. New routes are covered without any per-handler code.
• AuditNote — extractor through which a handler adds what only it knows: a stable action name, the targets, the dry-run flag.
• AuditLog — fans each event out to its AuditSinks: always a tracing line on the AUDIT_TARGET target, plus Kafka (kafka::KafkaSink) when [auditor.kafka] is configured.
• send_auth_audit — the /v2/auth/token attempt event.

Auditing is fail-open: a broker outage is logged and never fails or slows the request.

Modules

event

The audit event wire shape (schema_version 1).

kafka

Kafka destination for audit events.

Structs

AuditLog

The server’s audit trail: builds events and fans them out to sinks. Cheap to clone.

AuditNote

Handler-side handle on the current request’s audit event.

Auditor

[auditor] section of server.toml.

Constants

AUDIT_TARGET

tracing target of the always-on log copy of every audit event.

Traits

AuditSink

A destination for audit events.

Functions

audit_requests

Router middleware: emit one event::AuditEvent per audited request once its response is known. Layered outside the request timeout, so timed-out requests are recorded too. Requests that matched no route (404) or no method (405) are not audited — nothing was attempted.

send_auth_audit

Emit an EventKind::AuthAttempt event for a /v2/auth/token call.