Interface IAuditEntryFactory
Builds an audit entry with the caller already resolved — an HTTP principal when there is one, the declared AuditActor when there is not.
public interface IAuditEntryFactoryRemarks
Without this, a consumer writing its own entry constructs AuditEntry by hand and passes it to Log(AuditEntry), which never consults the ambient actor — so background work could declare an actor and still write entries attributed to nobody. Build entries here and hand the result to the logger.
Methods
Create(string, string, string, long, bool, string, string, IReadOnlyDictionary<string, string>)
Builds an entry for a consumer-defined operation, with the caller filled in. The entry is recorded as ServiceCall.
AuditEntry Create(string feature, string action, string methodName = null, long durationMs = 0, bool success = true, string errorMessage = null, string teamKey = null, IReadOnlyDictionary<string, string> metadata = null)Parameters
featurestringThe area acted on — the left half of a scope, e.g.
"job".actionstringWhat was done — the right half, e.g.
"claim".methodNamestringOptional method or step name, for the log's Method column.
durationMslongHow long the operation took, if measured.
successboolWhether it succeeded. False routes it to the failure styling in the log view.
errorMessagestringWhy it failed, shown in the failure tooltip and the exports.
teamKeystringThe team acted on. Supply it for background work — there is no selected team to infer.
metadataIReadOnlyDictionary<string, string>What changed, surfaced in the log's detail row.
Returns
Remarks
Prefer the overload taking an AuditEventType for anything that changed something. The enforcement proxies record their per-call access traces as ServiceCall too, so an entry written through this overload cannot be told apart from them by the Event filter — and on a busy tenant the traces outnumber the domain entries several times over.
Create(AuditEventType, string, string, string, long, bool, string, string, IReadOnlyDictionary<string, string>)
Builds an entry classified as eventType, so a reader can tell what someone did
from what someone was permitted to call.
AuditEntry Create(AuditEventType eventType, string feature, string action, string methodName = null, long durationMs = 0, bool success = true, string errorMessage = null, string teamKey = null, IReadOnlyDictionary<string, string> metadata = null)Parameters
eventTypeAuditEventTypeHow to classify the entry, e.g. DataChange.
featurestringThe area acted on — the left half of a scope, e.g.
"job".actionstringWhat was done — the right half, e.g.
"claim".methodNamestringOptional method or step name, for the log's Method column.
durationMslongHow long the operation took, if measured.
successboolWhether it succeeded. False routes it to the failure styling in the log view.
errorMessagestringWhy it failed, shown in the failure tooltip and the exports.
teamKeystringThe team acted on. Supply it for background work — there is no selected team to infer.
metadataIReadOnlyDictionary<string, string>What changed, surfaced in the log's detail row.
Returns
Remarks
The event type is what makes the log's Event filter useful to a consumer. Without it every consumer-written entry lands as ServiceCall — the same value the scope proxy writes for each authorized call — and the one distinction a reader cares about is the one the filter cannot express. Use DataChange for an operation that altered something.
The event type does not change how the entry is stored, retained or authorized. It is a classification for reading, and it is free-standing: the enforcement proxies keep writing their own entries for the same call regardless.