Interface IAuditReadService

Namespace

Tharga.Team.Service.Audit

Assembly

Tharga.Team.Service.dll

Reading one team's audit log. The interface every surface injects — the Blazor view, the REST endpoint and the MCP resource alike.

public interface IAuditReadService

Remarks

Authorization is the attribute, enforced by ScopeProxy against the team named in the first argument. No surface checks anything itself, which is the whole point: audit was the last part of the toolkit still gated at its surfaces, and the three had already drifted — the UI and REST asked AuditAccess.CanRead while MCP asked whether the caller held a host-configurable role, so the same API key got different answers from different doors.

Reading across every team lives on IAuditOversightService. The split is not stylistic: a team-bound service must name a team, so no call on this interface can reach past one. Invariant I1 — a team API key never reaches system-wide audit — becomes a property of the shape rather than a check somebody remembered to write.

Methods

QueryAsync(string, AuditQuery)

Audit entries for teamKey, newest first. Requires audit:read on that team — held directly, or through an access level the team consented to.

[RequireScope("audit:read")]
Task<AuditQueryResult> QueryAsync(string teamKey, AuditQuery query)

Parameters

teamKey string

query AuditQuery

Returns

Task<AuditQueryResult>

Remarks

teamKey is first because ScopeProxy resolves the target team from it. Any TeamKey on query is overwritten with it, so a caller authorized for one team cannot widen the query past the team they were checked against.