Class: Smplkit::Audit::Forwarder

Inherits:
Object
  • Object
show all
Defined in:
lib/smplkit/audit/models.rb

Overview

A SIEM streaming forwarder configured on the customer’s account.

Active-record style: instantiate via mgmt.audit.forwarders.new_forwarder(…), mutate fields directly, and call #save to persist or #delete to remove. Header values in configuration.headers are returned redacted on reads — the GET path on the audit API replaces every header value with “<redacted>”. Re-supply real values before calling #save; the SDK does not cache them client-side.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(client = nil, name:, forwarder_type:, configuration:, id: nil, enabled: false, environments: nil, description: nil, filter: nil, transform: nil, transform_type: nil, created_at: nil, updated_at: nil, deleted_at: nil, version: nil) ⇒ Forwarder

Returns a new instance of Forwarder.



447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
 
# File 'lib/smplkit/audit/models.rb', line 447

def initialize(client = nil, name:, forwarder_type:, configuration:,
               id: nil, enabled: false, environments: nil, description: nil,
               filter: nil, transform: nil, transform_type: nil,
               created_at: nil, updated_at: nil, deleted_at: nil, version: nil)
  @client = client
  @id = id
  @name = name
  @forwarder_type = ForwarderType.coerce(forwarder_type)
  @configuration = configuration
  # ``enabled`` is server-pinned false; we keep the attribute so reads
  # round-trip the server value, but enablement is driven by
  # ``environments`` (see the class docstring).
  @enabled = enabled
  @environments = environments || {}
  @description = description
  @filter = filter
  @transform = transform
  @transform_type = TransformType.coerce(transform_type)
  @created_at = created_at
  @updated_at = updated_at
  @deleted_at = deleted_at
  @version = version
end

Instance Attribute Details

#configuration ⇒ HttpConfiguration

Returns Destination request configuration.

Returns:



414
415
416
 
# File 'lib/smplkit/audit/models.rb', line 414

def configuration
  @configuration
end

#created_at ⇒ String?

Returns ISO-8601 timestamp of first persist. nil for an unsaved instance.

Returns:

  • (String, nil) —

    ISO-8601 timestamp of first persist. nil for an unsaved instance.



436
437
438
 
# File 'lib/smplkit/audit/models.rb', line 436

def created_at
  @created_at
end

#deleted_at ⇒ String?

Returns Soft-delete timestamp. nil for live forwarders.

Returns:

  • (String, nil) —

    Soft-delete timestamp. nil for live forwarders.



442
443
444
 
# File 'lib/smplkit/audit/models.rb', line 442

def deleted_at
  @deleted_at
end

#description ⇒ String?

Returns Optional free-text description.

Returns:

  • (String, nil) —

    Optional free-text description.



417
418
419
 
# File 'lib/smplkit/audit/models.rb', line 417

def description
  @description
end

#enabled ⇒ Boolean

Returns Read-only. Always false — the base enablement is pinned off. Whether a forwarder actually delivers is decided per environment via #environments; mutating this field has no effect on the server.

Returns:

  • (Boolean) —

    Read-only. Always false — the base enablement is pinned off. Whether a forwarder actually delivers is decided per environment via #environments; mutating this field has no effect on the server.



402
403
404
 
# File 'lib/smplkit/audit/models.rb', line 402

def enabled
  @enabled
end

#environments ⇒ Hash{String => ForwarderEnvironment}

Returns Per-environment overrides keyed by environment key (e.g. “production”, “staging”). A forwarder delivers in an environment only when environments[env].enabled is true. Each entry may carry an optional HttpConfiguration override; omit it to inherit the base #configuration. Every referenced environment must exist and be managed for the account.

Returns:

  • (Hash{String => ForwarderEnvironment}) —

    Per-environment overrides keyed by environment key (e.g. “production”, “staging”). A forwarder delivers in an environment only when environments[env].enabled is true. Each entry may carry an optional HttpConfiguration override; omit it to inherit the base #configuration. Every referenced environment must exist and be managed for the account.



411
412
413
 
# File 'lib/smplkit/audit/models.rb', line 411

def environments
  @environments
end

#filter ⇒ Hash?

Returns Optional JSON Logic expression evaluated per event. When set, events that don’t match are recorded as filtered_out deliveries instead of being delivered to the destination.

Returns:

  • (Hash, nil) —

    Optional JSON Logic expression evaluated per event. When set, events that don’t match are recorded as filtered_out deliveries instead of being delivered to the destination.



422
423
424
 
# File 'lib/smplkit/audit/models.rb', line 422

def filter
  @filter
end

#forwarder_type ⇒ String

Returns One of Smplkit::Audit::ForwarderType::VALUES.

Returns:



396
397
398
 
# File 'lib/smplkit/audit/models.rb', line 396

def forwarder_type
  @forwarder_type
end

#id ⇒ String?

Returns Caller-supplied unique identifier (key) for this forwarder. Unique within an account; immutable for the lifetime of the forwarder. nil only while the object represents an unsaved instance constructed without an id (which #save would then reject).

Returns:

  • (String, nil) —

    Caller-supplied unique identifier (key) for this forwarder. Unique within an account; immutable for the lifetime of the forwarder. nil only while the object represents an unsaved instance constructed without an id (which #save would then reject).



390
391
392
 
# File 'lib/smplkit/audit/models.rb', line 390

def id
  @id
end

#name ⇒ String

Returns Display name. Free-form.

Returns:

  • (String) —

    Display name. Free-form.



393
394
395
 
# File 'lib/smplkit/audit/models.rb', line 393

def name
  @name
end

#transform ⇒ Object?

Returns Optional template applied to each event before delivery. Free-form — the audit service passes the value verbatim to the engine named by #transform_type. For TransformType::JSONATA a JSONata expression string; nil delivers the event JSON as-is. Must be paired with a non-nil #transform_type.

Returns:

  • (Object, nil) —

    Optional template applied to each event before delivery. Free-form — the audit service passes the value verbatim to the engine named by #transform_type. For TransformType::JSONATA a JSONata expression string; nil delivers the event JSON as-is. Must be paired with a non-nil #transform_type.



429
430
431
 
# File 'lib/smplkit/audit/models.rb', line 429

def transform
  @transform
end

#transform_type ⇒ String?

Returns Engine that evaluates #transform — one of TransformType::VALUES. Required whenever #transform is set.

Returns:



433
434
435
 
# File 'lib/smplkit/audit/models.rb', line 433

def transform_type
  @transform_type
end

#updated_at ⇒ String?

Returns ISO-8601 timestamp of the most recent mutation.

Returns:

  • (String, nil) —

    ISO-8601 timestamp of the most recent mutation.



439
440
441
 
# File 'lib/smplkit/audit/models.rb', line 439

def updated_at
  @updated_at
end

#version ⇒ Integer?

Returns Monotonic version counter, bumped on every server-side write.

Returns:

  • (Integer, nil) —

    Monotonic version counter, bumped on every server-side write.



445
446
447
 
# File 'lib/smplkit/audit/models.rb', line 445

def version
  @version
end

Class Method Details

.from_resource(resource, client: nil) ⇒ Object 



541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
 
# File 'lib/smplkit/audit/models.rb', line 541

def self.from_resource(resource, client: nil)
  a = resource.attributes
  environments = (a.environments || {}).each_with_object({}) do |(env_key, env_raw), out|
    out[env_key.to_s] = ForwarderEnvironment.from_wire(env_raw)
  end
  new(
    client,
    id: resource.id,
    name: a.name,
    description: a.description,
    forwarder_type: a.forwarder_type,
    # The base ``enabled`` is server-pinned false; round-trip whatever
    # the server returned (always false) without assuming a default of
    # true.
    enabled: a.enabled.nil? ? false : a.enabled,
    environments: environments,
    filter: a.filter.nil? ? nil : Smplkit::Helpers.deep_stringify_keys(a.filter),
    transform_type: a.transform_type,
    transform: a.transform,
    configuration: HttpConfiguration.from_wire(a.configuration),
    created_at: a.created_at,
    updated_at: a.updated_at,
    deleted_at: a.deleted_at,
    version: a.version
  )
end

.validate_transform_pair!(transform, transform_type) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Validate the (transform, transform_type) pair.

Both must be nil or both must be set. When transform_type is TransformType::JSONATA, transform must be a String (the JSONata expression). Other engines accept any value.

Raises:

  • (ArgumentError) 


528
529
530
531
532
533
534
535
536
537
538
539
 
# File 'lib/smplkit/audit/models.rb', line 528

def self.validate_transform_pair!(transform, transform_type)
  if transform.nil? != transform_type.nil?
    raise ArgumentError,
          "transform and transform_type must be specified together (both nil or both set)"
  end
  return if transform.nil?
  return unless transform_type == TransformType::JSONATA && !transform.is_a?(String)

  raise ArgumentError,
        "transform must be a String when transform_type is JSONATA " \
        "(got #{transform.class})"
end

Instance Method Details

#_apply(other) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
 
# File 'lib/smplkit/audit/models.rb', line 504

def _apply(other)
  @id = other.id
  @name = other.name
  @forwarder_type = other.forwarder_type
  @configuration = other.configuration
  @enabled = other.enabled
  @environments = other.environments
  @description = other.description
  @filter = other.filter
  @transform = other.transform
  @transform_type = other.transform_type
  @created_at = other.created_at
  @updated_at = other.updated_at
  @deleted_at = other.deleted_at
  @version = other.version
end

#delete ⇒ nil Also known as: delete!

Soft-delete this forwarder on the server.

Returns:

  • (nil) 


496
497
498
499
500
 
# File 'lib/smplkit/audit/models.rb', line 496

def delete
  raise "Forwarder was constructed without a client or id; cannot delete" if @client.nil? || @id.nil?

  @client.delete(@id)
end

#save ⇒ self Also known as: save!

Create or update this forwarder on the server.

Upsert behavior is driven by #created_at: a forwarder with no created_at is created (POST); otherwise it’s full-replace updated (PUT). After the call, every field is refreshed from the server response (including newly-assigned id, created_at, updated_at, version).

Returns:

  • (self)

Raises:



483
484
485
486
487
488
489
490
 
# File 'lib/smplkit/audit/models.rb', line 483

def save
  raise "Forwarder was constructed without a client; cannot save" if @client.nil?

  self.class.send(:validate_transform_pair!, @transform, @transform_type)
  updated = @created_at.nil? ? @client._create_forwarder(self) : @client._update_forwarder(self)
  _apply(updated)
  self
end