database::security::audit_logger Class Reference

Security audit logging system. More...

#include <secure_connection.h>

Collaboration diagram for database::security::audit_logger:

Public Member Functions
	audit_logger ()=default
	Default constructor - used by database_context.
	audit_logger (const std::string &log_file_path)
	Constructor with persistent log file path.
void	log_database_access (const std::string &user_id, const std::string &session_id, const std::string &operation, const std::string &table, const std::string &query_hash, bool success, const std::string &error_message="")
void	log_authentication_event (const std::string &user_id, const std::string &client_ip, bool success, const std::string &method)
void	log_authorization_failure (const std::string &user_id, const std::string &operation, const std::string &table, const std::string &reason)
std::vector< audit_log_entry >	get_audit_logs (std::chrono::hours window) const
std::vector< audit_log_entry >	get_user_audit_logs (const std::string &user_id, std::chrono::hours window) const
std::string	generate_security_report (std::chrono::hours window) const
std::vector< std::string >	detect_suspicious_activity (std::chrono::hours window) const
void	set_log_retention_period (std::chrono::hours retention)
void	cleanup_old_logs ()
bool	export_logs_to_file (const std::string &filename) const

Private Member Functions
void	persist_entry (const audit_log_entry &entry)

Private Attributes
std::mutex	audit_mutex_
std::vector< audit_log_entry >	audit_logs_
std::chrono::hours	retention_period_ {24 * 30}
std::string	log_file_path_

Detailed Description

Security audit logging system.

Note

This class uses dependency injection pattern. Access via database_context::get_audit_logger() (Sprint 3, Task 3.3).

Example:

auto context = std::make_shared<database_context>();
auto audit_log = context->get_audit_logger();

Definition at line 268 of file secure_connection.h.

Constructor & Destructor Documentation

audit_logger() [1/2]

database::security::audit_logger::audit_logger ( )

default

Default constructor - used by database_context.

audit_logger() [2/2]

database::security::audit_logger::audit_logger ( const std::string & log_file_path )

explicit

Constructor with persistent log file path.

Parameters

log_file_path

Path to the audit log file for durable storage.

When a log file path is provided, all audit events are appended to the file immediately (with flush) in addition to the in-memory vector.

Definition at line 707 of file secure_connection.cpp.

        : log_file_path_(log_file_path)
    {
    }

Member Function Documentation

cleanup_old_logs()

void database::security::audit_logger::cleanup_old_logs

(

)

Definition at line 904 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(audit_mutex_);
 
        auto cutoff = std::chrono::system_clock::now() - retention_period_;
        audit_logs_.erase(
            std::remove_if(audit_logs_.begin(), audit_logs_.end(),
                           [&cutoff](const audit_log_entry& entry) {
                               return entry.timestamp < cutoff;
                           }),
            audit_logs_.end());
    }

References audit_logs_, audit_mutex_, and retention_period_.

detect_suspicious_activity()

std::vector< std::string > database::security::audit_logger::detect_suspicious_activity

(

std::chrono::hours

window

)

const

Definition at line 868 of file secure_connection.cpp.

    {
        auto logs = get_audit_logs(window);
        std::vector<std::string> alerts;
 
        // Detect users with high failure rates
        std::unordered_map<std::string, size_t> user_failures;
        for (const auto& entry : logs)
        {
            if (!entry.success)
            {
                ++user_failures[entry.user_id];
            }
        }
 
        for (const auto& [user_id, count] : user_failures)
        {
            if (count >= 5)
            {
                alerts.push_back("User '" + user_id + "' has " +
                                 std::to_string(count) +
                                 " failed operations in the last " +
                                 std::to_string(window.count()) + " hours");
            }
        }
 
        return alerts;
    }

References get_audit_logs().

Here is the call graph for this function:

export_logs_to_file()

bool database::security::audit_logger::export_logs_to_file

(

const std::string &

filename

)

const

Definition at line 917 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(audit_mutex_);
 
        std::ofstream file(filename);
        if (!file.is_open())
        {
            return false;
        }
 
        // Write CSV header
        file << "timestamp,user_id,session_id,operation,table_name,"
                "query_hash,success,error_message,client_ip,user_agent\n";
 
        for (const auto& entry : audit_logs_)
        {
            auto time_t = std::chrono::system_clock::to_time_t(entry.timestamp);
            file << time_t << ","
                 << entry.user_id << ","
                 << entry.session_id << ","
                 << entry.operation << ","
                 << entry.table_name << ","
                 << entry.query_hash << ","
                 << (entry.success ? "true" : "false") << ","
                 << entry.error_message << ","
                 << entry.client_ip << ","
                 << entry.user_agent << "\n";
        }
 
        return true;
    }

References audit_logs_, and audit_mutex_.

generate_security_report()

std::string database::security::audit_logger::generate_security_report

(

std::chrono::hours

window

)

const

Definition at line 836 of file secure_connection.cpp.

    {
        auto logs = get_audit_logs(window);
 
        size_t total = logs.size();
        size_t failures = 0;
        size_t auth_events = 0;
 
        for (const auto& entry : logs)
        {
            if (!entry.success)
            {
                ++failures;
            }
            if (entry.operation == "authentication")
            {
                ++auth_events;
            }
        }
 
        std::ostringstream oss;
        oss << "Security Report (last " << window.count() << " hours)\n"
            << "  Total events: " << total << "\n"
            << "  Failures: " << failures << "\n"
            << "  Auth events: " << auth_events << "\n"
            << "  Failure rate: "
            << (total > 0 ? (100.0 * failures / total) : 0.0) << "%\n";
 
        return oss.str();
    }

References get_audit_logs().

Here is the call graph for this function:

get_audit_logs()

std::vector< audit_log_entry > database::security::audit_logger::get_audit_logs

(

std::chrono::hours

window

)

const

Definition at line 798 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(audit_mutex_);
 
        auto cutoff = std::chrono::system_clock::now() - window;
        std::vector<audit_log_entry> result;
 
        for (const auto& entry : audit_logs_)
        {
            if (entry.timestamp >= cutoff)
            {
                result.push_back(entry);
            }
        }
 
        return result;
    }

References audit_logs_, and audit_mutex_.

Referenced by detect_suspicious_activity(), and generate_security_report().

Here is the caller graph for this function:

get_user_audit_logs()

std::vector< audit_log_entry > database::security::audit_logger::get_user_audit_logs	(	const std::string &	user_id,
		std::chrono::hours	window ) const

Definition at line 817 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(audit_mutex_);
 
        auto cutoff = std::chrono::system_clock::now() - window;
        std::vector<audit_log_entry> result;
 
        for (const auto& entry : audit_logs_)
        {
            if (entry.timestamp >= cutoff && entry.user_id == user_id)
            {
                result.push_back(entry);
            }
        }
 
        return result;
    }

References audit_logs_, and audit_mutex_.

log_authentication_event()

void database::security::audit_logger::log_authentication_event	(	const std::string &	user_id,
		const std::string &	client_ip,
		bool	success,
		const std::string &	method )

Definition at line 762 of file secure_connection.cpp.

    {
        audit_log_entry entry;
        entry.timestamp = std::chrono::system_clock::now();
        entry.user_id = user_id;
        entry.client_ip = client_ip;
        entry.operation = "authentication";
        entry.success = success;
        entry.error_message = success ? "" : "Authentication failed via " + method;
 
        std::lock_guard<std::mutex> lock(audit_mutex_);
        audit_logs_.push_back(entry);
        persist_entry(entry);
    }

References audit_logs_, audit_mutex_, database::security::audit_log_entry::client_ip, database::security::audit_log_entry::error_message, database::security::audit_log_entry::operation, persist_entry(), database::success, database::security::audit_log_entry::success, database::security::audit_log_entry::timestamp, and database::security::audit_log_entry::user_id.

Here is the call graph for this function:

log_authorization_failure()

void database::security::audit_logger::log_authorization_failure	(	const std::string &	user_id,
		const std::string &	operation,
		const std::string &	table,
		const std::string &	reason )

Definition at line 780 of file secure_connection.cpp.

    {
        audit_log_entry entry;
        entry.timestamp = std::chrono::system_clock::now();
        entry.user_id = user_id;
        entry.operation = "authorization_failure:" + operation;
        entry.table_name = table;
        entry.success = false;
        entry.error_message = reason;
 
        std::lock_guard<std::mutex> lock(audit_mutex_);
        audit_logs_.push_back(entry);
        persist_entry(entry);
    }

References audit_logs_, audit_mutex_, database::security::audit_log_entry::error_message, database::security::audit_log_entry::operation, persist_entry(), database::security::audit_log_entry::success, database::security::audit_log_entry::table_name, database::security::audit_log_entry::timestamp, and database::security::audit_log_entry::user_id.

Here is the call graph for this function:

log_database_access()

void database::security::audit_logger::log_database_access	(	const std::string &	user_id,
		const std::string &	session_id,
		const std::string &	operation,
		const std::string &	table,
		const std::string &	query_hash,
		bool	success,
		const std::string &	error_message = "" )

Definition at line 739 of file secure_connection.cpp.

    {
        audit_log_entry entry;
        entry.timestamp = std::chrono::system_clock::now();
        entry.user_id = user_id;
        entry.session_id = session_id;
        entry.operation = operation;
        entry.table_name = table;
        entry.query_hash = query_hash;
        entry.success = success;
        entry.error_message = error_message;
 
        std::lock_guard<std::mutex> lock(audit_mutex_);
        audit_logs_.push_back(entry);
        persist_entry(entry);
    }

References audit_logs_, audit_mutex_, database::security::audit_log_entry::error_message, database::security::audit_log_entry::operation, persist_entry(), database::security::audit_log_entry::query_hash, database::security::audit_log_entry::session_id, database::success, database::security::audit_log_entry::success, database::security::audit_log_entry::table_name, database::security::audit_log_entry::timestamp, and database::security::audit_log_entry::user_id.

Here is the call graph for this function:

persist_entry()

void database::security::audit_logger::persist_entry ( const audit_log_entry & entry )

private

Definition at line 712 of file secure_connection.cpp.

    {
        if (log_file_path_.empty())
        {
            return;
        }
 
        std::ofstream file(log_file_path_, std::ios::app);
        if (!file.is_open())
        {
            return;
        }
 
        auto time_t = std::chrono::system_clock::to_time_t(entry.timestamp);
        file << time_t << ","
             << entry.user_id << ","
             << entry.session_id << ","
             << entry.operation << ","
             << entry.table_name << ","
             << entry.query_hash << ","
             << (entry.success ? "true" : "false") << ","
             << entry.error_message << ","
             << entry.client_ip << ","
             << entry.user_agent << "\n";
        file.flush();
    }

References database::security::audit_log_entry::client_ip, database::security::audit_log_entry::error_message, log_file_path_, database::security::audit_log_entry::operation, database::security::audit_log_entry::query_hash, database::security::audit_log_entry::session_id, database::security::audit_log_entry::success, database::security::audit_log_entry::table_name, database::security::audit_log_entry::timestamp, database::security::audit_log_entry::user_agent, and database::security::audit_log_entry::user_id.

Referenced by log_authentication_event(), log_authorization_failure(), and log_database_access().

Here is the caller graph for this function:

set_log_retention_period()

void database::security::audit_logger::set_log_retention_period

(

std::chrono::hours

retention

)

Definition at line 898 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(audit_mutex_);
        retention_period_ = retention;
    }

References audit_mutex_, and retention_period_.

Member Data Documentation

audit_logs_

std::vector<audit_log_entry> database::security::audit_logger::audit_logs_

private

Definition at line 315 of file secure_connection.h.

Referenced by cleanup_old_logs(), export_logs_to_file(), get_audit_logs(), get_user_audit_logs(), log_authentication_event(), log_authorization_failure(), and log_database_access().

audit_mutex_

std::mutex database::security::audit_logger::audit_mutex_

mutableprivate

Definition at line 314 of file secure_connection.h.

Referenced by cleanup_old_logs(), export_logs_to_file(), get_audit_logs(), get_user_audit_logs(), log_authentication_event(), log_authorization_failure(), log_database_access(), and set_log_retention_period().

log_file_path_

std::string database::security::audit_logger::log_file_path_

private

Definition at line 317 of file secure_connection.h.

Referenced by persist_entry().

retention_period_

std::chrono::hours database::security::audit_logger::retention_period_ {24 * 30}

private

Definition at line 316 of file secure_connection.h.

{24 * 30}; // 30 days

Referenced by cleanup_old_logs(), and set_log_retention_period().

---

The documentation for this class was generated from the following files:

• database/security/secure_connection.h
• database/security/secure_connection.cpp