Initial SQL-only 1C adapter baseline

core/observability/__init__.py

@@ -0,0 +1,14 @@
+"""Shared observability helpers for services and plugins."""
+
+from .redaction import sanitize_for_logging
+from .store import JsonlAuditStore, resolve_audit_root
+from .trace import next_trace_id, resolve_request_id, resolve_trace_id
+
+__all__ = [
+    "JsonlAuditStore",
+    "next_trace_id",
+    "resolve_audit_root",
+    "resolve_request_id",
+    "resolve_trace_id",
+    "sanitize_for_logging",
+]

core/observability/redaction.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+
+REDACTED = "[REDACTED]"
+SENSITIVE_KEY_PARTS = (
+    "authorization",
+    "api_key",
+    "apikey",
+    "access_token",
+    "refresh_token",
+    "token",
+    "password",
+    "secret",
+    "cookie",
+    "set-cookie",
+)
+BEARER_RE = re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/=-]+")
+
+
+def _looks_sensitive_key(key: str) -> bool:
+    lowered = key.strip().lower()
+    return any(part in lowered for part in SENSITIVE_KEY_PARTS)
+
+
+def _sanitize_string(value: str) -> str:
+    return BEARER_RE.sub("Bearer " + REDACTED, value)
+
+
+def sanitize_for_logging(value: Any) -> Any:
+    if isinstance(value, dict):
+        cleaned: dict[str, Any] = {}
+        for key, item in value.items():
+            key_text = str(key)
+            if _looks_sensitive_key(key_text):
+                cleaned[key_text] = REDACTED
+            else:
+                cleaned[key_text] = sanitize_for_logging(item)
+        return cleaned
+    if isinstance(value, list):
+        return [sanitize_for_logging(item) for item in value]
+    if isinstance(value, tuple):
+        return [sanitize_for_logging(item) for item in value]
+    if isinstance(value, str):
+        return _sanitize_string(value)
+    return value

core/observability/store.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import json
+import threading
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+
+def utc_now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def resolve_audit_root(root: Path, *, service: str, env_var: str | None = None) -> Path:
+    import os
+
+    configured = os.environ.get(env_var or "", "").strip() if env_var else ""
+    if configured:
+        return Path(configured)
+    return root / "reports" / "observability" / service
+
+
+class JsonlAuditStore:
+    def __init__(self, root: Path, *, service: str) -> None:
+        self.root = root
+        self.service = service
+        self.root.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.Lock()
+
+    def _path_for(self, event_type: str) -> Path:
+        stamp = datetime.now(timezone.utc).strftime("%Y%m%d")
+        return self.root / event_type / f"{stamp}.jsonl"
+
+    def write_event(self, event_type: str, payload: dict[str, Any]) -> dict[str, Any]:
+        record = {
+            "event_type": event_type,
+            "service": self.service,
+            "logged_at": utc_now_iso(),
+            **payload,
+        }
+        path = self._path_for(event_type)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        line = json.dumps(record, ensure_ascii=False, separators=(",", ":")) + "\n"
+        with self._lock:
+            with path.open("a", encoding="utf-8") as handle:
+                handle.write(line)
+        return record

core/observability/trace.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+import uuid
+from typing import Mapping
+
+
+def next_trace_id() -> str:
+    return uuid.uuid4().hex
+
+
+def _header_value(headers: Mapping[str, str], *names: str) -> str:
+    for name in names:
+        value = headers.get(name)
+        if value:
+            return str(value).strip()
+    return ""
+
+
+def resolve_trace_id(headers: Mapping[str, str]) -> str:
+    trace_id = _header_value(headers, "x-trace-id", "X-Trace-Id", "x-request-id", "X-Request-Id")
+    return trace_id or next_trace_id()
+
+
+def resolve_request_id(headers: Mapping[str, str], *, fallback_trace_id: str) -> str:
+    request_id = _header_value(headers, "x-request-id", "X-Request-Id")
+    return request_id or fallback_trace_id