feat: audit P1 — event filtering presets, read events, auth_success default, config before_hash parity

[millerjp]

Context

Spun off from #365 — all P0 audit gaps are resolved. These are the remaining P1 items.

P1 Gaps

1. Config before_hash asymmetry

before_hash for config operations only hashes the compatibility level string, while after_hash hashes the full config struct (compat level + normalize + aliases + default metadata + default rule set). This means before_hash and after_hash are not comparable.

Fix: Hash the full config struct for before_hash as well, matching the after_hash approach.

2. auth_success not in default enabled events

auth_success events are defined but not included in the default enabled event set. Operators who enable auth and auditing would reasonably expect successful logins to be audited by default.

Fix: Add auth_success to the default enabled events list.

3. Preset keywords and category tagging not implemented

The design calls for preset keywords (all, writes, reads, security) and event category tagging, allowing operators to configure enabled_events: [writes, security] instead of listing individual event types. This is not yet implemented.

Deliverables:

• Event category tags (e.g., write, read, security, lifecycle)
• Preset keywords that expand to category groups
• Config support: enabled_events: [writes, security]

4. Read event types missing

Approximately 10+ read-only routes have no audit event generation:

• KEK/DEK GET endpoints
• Exporter GET endpoints
• Admin user/API key GET endpoints
• Analysis endpoints
• Schema/subject/config/mode GET endpoints (if reads preset is enabled)

Note: Read events SHOULD only fire when the reads preset or explicit read event types are enabled — they MUST NOT be emitted by default.

5. audit_filtering.feature BDD file does not exist

No BDD coverage for event filtering configuration (enabled/disabled event types, presets).

Deliverables:

• tests/bdd/features/mcp/audit_filtering.feature (or REST equivalent)
• Scenarios covering: default events, preset expansion, individual event enable/disable

Acceptance Criteria

• Config before_hash uses full struct hashing matching after_hash
• auth_success included in default enabled events
• Preset keywords (all, writes, reads, security) implemented
• Event category tags assigned to all event types
• Read event types defined for applicable GET endpoints
• Read events only fire when explicitly enabled
• audit_filtering.feature BDD file with comprehensive scenarios
• All existing audit BDD tests still pass

References

• Closes the remaining P1 gaps from fix: missing audit event generation — 31+ unaudited routes, no startup/shutdown events, no compatibility check auditing #365

[millerjp]

Code Review Findings (automated review against feature/mcp branch)

Status: Valid — multiple P1 gaps confirmed

What's implemented

• Event filtering works: Config accepts events: [event1, event2, ...] explicit list. If empty, defaults to setDefaultEnabledEvents().
• Read events defined: schema_get, config_get, mode_get, subject_list all defined and functional. Intentionally disabled by default to reduce log volume.
• Config/schema hashing: before_hash and after_hash implemented for most operations.

Confirmed gaps

1. Config before_hash/after_hash PARITY BROKEN (HIGH)

   • handlers.go line ~1076-1078: before_hash hashes just the compatibility level string (e.g., "BACKWARD"), while after_hash hashes the full config struct (10+ fields including metadata, rulesets)
   • Hashes are incomparable — they hash different objects
   • Same issue on config deletion: only hashes the compat level string
   • Fix needed: hash the same object type for both before and after

2. auth_success not emitted (MEDIUM)

   • Constant AuditEventAuthSuccess exists (line 101 in audit.go)
   • Not in default enabled events list
   • No code path emits this event anywhere in the codebase
   • Decision needed: implement the emission code, or remove the dead constant + update docs

3. Event filtering presets NOT implemented (MEDIUM)

   • Config only accepts explicit event name lists
   • Missing preset shortcuts: "all", "writes", "reads", "security"
   • No category tagging on event types

4. Read events for ~10+ GET routes missing (LOW)

   • KEK/DEK/exporter/admin/analysis GET routes don't have audit event types defined
   • Only schema/config/mode reads have audit events

Recommendation

Issue remains valid. Config hash parity is the highest priority item — it's an audit data integrity bug.