refactor: Event log use audit event as SSOT (#350)

internal/audit/eventlog_sink.go

@@ -20,7 +20,7 @@ func (s *eventlogSink) Handle(_ context.Context, event AuditEvent) error {
 
 	elEvent := eventlog.Event{
 		Timestamp:   event.Timestamp,
-		EventType:   mapEventType(event.Type),
+		EventType:   string(event.Type),
 		Message:     event.Message,
 		PackageName: pkgName(event.PackageVersion),
 		Version:     pkgVersion(event.PackageVersion),
@@ -48,36 +48,3 @@ func sessionDataToDetails(sd *SessionData) map[string]interface{} {
 func (s *eventlogSink) Close() error {
 	return nil
 }
-
-func mapEventType(t EventType) eventlog.EventType {
-	switch t {
-	case EventTypeMalwareBlocked:
-		return eventlog.EventTypeMalwareBlocked
-	case EventTypeMalwareConfirmed:
-		return eventlog.EventTypeMalwareConfirmed
-	case EventTypeInstallAllowed:
-		return eventlog.EventTypeInstallAllowed
-	case EventTypeInstallTrustedAllowed:
-		return eventlog.EventTypeInstallTrustedAllowed
-	case EventTypeInstallStarted:
-		return eventlog.EventTypeInstallStarted
-	case EventTypeDependencyResolved:
-		return eventlog.EventTypeDependencyResolved
-	case EventTypeInstallInsecureBypass:
-		return eventlog.EventTypeInstallInsecureBypass
-	case EventTypeProxyHostObserved:
-		return eventlog.EventTypeProxyHostObserved
-	case EventTypeDependencyCooldown:
-		return eventlog.EventTypeDependencyCooldown
-	case EventTypeCooldownSkipped:
-		return eventlog.EventTypeCooldownSkipped
-	case EventTypeSandboxOverride:
-		return eventlog.EventTypeSandboxOverride
-	case EventTypeError:
-		return eventlog.EventTypeError
-	case EventTypeSessionComplete:
-		return eventlog.EventType("session_complete")
-	default:
-		return eventlog.EventType(string(t))
-	}
-}

internal/audit/eventlog_sink_test.go

@@ -3,36 +3,36 @@ package audit
 import (
 	"testing"
 
-	"github.com/safedep/pmg/internal/eventlog"
 	"github.com/stretchr/testify/assert"
 )
 
-func TestEventlogSinkTranslatesAllEventTypes(t *testing.T) {
+// TestEventTypeOnDiskValues pins the event_type strings written to the on-disk
+// event log. The audit package is the single owner of this vocabulary; the
+// eventlog sink writes string(event.Type) verbatim, so these values are the
+// file-format contract and must not change without a migration.
+func TestEventTypeOnDiskValues(t *testing.T) {
 	tests := []struct {
-		name     string
 		input    EventType
-		expected eventlog.EventType
+		expected string
 	}{
-		{"malware_blocked", EventTypeMalwareBlocked, eventlog.EventTypeMalwareBlocked},
-		{"malware_confirmed", EventTypeMalwareConfirmed, eventlog.EventTypeMalwareConfirmed},
-		{"install_allowed", EventTypeInstallAllowed, eventlog.EventTypeInstallAllowed},
-		{"install_trusted_allowed", EventTypeInstallTrustedAllowed, eventlog.EventTypeInstallTrustedAllowed},
-		{"install_started", EventTypeInstallStarted, eventlog.EventTypeInstallStarted},
-		{"dependency_resolved", EventTypeDependencyResolved, eventlog.EventTypeDependencyResolved},
-		{"install_insecure_bypass", EventTypeInstallInsecureBypass, eventlog.EventTypeInstallInsecureBypass},
-		{"proxy_host_observed", EventTypeProxyHostObserved, eventlog.EventTypeProxyHostObserved},
-		{"dependency_cooldown", EventTypeDependencyCooldown, eventlog.EventTypeDependencyCooldown},
-		{"dependency_cooldown_skipped", EventTypeCooldownSkipped, eventlog.EventTypeCooldownSkipped},
-		{"sandbox_override", EventTypeSandboxOverride, eventlog.EventTypeSandboxOverride},
-		{"error", EventTypeError, eventlog.EventTypeError},
-		{"session_complete", EventTypeSessionComplete, eventlog.EventType("session_complete")},
-		{"unknown_type", EventType("custom_event"), eventlog.EventType("custom_event")},
+		{EventTypeMalwareBlocked, "malware_blocked"},
+		{EventTypeMalwareConfirmed, "malware_confirmed"},
+		{EventTypeInstallAllowed, "install_allowed"},
+		{EventTypeInstallTrustedAllowed, "install_trusted_allowed"},
+		{EventTypeInstallStarted, "install_started"},
+		{EventTypeDependencyResolved, "dependency_resolved"},
+		{EventTypeInstallInsecureBypass, "install_insecure_bypass"},
+		{EventTypeProxyHostObserved, "proxy_host_observed"},
+		{EventTypeDependencyCooldown, "dependency_cooldown"},
+		{EventTypeCooldownSkipped, "dependency_cooldown_skipped"},
+		{EventTypeSandboxOverride, "sandbox_override"},
+		{EventTypeError, "error"},
+		{EventTypeSessionComplete, "session_complete"},
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := mapEventType(tt.input)
-			assert.Equal(t, tt.expected, result)
+		t.Run(tt.expected, func(t *testing.T) {
+			assert.Equal(t, tt.expected, string(tt.input))
 		})
 	}
 }