docs: release durable event contract

Локально .DS_Store создавался Finder'ом и попадал в untracked.
Добавлен в .gitignore, чтобы дальше не маячил в git status.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,2 @@
+# macOS Finder metadata
+.DS_Store

CHANGELOG.md

@@ -0,0 +1,59 @@
+# Changelog
+
+## v0.4.0 - 2026-06-17
+
+Added:
+
+- `durableevent` package with the shared wire contract for durable
+  cross-service events.
+- Event validation, payload normalization and stable idempotency key helper.
+
+Migration:
+
+1. Push `portal-common` commit and tag `v0.4.0`.
+2. In each producer/consumer service, update:
+
+   ```bash
+   go get gitea.estateliga.work/admin/portal-common@v0.4.0
+   go mod tidy
+   ```
+
+3. Use `durableevent.New(...)` for critical cross-service events and publish
+   the JSON envelope to the selected durable transport.
+4. Keep consumers idempotent by storing or checking `idempotency_key`.
+
+## v0.3.0 - 2026-06-17
+
+Added:
+
+- `audit` package with the shared business-audit event contract.
+- Safe audit details redaction for sensitive keys such as token, secret,
+  password, api_key, authorization and webhook_url.
+- `audit.Client` for `POST /api/internal/audit/events` in Portal.
+
+Migration:
+
+1. Push `portal-common` commit and tag `v0.3.0`.
+2. In each service, update:
+
+   ```bash
+   go get gitea.estateliga.work/admin/portal-common@v0.3.0
+   go mod tidy
+   ```
+
+3. Use `audit.NewClient(cfg.PortalBaseURL, cfg.PortalAPIKey)` or equivalent
+   Portal URL / internal key config already present in the service.
+4. Send business events from handlers/workers after the durable operation
+   succeeds.
+5. Keep Portal proxy audit mappings only as fallback until duplicate events are
+   checked in production.
+
+## v0.2.0
+
+Existing shared packages:
+
+- `db`
+- `middleware`
+- `portal`
+- `redisx`
+- `eventbus`

README.md

@@ -7,6 +7,7 @@ Shared Go-библиотека для микросервисов портала.
 - `db/` — pgxpool init + slow-query tracer. Заменяет идентичный код в 9 сервисах.
 - `middleware/` — `InternalAuth` (X-Internal-Key + X-User-*) + хелперы для кастомных заголовков.
 - `portal/` — HTTP-клиент portal-сервиса: directory с кэшем+stale fallback, notifications, deactivate user.
+- `audit/` — общий контракт business-audit событий и клиент отправки в Portal.
 
 ## Использование
 
@@ -14,6 +15,7 @@ Shared Go-библиотека для микросервисов портала.
 
 ```go
 import (
+    "gitea.estateliga.work/admin/portal-common/audit"
     "gitea.estateliga.work/admin/portal-common/db"
     "gitea.estateliga.work/admin/portal-common/middleware"
     "gitea.estateliga.work/admin/portal-common/portal"
@@ -25,8 +27,31 @@ r := chi.NewRouter()
 r.Use(middleware.InternalAuth(cfg.InternalAPIKey))
 
 portalCli := portal.New(cfg.PortalBaseURL, cfg.PortalAPIKey)
+auditCli := audit.NewClient(cfg.PortalBaseURL, cfg.PortalAPIKey)
+_ = auditCli.Send(ctx, audit.Event{
+    Action:     "tasks.task_create",
+    EntityType: "task",
+    EntityID:   taskID,
+    UserID:     actorID,
+    UserName:   actorName,
+    Details: map[string]any{
+        "request_id": requestID,
+    },
+})
 ```
 
+## Business audit vocabulary
+
+События именуются в формате `<service>.<entity>_<verb>`:
+
+- `service`: короткий код сервиса (`tasks`, `files`, `tg`, `pf`, `telephony`, `portal`).
+- `entity`: бизнес-сущность (`task`, `node`, `channel`, `project`, `call`).
+- `verb`: действие в прошедшем бизнес-смысле или команда (`create`, `update`, `delete`, `retry`, `share`, `move`).
+
+В `Details` можно класть диагностический контекст (`request_id`, `scope`,
+`status`, `error_code`), но нельзя класть токены, пароли и API-ключи. Пакет
+`audit` дополнительно вырезает чувствительные ключи перед отправкой.
+
 ## Dev-режим (без push в Gitea)
 
 В `go.mod` сервиса добавить `replace`:
@@ -38,9 +63,22 @@ replace gitea.estateliga.work/admin/portal-common => ../portal-common
 Когда библиотека стабилизируется, заменить на pinned тег:
 
 ```
-require gitea.estateliga.work/admin/portal-common v0.1.0
+require gitea.estateliga.work/admin/portal-common v0.3.0
 ```
 
+## Release
+
+После изменения публичных пакетов:
+
+```bash
+go test ./...
+git tag v0.3.0
+git push origin main --tags
+```
+
+Сервисы обновляются только после публикации тега, без коммита локального
+`replace`.
+
 ## Зачем
 
 До этого 9 сервисов копировали один в один: pgxpool init, slow-query tracer (500ms threshold), InternalAuth middleware. Tweak'ать tuning централизованно было невозможно. Сейчас изменения идут в одном репо, сервисы пересобираются.

audit/audit.go

@@ -0,0 +1,158 @@
+// Package audit defines the shared business-audit contract used by Portal
+// microservices.
+package audit
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+)
+
+const (
+	MaxTokenLength  = 80
+	MaxDetailsBytes = 16 * 1024
+)
+
+var (
+	tokenRe     = regexp.MustCompile(`^[a-z][a-z0-9_.-]{1,79}$`)
+	secretKeyRe = regexp.MustCompile(`(?i)token|secret|password|api_?key|bearer|authorization|webhook_url|bitrix`)
+)
+
+// Event is the stable wire contract for business-audit events.
+type Event struct {
+	Action     string         `json:"action"`
+	EntityType string         `json:"entity_type"`
+	EntityID   string         `json:"entity_id,omitempty"`
+	UserID     string         `json:"user_id,omitempty"`
+	UserName   string         `json:"user_name,omitempty"`
+	Details    map[string]any `json:"details,omitempty"`
+	IPAddress  string         `json:"ip_address,omitempty"`
+}
+
+// Normalize trims fields and redacts sensitive values in Details.
+func (e Event) Normalize() Event {
+	e.Action = strings.TrimSpace(e.Action)
+	e.EntityType = strings.TrimSpace(e.EntityType)
+	e.EntityID = truncateRunes(strings.TrimSpace(e.EntityID), 255)
+	e.UserID = strings.TrimSpace(e.UserID)
+	e.UserName = strings.TrimSpace(e.UserName)
+	e.IPAddress = strings.TrimSpace(e.IPAddress)
+	if e.Details != nil {
+		if redacted, ok := RedactSecrets(e.Details).(map[string]any); ok {
+			e.Details = redacted
+		}
+	}
+	return e
+}
+
+// Validate checks the event shape before it is sent to Portal.
+func (e Event) Validate() error {
+	e = e.Normalize()
+	if !ValidToken(e.Action) {
+		return fmt.Errorf("invalid audit action %q", e.Action)
+	}
+	if !ValidToken(e.EntityType) {
+		return fmt.Errorf("invalid audit entity_type %q", e.EntityType)
+	}
+	if e.Details != nil && detailsTooLarge(e.Details) {
+		return fmt.Errorf("audit details exceed %d bytes", MaxDetailsBytes)
+	}
+	return nil
+}
+
+func ValidToken(value string) bool {
+	value = strings.TrimSpace(value)
+	return len(value) <= MaxTokenLength && tokenRe.MatchString(value)
+}
+
+// RedactSecrets recursively replaces values for sensitive JSON keys.
+func RedactSecrets(v any) any {
+	switch x := v.(type) {
+	case map[string]any:
+		out := make(map[string]any, len(x))
+		for k, val := range x {
+			if secretKeyRe.MatchString(k) {
+				out[k] = "***"
+			} else {
+				out[k] = RedactSecrets(val)
+			}
+		}
+		return out
+	case []any:
+		out := make([]any, len(x))
+		for i, val := range x {
+			out[i] = RedactSecrets(val)
+		}
+		return out
+	default:
+		return v
+	}
+}
+
+type Client struct {
+	baseURL string
+	apiKey  string
+	hc      *http.Client
+}
+
+func NewClient(baseURL, apiKey string) *Client {
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		apiKey:  apiKey,
+		hc:      &http.Client{Timeout: 5 * time.Second},
+	}
+}
+
+func (c *Client) Enabled() bool {
+	return c != nil && c.baseURL != "" && c.apiKey != ""
+}
+
+func (c *Client) Send(ctx context.Context, event Event) error {
+	if !c.Enabled() {
+		return errors.New("audit client disabled")
+	}
+	event = event.Normalize()
+	if err := event.Validate(); err != nil {
+		return err
+	}
+	body, err := json.Marshal(event)
+	if err != nil {
+		return fmt.Errorf("marshal audit event: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/api/internal/audit/events", bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("new audit request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-Internal-Key", c.apiKey)
+	resp, err := c.hc.Do(req)
+	if err != nil {
+		return fmt.Errorf("send audit event: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode >= 300 {
+		respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return fmt.Errorf("portal audit returned %d: %s", resp.StatusCode, string(respBody))
+	}
+	return nil
+}
+
+func detailsTooLarge(value any) bool {
+	raw, err := json.Marshal(value)
+	return err != nil || len(raw) > MaxDetailsBytes
+}
+
+func truncateRunes(value string, max int) string {
+	runes := []rune(value)
+	if len(runes) <= max {
+		return value
+	}
+	return string(runes[:max])
+}

audit/audit_test.go

@@ -0,0 +1,85 @@
+package audit
+
+import "testing"
+
+func TestEventNormalizeRedactsSecretsAndTruncatesEntityID(t *testing.T) {
+	event := Event{
+		Action:     " files.share_create ",
+		EntityType: " file_node ",
+		EntityID:   longString("x", 300),
+		Details: map[string]any{
+			"request_id": "rid-1",
+			"password":   "plain",
+			"nested": map[string]any{
+				"api_key": "secret",
+			},
+			"items": []any{
+				map[string]any{"token": "secret"},
+			},
+		},
+	}
+
+	got := event.Normalize()
+	if got.Action != "files.share_create" {
+		t.Fatalf("action was not trimmed: %q", got.Action)
+	}
+	if got.EntityType != "file_node" {
+		t.Fatalf("entity type was not trimmed: %q", got.EntityType)
+	}
+	if len([]rune(got.EntityID)) != 255 {
+		t.Fatalf("entity id was not truncated, got %d", len([]rune(got.EntityID)))
+	}
+	if got.Details["password"] != "***" {
+		t.Fatalf("password was not redacted: %#v", got.Details["password"])
+	}
+	nested := got.Details["nested"].(map[string]any)
+	if nested["api_key"] != "***" {
+		t.Fatalf("nested api_key was not redacted: %#v", nested["api_key"])
+	}
+	items := got.Details["items"].([]any)
+	if items[0].(map[string]any)["token"] != "***" {
+		t.Fatalf("array token was not redacted: %#v", items[0])
+	}
+}
+
+func TestEventValidate(t *testing.T) {
+	valid := Event{Action: "tasks.task_create", EntityType: "task"}
+	if err := valid.Validate(); err != nil {
+		t.Fatalf("valid event rejected: %v", err)
+	}
+
+	invalidAction := Event{Action: "Task Created", EntityType: "task"}
+	if err := invalidAction.Validate(); err == nil {
+		t.Fatal("invalid action was accepted")
+	}
+
+	invalidEntity := Event{Action: "tasks.task_create", EntityType: "1task"}
+	if err := invalidEntity.Validate(); err == nil {
+		t.Fatal("invalid entity type was accepted")
+	}
+}
+
+func TestValidToken(t *testing.T) {
+	tests := map[string]bool{
+		"files.node_move":                 true,
+		"ai.job-retry":                    true,
+		"a1":                              true,
+		"A1":                              false,
+		"a":                               false,
+		"files node":                      false,
+		longString("a", MaxTokenLength+1): false,
+	}
+	for value, want := range tests {
+		if got := ValidToken(value); got != want {
+			t.Fatalf("ValidToken(%q) = %v, want %v", value, got, want)
+		}
+	}
+}
+
+func longString(ch string, n int) string {
+	out := ""
+	for range n {
+		out += ch
+	}
+	return out
+}

durableevent/event.go

@@ -0,0 +1,150 @@
+// Package durableevent defines the shared contract for critical cross-service
+// events that must survive process restarts and temporary subscriber outages.
+package durableevent
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+	"time"
+)
+
+const (
+	DefaultSchemaVersion = 1
+	MaxTokenLength       = 120
+	MaxIDLength          = 255
+	MaxPayloadBytes      = 64 * 1024
+)
+
+var tokenRe = regexp.MustCompile(`^[a-z][a-z0-9_.-]{1,119}$`)
+
+// Event is the stable wire shape for durable cross-service events.
+//
+// It is intentionally transport-neutral: the same JSON can be written to
+// Redis Streams, a database outbox, or a journal table.
+type Event struct {
+	EventType      string          `json:"event_type"`
+	SchemaVersion  int             `json:"schema_version"`
+	ActorUserID    string          `json:"actor_user_id,omitempty"`
+	ActorName      string          `json:"actor_name,omitempty"`
+	EntityType     string          `json:"entity_type"`
+	EntityID       string          `json:"entity_id"`
+	RelatedType    string          `json:"related_entity_type,omitempty"`
+	RelatedID      string          `json:"related_entity_id,omitempty"`
+	RequestID      string          `json:"request_id,omitempty"`
+	IdempotencyKey string          `json:"idempotency_key"`
+	OccurredAt     time.Time       `json:"occurred_at"`
+	Payload        json.RawMessage `json:"payload,omitempty"`
+}
+
+func New(eventType, entityType, entityID string, payload any) (Event, error) {
+	raw, err := Payload(payload)
+	if err != nil {
+		return Event{}, err
+	}
+	event := Event{
+		EventType:     eventType,
+		SchemaVersion: DefaultSchemaVersion,
+		EntityType:    entityType,
+		EntityID:      entityID,
+		OccurredAt:    time.Now().UTC(),
+		Payload:       raw,
+	}
+	event.IdempotencyKey = BuildIdempotencyKey(event.EventType, event.EntityType, event.EntityID)
+	return event, nil
+}
+
+func (e Event) Normalize() Event {
+	e.EventType = strings.TrimSpace(e.EventType)
+	e.ActorUserID = strings.TrimSpace(e.ActorUserID)
+	e.ActorName = truncate(strings.TrimSpace(e.ActorName), MaxIDLength)
+	e.EntityType = strings.TrimSpace(e.EntityType)
+	e.EntityID = truncate(strings.TrimSpace(e.EntityID), MaxIDLength)
+	e.RelatedType = strings.TrimSpace(e.RelatedType)
+	e.RelatedID = truncate(strings.TrimSpace(e.RelatedID), MaxIDLength)
+	e.RequestID = truncate(strings.TrimSpace(e.RequestID), MaxIDLength)
+	e.IdempotencyKey = truncate(strings.TrimSpace(e.IdempotencyKey), MaxIDLength)
+	if e.SchemaVersion == 0 {
+		e.SchemaVersion = DefaultSchemaVersion
+	}
+	if !e.OccurredAt.IsZero() {
+		e.OccurredAt = e.OccurredAt.UTC()
+	}
+	return e
+}
+
+func (e Event) Validate() error {
+	e = e.Normalize()
+	if !ValidToken(e.EventType) {
+		return fmt.Errorf("invalid event_type %q", e.EventType)
+	}
+	if !ValidToken(e.EntityType) {
+		return fmt.Errorf("invalid entity_type %q", e.EntityType)
+	}
+	if e.EntityID == "" {
+		return errors.New("entity_id is required")
+	}
+	if e.IdempotencyKey == "" {
+		return errors.New("idempotency_key is required")
+	}
+	if e.SchemaVersion < 1 {
+		return errors.New("schema_version must be positive")
+	}
+	if e.OccurredAt.IsZero() {
+		return errors.New("occurred_at is required")
+	}
+	if len(e.Payload) > MaxPayloadBytes {
+		return fmt.Errorf("payload exceeds %d bytes", MaxPayloadBytes)
+	}
+	if len(e.Payload) > 0 && !json.Valid(e.Payload) {
+		return errors.New("payload must be valid JSON")
+	}
+	return nil
+}
+
+func ValidToken(value string) bool {
+	value = strings.TrimSpace(value)
+	return len(value) <= MaxTokenLength && tokenRe.MatchString(value)
+}
+
+func Payload(value any) (json.RawMessage, error) {
+	if value == nil {
+		return nil, nil
+	}
+	if raw, ok := value.(json.RawMessage); ok {
+		if len(raw) > 0 && !json.Valid(raw) {
+			return nil, errors.New("payload must be valid JSON")
+		}
+		return raw, nil
+	}
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return nil, fmt.Errorf("marshal payload: %w", err)
+	}
+	return raw, nil
+}
+
+func BuildIdempotencyKey(parts ...string) string {
+	h := sha256.New()
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		_, _ = h.Write([]byte(part))
+		_, _ = h.Write([]byte{0})
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+func truncate(value string, max int) string {
+	runes := []rune(value)
+	if len(runes) <= max {
+		return value
+	}
+	return string(runes[:max])
+}

durableevent/event_test.go

@@ -0,0 +1,98 @@
+package durableevent
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+func TestNewEventBuildsValidEvent(t *testing.T) {
+	event, err := New("hh.response_received", "hh_response", "resume-1", map[string]any{"resume_id": "resume-1"})
+	if err != nil {
+		t.Fatalf("New returned error: %v", err)
+	}
+	if event.SchemaVersion != DefaultSchemaVersion {
+		t.Fatalf("schema version = %d, want %d", event.SchemaVersion, DefaultSchemaVersion)
+	}
+	if event.IdempotencyKey == "" {
+		t.Fatal("idempotency key was not generated")
+	}
+	if err := event.Validate(); err != nil {
+		t.Fatalf("generated event is invalid: %v", err)
+	}
+}
+
+func TestEventValidateRejectsInvalidShape(t *testing.T) {
+	validTime := time.Date(2026, 6, 17, 10, 0, 0, 0, time.UTC)
+	tests := []struct {
+		name  string
+		event Event
+	}{
+		{
+			name: "bad event type",
+			event: Event{
+				EventType:      "HH Response",
+				EntityType:     "hh_response",
+				EntityID:       "1",
+				IdempotencyKey: "key",
+				SchemaVersion:  1,
+				OccurredAt:     validTime,
+			},
+		},
+		{
+			name: "missing entity id",
+			event: Event{
+				EventType:      "hh.response_received",
+				EntityType:     "hh_response",
+				IdempotencyKey: "key",
+				SchemaVersion:  1,
+				OccurredAt:     validTime,
+			},
+		},
+		{
+			name: "invalid payload",
+			event: Event{
+				EventType:      "hh.response_received",
+				EntityType:     "hh_response",
+				EntityID:       "1",
+				IdempotencyKey: "key",
+				SchemaVersion:  1,
+				OccurredAt:     validTime,
+				Payload:        json.RawMessage(`{`),
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := tt.event.Validate(); err == nil {
+				t.Fatal("invalid event was accepted")
+			}
+		})
+	}
+}
+
+func TestBuildIdempotencyKeyIsStable(t *testing.T) {
+	a := BuildIdempotencyKey("hh.response_received", "resume-1", "response-2")
+	b := BuildIdempotencyKey("hh.response_received", "resume-1", "response-2")
+	c := BuildIdempotencyKey("hh.response_received", "resume-1", "response-3")
+	if a == "" {
+		t.Fatal("empty idempotency key")
+	}
+	if a != b {
+		t.Fatal("same parts produced different keys")
+	}
+	if a == c {
+		t.Fatal("different parts produced same key")
+	}
+}
+
+func TestPayloadAcceptsRawMessage(t *testing.T) {
+	raw := json.RawMessage(`{"ok":true}`)
+	got, err := Payload(raw)
+	if err != nil {
+		t.Fatalf("Payload returned error: %v", err)
+	}
+	if string(got) != string(raw) {
+		t.Fatalf("payload = %s, want %s", got, raw)
+	}
+}

middleware/headers.go

@@ -0,0 +1,45 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+)
+
+// HeaderBool reads portal-proxy boolean headers.
+// Contract: "1", "true", "yes" and "on" are true; everything else is false.
+func HeaderBool(r *http.Request, name string) bool {
+	switch strings.ToLower(strings.TrimSpace(r.Header.Get(name))) {
+	case "1", "true", "yes", "on":
+		return true
+	default:
+		return false
+	}
+}
+
+// HeaderCSV returns a trimmed non-empty CSV list from a portal-proxy header.
+func HeaderCSV(r *http.Request, name string) []string {
+	raw := strings.TrimSpace(r.Header.Get(name))
+	if raw == "" {
+		return nil
+	}
+	parts := strings.Split(raw, ",")
+	out := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if v := strings.TrimSpace(part); v != "" {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+// HeaderScope returns a lower-cased scope constrained to allowed values.
+// The fallback is returned when the header is empty or unknown.
+func HeaderScope(r *http.Request, name, fallback string, allowed ...string) string {
+	value := strings.ToLower(strings.TrimSpace(r.Header.Get(name)))
+	for _, option := range allowed {
+		if value == strings.ToLower(strings.TrimSpace(option)) {
+			return value
+		}
+	}
+	return fallback
+}