audit: export LevelAudit slog level constant#141
Merged
Conversation
Add a LevelAudit constant (slog.Level(2)) to the audit package so all ToolHive components share one definition of the custom audit log level rather than each hardcoding the numeric value. Both the toolhive operator (pkg/audit) and the registry server (internal/audit) currently define slog.Level(2) independently; exporting it here lets them converge on a single source of truth. The value sits between slog.LevelInfo and slog.LevelWarn so audit events can be filtered independently from regular application logs. A test locks the value and its ordering since changing it would break consumers that filter on the numeric level. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisJBurns
approved these changes
Jun 23, 2026
rdimitrov
added a commit
to stacklok/toolhive-registry-server
that referenced
this pull request
Jun 23, 2026
## Summary The audit logger emits events at a custom `slog` level between Info and Warn, which serialized in JSON output as `"level":"INFO+2"`. That makes audit entries awkward to filter in log aggregators (Loki, Elasticsearch, Splunk) that expect named level strings, and it diverges from the toolhive operator, which already renders the same level as `"AUDIT"`. Operators running both toolhive and the registry server otherwise see inconsistent `level` values for what is logically the same event level, requiring two filter patterns. ## Changes - `internal/audit/logger.go`: add a `ReplaceAttr` hook to `NewLogger` that rewrites the custom audit level to the string `"AUDIT"` (matching the operator). Drop the locally defined `auditLevel` var. - `internal/audit/middleware.go`: use `audit.LevelAudit` from `toolhive-core` instead of the local level, so all ToolHive components share one definition rather than each hardcoding `slog.Level(2)`. - `internal/audit/middleware_test.go`: add `TestLogger_RendersAuditLevelAsString` asserting the rendered `level` field is `"AUDIT"`. - `go.mod`: bump `toolhive-core` to `v0.0.26`, which exports the new `audit.LevelAudit` constant (stacklok/toolhive-core#141). ## Testing - `go test ./internal/audit/...` ✅ - `golangci-lint run ./internal/audit/...` ✅ Fixes #826 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an exported
LevelAudit = slog.Level(2)constant to theauditpackage so all ToolHive components share a single definition of the custom audit log level instead of each hardcoding the numeric value.Today both the toolhive operator (
pkg/audit/auditor.go) and the registry server (internal/audit/logger.go) defineslog.Level(2)independently. Exporting it here lets them converge on one source of truth.The level sits between
slog.LevelInfo(0) andslog.LevelWarn(4) so audit events can be filtered independently from regular application logs.Changes
audit/event.go: exportconst LevelAudit = slog.Level(2)with doc commentaudit/event_test.go: add aTestConstantssubtest locking the value and its ordering (Info < LevelAudit < Warn), since changing it would break consumers that filter on the numeric level; use the constant inTestAuditEventLogToContext
Enables stacklok/toolhive-registry-server#826 — the registry server will import
audit.LevelAuditrather than redefining it locally, and render the level as"AUDIT"to match the operator.🤖 Generated with Claude Code