【工具链】审计查询台：GM 操作的检索界面

---审计查询台：多维的检索条件
function Audit.query(filters)
    -- filters: { operator, action, uid, from, to }
    local out = {}
    for _, log in ipairs(Audit.logs) do
        if (not filters.operator
            or log.operator == filters.operator)
            and (not filters.action
                or log.action == filters.action)
            and (not filters.uid or log.uid == filters.uid)
            and log.at >= (filters.from or 0)
            and log.at <= (filters.to or math.huge) then
            out[#out + 1] = log
        end
    end
    table.sort(out, function(a, b) return a.at > b.at end)
    return out
end

---审计的写入规范：四元组强制
function Audit.log(operator, action, uid, detail)
    if not operator or not action or not uid then
        error("审计缺失必填字段", 2)
    end
    Audit.logs[#Audit.logs + 1] = {
        operator = operator, action = action,
        uid = uid, detail = detail or "",
        at = os.time(),
    }
    -- 全量写入的落库通道
    Audit.flush()
end

---高频操作的阈值告警
setontimerex(107, 300)
function Audit.watch()
    local stat = {}
    for _, log in ipairs(Audit.logs) do
        if os.time() - log.at < 3600 then
            local key = log.operator .. ":" .. log.action
            stat[key] = (stat[key] or 0) + 1
        end
    end
    for key, n in pairs(stat) do
        if n > 100 then
            Ops.alert("操作频次异常", key, n)
        end
    end
end