package main

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"runtime/debug"
	"strings"
)

func digest(b []byte) string                 { sum := sha256.Sum256(b); return hex.EncodeToString(sum[:]) }
func matches(b []byte, expected string) bool { return digest(b) == expected }

type Audit struct {
	Actor     string `json:"actor"`
	Action    string `json:"action"`
	Object    string `json:"object"`
	Result    string `json:"result"`
	RequestID string `json:"request_id"`
}

// A field allowlist: no arbitrary request body, Cookie, or Authorization fields.
func writeAudit(w io.Writer, e Audit) error { return json.NewEncoder(w).Encode(e) }
func main() {
	artifact := []byte("public build artifact fixture v1")
	expected := digest(artifact)
	fmt.Printf("original-digest=%v changed-digest=%v\n", matches(artifact, expected), matches([]byte("public build artifact fixture v2"), expected))
	var log bytes.Buffer
	err := writeAudit(&log, Audit{"user-7", "read\nforged-entry", "document-42", "deny", "public-request-1"})
	if err != nil {
		panic(err)
	}
	fmt.Print(log.String())
	fmt.Println("physical-log-lines:", strings.Count(log.String(), "\n"))
	info, ok := debug.ReadBuildInfo()
	if ok {
		fmt.Println("build-go:", info.GoVersion)
	}
}