diff --git a/src/BinaryIndex/StellaOps.BinaryIndex.WebService/Program.cs b/src/BinaryIndex/StellaOps.BinaryIndex.WebService/Program.cs index a16f33c96..8e9f12c84 100644 --- a/src/BinaryIndex/StellaOps.BinaryIndex.WebService/Program.cs +++ b/src/BinaryIndex/StellaOps.BinaryIndex.WebService/Program.cs @@ -3,6 +3,7 @@ using Microsoft.Extensions.DependencyInjection.Extensions; using Microsoft.Extensions.Logging; using Microsoft.Extensions.Options; using StackExchange.Redis; +using StellaOps.Audit.Emission; using StellaOps.BinaryIndex.Cache; using StellaOps.BinaryIndex.Core.Resolution; using StellaOps.BinaryIndex.Core.Services; @@ -38,6 +39,9 @@ builder.Services.TryAddSingleton(); builder.Services.AddGoldenSetServices(builder.Configuration); builder.Services.AddBinaryIndexGoldenSetStorage(builder.Configuration); builder.Services.AddBinaryIndexRuntimePersistence(builder.Configuration); + +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +builder.Services.AddAuditEmission(builder.Configuration); builder.Services.AddBinaryIndexResolutionCache(builder.Configuration); builder.Services.AddScoped(); builder.Services.AddScoped(sp => diff --git a/src/BinaryIndex/StellaOps.BinaryIndex.WebService/StellaOps.BinaryIndex.WebService.csproj b/src/BinaryIndex/StellaOps.BinaryIndex.WebService/StellaOps.BinaryIndex.WebService.csproj index f391f7ec9..f37caa751 100644 --- a/src/BinaryIndex/StellaOps.BinaryIndex.WebService/StellaOps.BinaryIndex.WebService.csproj +++ b/src/BinaryIndex/StellaOps.BinaryIndex.WebService/StellaOps.BinaryIndex.WebService.csproj @@ -16,6 +16,7 @@ + diff --git a/src/Concelier/StellaOps.Concelier.WebService/Program.cs b/src/Concelier/StellaOps.Concelier.WebService/Program.cs index fe534d5f3..2deb8f258 100644 --- a/src/Concelier/StellaOps.Concelier.WebService/Program.cs +++ b/src/Concelier/StellaOps.Concelier.WebService/Program.cs @@ -1,6 +1,7 @@ using AttestationClaims = StellaOps.Concelier.Core.Attestation.AttestationClaims; using HttpResults = Microsoft.AspNetCore.Http.Results; +using StellaOps.Audit.Emission; using Microsoft.AspNetCore.Authentication.JwtBearer; using Microsoft.AspNetCore.Diagnostics; using Microsoft.AspNetCore.Http; @@ -747,26 +748,6 @@ builder.Services.PostConfigure(options => } }); -if (!isTesting) -{ - builder.Services.RemoveAll(); - builder.Services.AddSingleton(); - builder.Services.RemoveAll(); - builder.Services.AddSingleton(); - builder.Services.RemoveAll(); - builder.Services.AddSingleton(); - - for (var index = builder.Services.Count - 1; index >= 0; index--) - { - var descriptor = builder.Services[index]; - if (descriptor.ServiceType == typeof(IHostedService) && - descriptor.ImplementationType == typeof(JobSchedulerHostedService)) - { - builder.Services.RemoveAt(index); - } - } -} - builder.Services.AddSingleton(); builder.Services.AddSingleton(sp => new StellaOps.Concelier.WebService.Diagnostics.ServiceStatus(sp.GetRequiredService())); @@ -1018,6 +999,9 @@ if (authorityConfigured) } } +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +builder.Services.AddAuditEmission(builder.Configuration); + builder.Services.AddAuthorization(options => { options.AddStellaOpsScopePolicy(JobsPolicyName, concelierOptions.Authority.RequiredScopes.ToArray()); diff --git a/src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj b/src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj index 10fa95466..d716a486a 100644 --- a/src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj +++ b/src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj @@ -22,6 +22,7 @@ + diff --git a/src/Concelier/StellaOps.Excititor.WebService/Program.cs b/src/Concelier/StellaOps.Excititor.WebService/Program.cs index 3a4dd8e6d..d4ea38d38 100644 --- a/src/Concelier/StellaOps.Excititor.WebService/Program.cs +++ b/src/Concelier/StellaOps.Excititor.WebService/Program.cs @@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; +using StellaOps.Audit.Emission; using Microsoft.Extensions.Caching.Memory; using Microsoft.Extensions.DependencyInjection.Extensions; using Microsoft.Extensions.Logging; @@ -177,6 +178,9 @@ services.AddMemoryCache(); // Register authentication services so app.UseAuthentication() can resolve IAuthenticationSchemeProvider. services.AddStellaOpsResourceServerAuthentication(builder.Configuration); +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +services.AddAuditEmission(builder.Configuration); + // RASD-03: Register scope-based authorization policies for Excititor endpoints. // Auth is enforced by the gateway JWT bearer middleware; these named policies map // scopes to endpoint-level metadata so Router/OpenAPI can export claim requirements. diff --git a/src/Concelier/StellaOps.Excititor.WebService/StellaOps.Excititor.WebService.csproj b/src/Concelier/StellaOps.Excititor.WebService/StellaOps.Excititor.WebService.csproj index cbe4bc07b..fdae87e49 100644 --- a/src/Concelier/StellaOps.Excititor.WebService/StellaOps.Excititor.WebService.csproj +++ b/src/Concelier/StellaOps.Excititor.WebService/StellaOps.Excititor.WebService.csproj @@ -16,6 +16,7 @@ + diff --git a/src/Graph/StellaOps.Graph.Api/Program.cs b/src/Graph/StellaOps.Graph.Api/Program.cs index 34c517870..7d3bf3359 100644 --- a/src/Graph/StellaOps.Graph.Api/Program.cs +++ b/src/Graph/StellaOps.Graph.Api/Program.cs @@ -1,6 +1,7 @@ using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Authorization; using Microsoft.Extensions.Configuration; +using StellaOps.Audit.Emission; using StellaOps.Auth.Abstractions; using StellaOps.Auth.ServerIntegration; using StellaOps.Auth.ServerIntegration.Tenancy; @@ -110,6 +111,10 @@ builder.Services .AddScheme( GraphHeaderAuthenticationHandler.SchemeName, _ => { }); + +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +builder.Services.AddAuditEmission(builder.Configuration); + builder.Services.AddAuthorization(options => { options.AddPolicy(GraphPolicies.ReadOrQuery, policy => diff --git a/src/Graph/StellaOps.Graph.Api/StellaOps.Graph.Api.csproj b/src/Graph/StellaOps.Graph.Api/StellaOps.Graph.Api.csproj index 574ec5843..c835dc95a 100644 --- a/src/Graph/StellaOps.Graph.Api/StellaOps.Graph.Api.csproj +++ b/src/Graph/StellaOps.Graph.Api/StellaOps.Graph.Api.csproj @@ -13,6 +13,7 @@ + diff --git a/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/Program.cs b/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/Program.cs index 29a7eb1ec..ec6eef493 100644 --- a/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/Program.cs +++ b/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/Program.cs @@ -36,6 +36,7 @@ using StellaOps.Notify.Persistence.Extensions; using StellaOps.Notify.Queue; using StellaOps.Notifier.Worker.Storage; using StellaOps.Cryptography; +using StellaOps.Audit.Emission; using StellaOps.Auth.ServerIntegration; using StellaOps.Auth.ServerIntegration.Tenancy; using StellaOps.Auth.Abstractions; @@ -175,6 +176,9 @@ builder.Services.AddNotifierTenancy(builder.Configuration); // Authentication (resource server JWT validation via Authority) builder.Services.AddStellaOpsResourceServerAuthentication(builder.Configuration); +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +builder.Services.AddAuditEmission(builder.Configuration); + // Authorization policies for Notifier scopes (RASD-03) builder.Services.AddAuthorization(options => { diff --git a/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/StellaOps.Notifier.WebService.csproj b/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/StellaOps.Notifier.WebService.csproj index fbeb96082..c6f27d536 100644 --- a/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/StellaOps.Notifier.WebService.csproj +++ b/src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/StellaOps.Notifier.WebService.csproj @@ -10,6 +10,7 @@ + diff --git a/src/Policy/StellaOps.Policy.Gateway/Program.cs b/src/Policy/StellaOps.Policy.Gateway/Program.cs index 4b56fa5d9..f873051b3 100644 --- a/src/Policy/StellaOps.Policy.Gateway/Program.cs +++ b/src/Policy/StellaOps.Policy.Gateway/Program.cs @@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.Extensions.Configuration; +using StellaOps.Audit.Emission; using Microsoft.Extensions.DependencyInjection.Extensions; using Microsoft.Extensions.Logging; using Microsoft.Extensions.Options; @@ -140,6 +141,10 @@ builder.Services.AddProblemDetails(); builder.Services.AddHealthChecks(); builder.Services.AddAuthentication(); builder.Services.AddAuthorization(); + +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +builder.Services.AddAuditEmission(builder.Configuration); + builder.Services.AddStellaOpsScopeHandler(); builder.Services.AddPolicyPostgresStorage(builder.Configuration); // Also configure unnamed PostgresOptions so PolicyDataSource (IOptions) resolves the connection string. diff --git a/src/Policy/StellaOps.Policy.Gateway/StellaOps.Policy.Gateway.csproj b/src/Policy/StellaOps.Policy.Gateway/StellaOps.Policy.Gateway.csproj index f670d1186..92734dec3 100644 --- a/src/Policy/StellaOps.Policy.Gateway/StellaOps.Policy.Gateway.csproj +++ b/src/Policy/StellaOps.Policy.Gateway/StellaOps.Policy.Gateway.csproj @@ -10,6 +10,7 @@ + diff --git a/src/SbomService/StellaOps.SbomService/Program.cs b/src/SbomService/StellaOps.SbomService/Program.cs index ebe66b8f2..ac1849818 100644 --- a/src/SbomService/StellaOps.SbomService/Program.cs +++ b/src/SbomService/StellaOps.SbomService/Program.cs @@ -1,6 +1,7 @@ using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Mvc; +using StellaOps.Audit.Emission; using StellaOps.Auth.ServerIntegration; using StellaOps.Auth.ServerIntegration.Tenancy; using Microsoft.Extensions.Options; @@ -30,6 +31,10 @@ builder.Services.AddSingleton(SystemGuidProvider.Instance); builder.Services.AddAuthentication(HeaderAuthenticationHandler.SchemeName) .AddScheme(HeaderAuthenticationHandler.SchemeName, _ => { }); builder.Services.AddStellaOpsTenantServices(); + +// Unified audit emission (posts audit events to Timeline service). See SPRINT_20260408_004 AUDIT-002. +builder.Services.AddAuditEmission(builder.Configuration); + builder.Services.AddAuthorization(options => { // SbomService uses HeaderAuthenticationHandler (x-tenant-id). Policies require authenticated tenant context. diff --git a/src/SbomService/StellaOps.SbomService/StellaOps.SbomService.csproj b/src/SbomService/StellaOps.SbomService/StellaOps.SbomService.csproj index 27e9aa79b..7647e2a95 100644 --- a/src/SbomService/StellaOps.SbomService/StellaOps.SbomService.csproj +++ b/src/SbomService/StellaOps.SbomService/StellaOps.SbomService.csproj @@ -25,6 +25,7 @@ +