[Bogdan00004]

Component and requirement IDs

• Component: Audit (backend/Platform.Audit)
• Requirements: AUD-01 (foundation only, no audit behavior yet); supports OPS-02, OPS-03
• Author(s): Bogdan Pećanac, PR 149/2023

Changes

• New backend/SecurityLab.slnx listing Platform.Access, Platform.Api, Platform.Audit, Platform.Audit.Tests and Platform.Tests.
• New Platform.Audit project with the layers Contracts, Domain, Application, Infrastructure and Composition. Only AddAudit() exists; it registers nothing yet.
• Platform.Api references Audit and calls AddAudit() after AddAccessControl() (2 lines in Program.cs).
• New Platform.Audit.Tests (NUnit) with DI scope validation tests.
• ci.yml: builds and tests the whole solution (including Platform.Tests, previously run by its own step), fails when no test is executed, and uploads the TRX results even when tests fail.
• New docs/components/audit/DI-GUIDELINES.md: proposed service lifetime rules, updated for the Identity services now on main.
• Branch updated with main (e7474c7). The only conflict was in Program.cs; main's content is kept and only AddAudit() is added.

Verification

• Commands: dotnet build backend/SecurityLab.slnx --configuration Release and dotnet test backend/SecurityLab.slnx --configuration Release
• Commit: c7e47e3, date: 02.11.2026, SDK: 10.0.403
• Result: build succeeded; tests total 46 (Audit 4, Platform.Tests 42), passed 46, failed 0, skipped 0 (run locally on Windows).
• CI run: https://github.com/owlCoder/security-lab/actions/runs/41516623911
• No audit behavior exists yet, so there is nothing else to verify.

Architecture and data flow

N/A: this PR adds no data flow or stored data. The component diagram and DFD will accompany the first audit behavior.

Security checks and negative tests

• Boundary: dependency injection composition. Misuse: a singleton capturing a scoped service could serve one request's identity or membership to another.
• Control: strict ValidateScopes and ValidateOnBuild, both on the container and on the real Platform.Api host (now including the Identity registrations).
• Positive tests: AccessAndAuditRegistrations_PassScopeAndBuildValidation, Host_StartsWithScopeValidation_AndHealthResponds.
• Negative tests: CaptiveDependency_IsRejectedByValidation, Host_WithCaptiveDependency_FailsToStart.
• Residual risk: validation covers only registered services; no secrets or user data are involved.

Dependencies

• CI: the Identity Test step is replaced by a solution-level run that includes Platform.Tests (42 tests, all passing).
• backend/SecurityLab.slnx is also added by PR ACC-04 / ACC-08: KT1 implementacija, bezbednosni model i negativni testovi (ponovljeni PR #20) #25/ACC-04 / ACC-08: KT1 implementacija, bezbednosni model i negativni testovi (ponovljeni PR #21) #26 (restore of ACC-04/ACC-08). Whichever lands second adds its own project to the list.
• Identity has its own IAuditWriter in Platform.Api.Services.Identity; how it relates to the future Audit contract is an open question.
• Other Audit work (contract, storage, writer, query) builds on this skeleton.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[owlCoder]

Pregled: AUD-01 pripada timu 12. Osnovni GitHub Actions build prolazi, ali 4 najavljena Audit DI testa nisu pokrenuta u CI. Pre merge-a molimo uključite Platform.Audit.Tests u CI, potvrdite zelen rezultat i ponovo proverite integraciju na najnovijem main.

[Bogdan00004]

@owlCoder Uključeno: CI sada gradi i testira ceo solution (Audit i Platform.Tests, 46 testova), TRX se čuva i pri padu, a CI pada ako nijedan test nije izvršen. Grana je osvežena na main (e7474c7), konflikt u Program.cs je rešen (dodat samo AddAudit()). CI run: https://github.com/owlCoder/security-lab/actions/runs/41516623911