- Shipped
- 4 Agosti 2026, 04:07 UTC
- Author
- Kamo
- Commit
- 420fe09
The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§164.528) and the periodic information system activity review (§164.308(a)(1)(ii)(D)). Both are queries. This adds the query surface. Authorization is the feature, not the grid. The organization is taken from the session and from nowhere else — there is deliberately no orgId parameter on any handler, and PhiAuditQueryService is a single choke point that adds the tenant predicate before it even consults the filter. Four sibling query methods would have been four chances to forget it. Scoping is a WHERE clause rather than a post-filter, because filtering a returned page would leave totalElements counting rows the caller may not see. The read side gets its own repository interface. The shared PhiAccessLogRepository finders are deliberately cross-tenant — correct for a platform tool, a disclosure if handed to a customer screen — so the screen gets an interface whose only entry point takes a Specification. It lives under com.kamo.SecurityService, which the existing @EnableJpaRepositories entry already covers, so no scan change is needed and none can be forgotten. Rights are VIEW_ACCESS_LOGS (29) and EXPORT_ACCESS_LOGS (32) — the pair that already gates the authentication log, so anyone who administers security today can use this on day one. A new right id would have shipped the screen dead: it needs a KamoInitializer run and a grant before any member holds one. Reading the trail is itself recorded, as REPORT/SEARCH for a read and REPORT/EXPORT for a copy, including refused attempts. The search criteria are not recorded — a filter carries member and record ids, and a trail that stores what was searched for accumulates the identifiers it exists to protect. Everything is bounded: page size clamps to 200, an export caps at 10,000 rows. A six-year trail is millions of rows and the capture layer writes one row per grid row per load, so an unclamped size is a reachable OOM rather than a theoretical one. Timestamps leave as explicit UTC instants. The column is zone-less wall-clock, and this evidence is read months later by someone who was not there.