feat(authz): add pluggable authorization audit sink

packages/authz/test/audit.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import { memoryAuditSink, safeRecord } from "../src/audit.ts";
+
+describe("audit sink", () => {
+  test("memoryAuditSink collects events", () => {
+    const sink = memoryAuditSink();
+    sink.record({ permission: "post:read", allowed: true, at: 1 });
+    expect(sink.events).toHaveLength(1);
+    expect(sink.events[0]!.permission).toBe("post:read");
+  });
+
+  test("safeRecord swallows sink failures", () => {
+    const exploding = {
+      record() {
+        throw new Error("sink is down");
+      },
+    };
+    // Auditing must never break a request.
+    expect(() => safeRecord(exploding, { permission: "p:x", allowed: false, at: 1 })).not.toThrow();
+  });
+
+  test("safeRecord swallows async sink rejections", async () => {
+    const rejecting = { record: async () => Promise.reject(new Error("later")) };
+    expect(() => safeRecord(rejecting, { permission: "p:x", allowed: false, at: 1 })).not.toThrow();
+    await Bun.sleep(1);
+  });
+
+  test("safeRecord tolerates an undefined sink", () => {
+    expect(() => safeRecord(undefined, { permission: "p:x", allowed: true, at: 1 })).not.toThrow();
+  });
+});