feat: deliver Sense audits to Bell (T-016)

Sense/cmd/sense-api/main.go

@@ -12,6 +12,7 @@ import (
 	"syscall"
 	"time"
 
+	"yovision/sense/internal/auditrelay"
 	"yovision/sense/internal/auth"
 	"yovision/sense/internal/config"
 	"yovision/sense/internal/controlapi"
@@ -55,6 +56,28 @@ func run(logger *slog.Logger) error {
 		return err
 	}
 	defer repository.Close()
+	var auditWorker *auditrelay.Worker
+	if cfg.AuditRelayEnabled {
+		relayStore, ok := repository.(auditrelay.Repository)
+		if !ok {
+			return errors.New("selected repository does not support audit relay")
+		}
+		if err := relayStore.AuditRelayReady(ctx); err != nil {
+			return err
+		}
+		secret, err := auditrelay.LoadKey(cfg.AuditRelayKeyFile, cfg.AuditRelayKeyID)
+		if err != nil {
+			return err
+		}
+		client, err := auditrelay.NewClient(cfg.AuditRelayURL, cfg.AuditRelayKeyID, secret, nil)
+		if err != nil {
+			return err
+		}
+		auditWorker, err = auditrelay.NewWorker(relayStore, client, instanceID)
+		if err != nil {
+			return err
+		}
+	}
 	var controlHandler http.Handler
 	if cfg.ControlAPIEnabled {
 		controlStore, ok := repository.(store.ControlRepository)
@@ -116,6 +139,9 @@ func run(logger *slog.Logger) error {
 	if orphanScanner != nil {
 		startBackground(func() { orphanScanner.Run(ctx, cfg.OrphanScanInterval, report) })
 	}
+	if auditWorker != nil {
+		startBackground(func() { auditWorker.Run(ctx, cfg.AuditRelayInterval, report) })
+	}
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", func(writer http.ResponseWriter, _ *http.Request) {
@@ -146,7 +172,8 @@ func run(logger *slog.Logger) error {
 	go func() {
 		logger.Info("Sense listening", "address", cfg.HTTPAddress, "version", version,
 			"instance_id", instanceID,
-			"control_api_enabled", cfg.ControlAPIEnabled)
+			"control_api_enabled", cfg.ControlAPIEnabled,
+			"audit_relay_enabled", cfg.AuditRelayEnabled)
 		serverErrors <- server.ListenAndServe()
 	}()