Initial import from Proxmox host

src/opnsense_mcp/audit.py

@@ -0,0 +1,23 @@
+"""Append-only audit log for mutating operations."""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from opnsense_mcp.config import settings
+
+
+def audit_log(action: str, details: dict[str, Any], *, dry_run: bool = False) -> None:
+    entry = {
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "action": action,
+        "dry_run": dry_run,
+        **details,
+    }
+    path = Path(settings.audit_log_path)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as fh:
+        fh.write(json.dumps(entry, default=str) + "\n")