fix(audit): reject unsafe tenant queries

[XnLemon]

Objective

Close a small Phase2 audit-query safety gap by rejecting tenant-scoped audit queries that include unredacted sensitive content in the tenant filter itself.

Changes

• Added shared redaction validation for AuditQueryFilter.TenantID after trimming and before matching records.
• Preserved existing missing-tenant behavior via ErrTenantIDRequired.
• Added regression coverage for unsafe tenant query filters carrying Authorization bearer tokens.

Validation

• go test ./platform
• go vet ./platform
• git diff --check
• open-code-review subagent review: 0 High / 0 Medium / 0 Low

Known Risks / Limitations

• This is intentionally narrow and only hardens audit query input validation; it does not change audit record storage or matching semantics beyond rejecting unsafe tenant filters.

Follow-up

• Continue Phase2 closure on the next independently reviewable governance/security gap.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c2d0676b-6a75-4344-bd56-3d1409fb6690

📥 Commits

Reviewing files that changed from the base of the PR and between 361e2a4 and 35493a2.

📒 Files selected for processing (2)

• platform/audit_query.go
• platform/audit_query_test.go

---

📝 Walkthrough

English

• Change overview: Audit queries now trim and validate AuditQueryFilter.TenantID for unsafe or sensitive content, including bearer-token-like Authorization values, before matching records. Missing tenant IDs continue to return ErrTenantIDRequired; audit storage and matching semantics are otherwise unchanged.
• Compatibility and behavioral risks: Valid but previously accepted tenant IDs containing sensitive-content patterns may now be rejected. Existing callers must continue providing a non-empty, safe tenant ID. The new regression test verifies rejection and identifies tenant_id in the error.
• Recommended validation: Run go test ./platform, go vet ./platform, and git diff --check. Also verify missing-tenant behavior and safe tenant filters remain successful.

中文

变更概述

• 审计查询现在会先对 AuditQueryFilter.TenantID 进行去空格处理，并在记录匹配前校验是否包含不安全或敏感内容，包括类似 Authorization Bearer Token 的值。
• 缺少租户 ID 时仍返回 ErrTenantIDRequired；审计记录存储和其他匹配语义未改变。
• 新增回归测试，确认包含不安全内容的租户过滤条件会被拒绝，并在错误信息中标识 tenant_id。

兼容性与行为风险

• 以前可接受但包含敏感内容特征的租户 ID 现在可能被拒绝。
• 调用方必须继续传入非空且安全的租户 ID。
• 正常租户过滤条件以及缺少租户 ID 的既有行为应保持不变。

建议验证步骤

执行：

go test ./platform
go vet ./platform
git diff --check

同时确认安全的租户过滤条件查询成功，缺少租户 ID 时仍返回 ErrTenantIDRequired。

Walkthrough

AuditQueryFilter.normalize() now validates non-empty tenant IDs against redacted-text rules. A unit test confirms QueryAudit rejects a tenant filter containing an authorization-token-like substring.

Changes

Audit filter validation

Layer / File(s)	Summary
Tenant validation and regression coverage platform/audit_query.go, platform/audit_query_test.go	Tenant IDs are validated with validateAuditRedactedText before other filter validation, with test coverage for unsafe tenant values.

Estimated code review effort: 1 (Trivial) | ~5 minutes

中文

AuditQueryFilter.normalize() 现在会校验非空租户 ID，测试覆盖了包含类似授权令牌内容的非法租户筛选值。

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects rejecting unsafe tenant audit queries.
Description check	✅ Passed	The description is clearly related to hardening audit query tenant filter validation and adding regression coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/phase2-audit-query-redaction

---

_{Comment @coderabbitai help to get the list of available commands.}