add Lua sandbox with timer system (milestones 1-5 complete)

src/main/cpp/sandbox/audit_log.cpp

@@ -0,0 +1,188 @@
+#include "audit_log.h"
+
+#include <algorithm>
+
+namespace mosis {
+
+//=============================================================================
+// CONSTRUCTOR
+//=============================================================================
+
+AuditLog::AuditLog(size_t max_entries)
+    : m_max_entries(max_entries)
+{
+    m_entries.resize(max_entries);
+}
+
+//=============================================================================
+// LOGGING
+//=============================================================================
+
+void AuditLog::Log(AuditEvent event, const std::string& app_id,
+                   const std::string& details, bool success) {
+    std::lock_guard<std::mutex> lock(m_mutex);
+
+    AuditEntry entry{
+        .timestamp = std::chrono::system_clock::now(),
+        .event = event,
+        .app_id = app_id,
+        .details = details,
+        .success = success
+    };
+
+    m_entries[m_write_index] = std::move(entry);
+    m_write_index = (m_write_index + 1) % m_max_entries;
+    m_total_logged++;
+
+    if (m_total_logged > m_max_entries) {
+        m_wrapped = true;
+    }
+}
+
+//=============================================================================
+// QUERIES
+//=============================================================================
+
+std::vector<AuditEntry> AuditLog::GetEntries(size_t count) const {
+    std::lock_guard<std::mutex> lock(m_mutex);
+
+    std::vector<AuditEntry> result;
+    size_t stored = GetStoredEntries();
+    count = std::min(count, stored);
+
+    result.reserve(count);
+
+    // Read from most recent backwards
+    for (size_t i = 0; i < count; i++) {
+        size_t idx = (m_write_index + m_max_entries - 1 - i) % m_max_entries;
+        result.push_back(m_entries[idx]);
+    }
+
+    return result;
+}
+
+std::vector<AuditEntry> AuditLog::GetEntriesForApp(const std::string& app_id,
+                                                    size_t count) const {
+    std::lock_guard<std::mutex> lock(m_mutex);
+
+    std::vector<AuditEntry> result;
+    result.reserve(count);
+
+    size_t stored = GetStoredEntries();
+
+    for (size_t i = 0; i < stored && result.size() < count; i++) {
+        size_t idx = (m_write_index + m_max_entries - 1 - i) % m_max_entries;
+        if (m_entries[idx].app_id == app_id) {
+            result.push_back(m_entries[idx]);
+        }
+    }
+
+    return result;
+}
+
+std::vector<AuditEntry> AuditLog::GetEntriesByEvent(AuditEvent event,
+                                                     size_t count) const {
+    std::lock_guard<std::mutex> lock(m_mutex);
+
+    std::vector<AuditEntry> result;
+    result.reserve(count);
+
+    size_t stored = GetStoredEntries();
+
+    for (size_t i = 0; i < stored && result.size() < count; i++) {
+        size_t idx = (m_write_index + m_max_entries - 1 - i) % m_max_entries;
+        if (m_entries[idx].event == event) {
+            result.push_back(m_entries[idx]);
+        }
+    }
+
+    return result;
+}
+
+//=============================================================================
+// STATISTICS
+//=============================================================================
+
+size_t AuditLog::GetTotalEntries() const {
+    std::lock_guard<std::mutex> lock(m_mutex);
+    return m_total_logged;
+}
+
+size_t AuditLog::GetStoredEntries() const {
+    // Note: caller should hold lock
+    if (m_wrapped) {
+        return m_max_entries;
+    }
+    return m_write_index;
+}
+
+size_t AuditLog::CountEvents(AuditEvent event, const std::string& app_id) const {
+    std::lock_guard<std::mutex> lock(m_mutex);
+
+    size_t count = 0;
+    size_t stored = GetStoredEntries();
+
+    for (size_t i = 0; i < stored; i++) {
+        const auto& entry = m_entries[i];
+        if (entry.event == event) {
+            if (app_id.empty() || entry.app_id == app_id) {
+                count++;
+            }
+        }
+    }
+
+    return count;
+}
+
+//=============================================================================
+// CLEAR
+//=============================================================================
+
+void AuditLog::Clear() {
+    std::lock_guard<std::mutex> lock(m_mutex);
+    m_write_index = 0;
+    m_total_logged = 0;
+    m_wrapped = false;
+    // Clear all entries
+    for (auto& entry : m_entries) {
+        entry = AuditEntry{};
+    }
+}
+
+//=============================================================================
+// UTILITIES
+//=============================================================================
+
+const char* AuditLog::EventToString(AuditEvent event) {
+    switch (event) {
+        case AuditEvent::AppStart: return "AppStart";
+        case AuditEvent::AppStop: return "AppStop";
+        case AuditEvent::PermissionCheck: return "PermissionCheck";
+        case AuditEvent::PermissionGranted: return "PermissionGranted";
+        case AuditEvent::PermissionDenied: return "PermissionDenied";
+        case AuditEvent::NetworkRequest: return "NetworkRequest";
+        case AuditEvent::NetworkBlocked: return "NetworkBlocked";
+        case AuditEvent::FileAccess: return "FileAccess";
+        case AuditEvent::FileBlocked: return "FileBlocked";
+        case AuditEvent::DatabaseAccess: return "DatabaseAccess";
+        case AuditEvent::CameraAccess: return "CameraAccess";
+        case AuditEvent::MicrophoneAccess: return "MicrophoneAccess";
+        case AuditEvent::LocationAccess: return "LocationAccess";
+        case AuditEvent::SandboxViolation: return "SandboxViolation";
+        case AuditEvent::ResourceLimitHit: return "ResourceLimitHit";
+        case AuditEvent::RateLimitHit: return "RateLimitHit";
+        case AuditEvent::Custom: return "Custom";
+        default: return "Unknown";
+    }
+}
+
+//=============================================================================
+// GLOBAL INSTANCE
+//=============================================================================
+
+AuditLog& GetAuditLog() {
+    static AuditLog instance(10000);
+    return instance;
+}
+
+} // namespace mosis