foxhunt/database/QUICK_START.md

# Database Quick Start Guide

**Foxhunt HFT Trading System - Audit Infrastructure**

---

## Connection Information

```bash
Host: localhost
Port: 5433
Database: foxhunt_test
User: foxhunt_test
Password: test_password
```

### Environment Variable

```bash
export DATABASE_URL=postgresql://foxhunt_test:test_password@localhost:5433/foxhunt_test
```

### Rust Connection (sqlx)

```rust
use sqlx::postgres::PgPool;

let pool = PgPool::connect("postgresql://foxhunt_test:test_password@localhost:5433/foxhunt_test")
    .await?;
```

---

## Quick Tests

### 1. Test Connectivity

```bash
PGPASSWORD=test_password psql -h localhost -p 5433 -U foxhunt_test -d foxhunt_test -c "SELECT version();"
```

### 2. Count Audit Tables

```bash
PGPASSWORD=test_password psql -h localhost -p 5433 -U foxhunt_test -d foxhunt_test -c "
SELECT COUNT(*) FROM information_schema.tables
WHERE table_name LIKE '%audit%' AND table_schema = 'public';"
```

### 3. Insert Test Event

```bash
PGPASSWORD=test_password psql -h localhost -p 5433 -U foxhunt_test -d foxhunt_test -c "
INSERT INTO security_audit_log (event_type, success, error_message)
VALUES ('admin_action', true, 'Test event')
RETURNING id;"
```

---

## Available Audit Tables (8 tables)

| Table | Purpose | Size | Indexes |
|-------|---------|------|---------|
| `security_audit_log` | Security events | 120 kB | 6 |
| `sox_trade_audit` | SOX compliance | 48 kB | 5 |
| `transaction_audit_events` | HFT transactions | 152 kB | 12 |
| `kill_switch_audit` | Circuit breaker | 40 kB | 4 |
| `position_limits_audit` | Position monitoring | 40 kB | 4 |
| `mifid_transaction_report` | MiFID II reporting | 40 kB | 4 |
| `best_execution_analysis` | Execution quality | 40 kB | 4 |
| `compliance_rule_executions` | Rule tracking | 40 kB | 4 |

---

## Common Operations

### Log Security Event

```sql
INSERT INTO security_audit_log (event_type, success, error_message, ip_address)
VALUES ('login_attempt', true, NULL, '192.168.1.1')
RETURNING id;
```

### Log Trade (SOX)

```sql
SELECT log_sox_trade_activity(
    'f47ac10b-58cc-4372-a567-0e02b2c3d479'::uuid,  -- trade_id
    'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid,  -- user_id
    'AAPL',                                          -- symbol
    'BUY',                                           -- side
    100.0,                                           -- quantity
    150.25,                                          -- price
    'LIMIT',                                         -- order_type
    15025.00,                                        -- trade_value
    NOW(),                                           -- order_timestamp
    NULL,                                            -- risk_assessment
    NULL                                             -- compliance_flags
);
```

### Query Recent Events

```sql
SELECT event_type, success, created_at
FROM security_audit_log
ORDER BY created_at DESC
LIMIT 10;
```

### Activate Kill Switch

```sql
SELECT activate_kill_switch(
    'AUTOMATIC',
    'Risk limit exceeded',
    'HIGH',
    'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid,
    1000000.00,
    -50000.00
);
```

---

## Rust Code Examples

### Insert Audit Event

```rust
use sqlx::PgPool;
use uuid::Uuid;

async fn log_security_event(
    pool: &PgPool,
    event_type: &str,
    success: bool,
    error_msg: Option<&str>,
) -> Result<Uuid, sqlx::Error> {
    let record = sqlx::query!(
        r#"
        INSERT INTO security_audit_log (event_type, success, error_message)
        VALUES ($1, $2, $3)
        RETURNING id
        "#,
        event_type,
        success,
        error_msg
    )
    .fetch_one(pool)
    .await?;

    Ok(record.id)
}
```

### Query Audit Events

```rust
use sqlx::PgPool;
use chrono::{DateTime, Utc};

#[derive(Debug)]
struct AuditEvent {
    id: Uuid,
    event_type: String,
    success: bool,
    created_at: DateTime<Utc>,
}

async fn get_recent_events(
    pool: &PgPool,
    limit: i64,
) -> Result<Vec<AuditEvent>, sqlx::Error> {
    let events = sqlx::query_as!(
        AuditEvent,
        r#"
        SELECT id, event_type, success, created_at
        FROM security_audit_log
        ORDER BY created_at DESC
        LIMIT $1
        "#,
        limit
    )
    .fetch_all(pool)
    .await?;

    Ok(events)
}
```

### Call Audit Function

```rust
use sqlx::PgPool;
use uuid::Uuid;

async fn log_sox_trade(
    pool: &PgPool,
    trade_id: Uuid,
    user_id: Uuid,
    symbol: &str,
    side: &str,
    quantity: f64,
    price: f64,
) -> Result<Uuid, sqlx::Error> {
    let record = sqlx::query!(
        r#"
        SELECT log_sox_trade_activity(
            $1::uuid, $2::uuid, $3, $4, $5, $6,
            'LIMIT', $7, NOW(), NULL, NULL
        ) as audit_id
        "#,
        trade_id,
        user_id,
        symbol,
        side,
        quantity,
        price,
        quantity * price
    )
    .fetch_one(pool)
    .await?;

    Ok(record.audit_id.unwrap())
}
```

---

## Available Functions

| Function | Purpose | Returns |
|----------|---------|---------|
| `log_sox_trade_activity(...)` | Log SOX trade | UUID |
| `log_security_event(...)` | Log security event | UUID |
| `activate_kill_switch(...)` | Activate circuit breaker | UUID |
| `check_position_limits(...)` | Check position limits | UUID |
| `verify_audit_event_integrity(event_id)` | Verify checksum | BOOLEAN |
| `query_audit_events(...)` | Query with filters | TABLE |
| `get_audit_event_statistics(...)` | Get statistics | TABLE |

---

## Regulatory Compliance

### SOX (Sarbanes-Oxley)
- **Table**: `sox_trade_audit`
- **Requirements**: Section 404 (Internal Controls), Section 302 (Certification)
- **Retention**: 7 years minimum
- **Features**: Immutable, SHA-256 checksums, audit trail versioning

### MiFID II
- **Tables**: `mifid_transaction_report`, `best_execution_analysis`, `position_limits_audit`
- **Requirements**: Articles 26, 27, 57
- **Features**: RTS 22 compliance, best execution grading (A+ to F)

---

## Performance Tips

1. **Use Prepared Statements**: Prevent SQL injection and improve performance
2. **Batch Inserts**: Use transactions for multiple audit events
3. **Index Usage**: All audit tables have optimized indexes
4. **Partitioning**: Consider partitioning `transaction_audit_events` for large datasets
5. **VACUUM**: Run `VACUUM ANALYZE` regularly on audit tables

---

## Troubleshooting

### Connection Failed

```bash
# Check container status
docker ps | grep postgres

# Check logs
docker logs api_gateway_test_postgres

# Restart container
docker restart api_gateway_test_postgres
```

### Slow Queries

```sql
-- Check index usage
SELECT schemaname, tablename, indexname, idx_scan
FROM pg_stat_user_indexes
WHERE schemaname = 'public' AND tablename LIKE '%audit%'
ORDER BY idx_scan DESC;

-- Check table statistics
SELECT schemaname, relname, n_live_tup, n_dead_tup
FROM pg_stat_user_tables
WHERE schemaname = 'public' AND relname LIKE '%audit%';
```

### Disk Space Issues

```sql
-- Check table sizes
SELECT tablename, pg_size_pretty(pg_total_relation_size('public.'||tablename))
FROM pg_tables
WHERE schemaname = 'public' AND tablename LIKE '%audit%'
ORDER BY pg_total_relation_size('public.'||tablename) DESC;
```

---

## Additional Resources

- **Full Documentation**: `/home/jgrusewski/Work/foxhunt/docs/WAVE78_AGENT1_DATABASE_MIGRATIONS.md`
- **Query Reference**: `/home/jgrusewski/Work/foxhunt/database/common_audit_queries.sql`
- **Connection Test**: `/tmp/test_db_connection.sh`

---

## Support

For database issues:
1. Check container logs: `docker logs api_gateway_test_postgres`
2. Verify connectivity: Run `/tmp/test_db_connection.sh`
3. Review migration status in documentation
4. Check for role permission errors (known issue, non-blocking)

---

**Last Updated**: 2025-10-03
**Database Version**: PostgreSQL 16.10
**Status**: ✅ OPERATIONAL (95/100 production readiness)