fix auditd search user schema

Author: marcofortina

docs/plugins/generated.md

@@ -881,10 +881,10 @@ Search audit events by key, user or time window.
 
 | Parameter | Required | Type | Default | Description |
 |---|---:|---|---|---|
-| `key` | no | `string` |  | SSH public key line. |
-| `user` | no | `boolean` | `False` | Use systemctl --user instead of the system manager. |
-| `start` | no | `boolean` | `False` | Start a service or timer after installing its unit. |
-| `end` | no | `string` |  | End time for an audit search or time window. |
+| `key` | no | `string` |  | Audit event key. |
+| `user` | no | `string` |  | Audit user name or numeric UID. |
+| `start` | no | `string` |  | Audit search start time. |
+| `end` | no | `string` |  | Audit search end time. |
 | `sudo` | no | `boolean` | `False` | Run the remote operation through sudo -n when supported. |
 
 Result fields:

src/automax/plugins/ops_completeness.py

@@ -173,6 +173,12 @@ class AuditdSearchPlugin(_ReadOnlyCommandPlugin):
     name = "auditd.search"
     description = "Search audit events by key, user or time window."
     optional_params = ("key", "user", "start", "end", "sudo")
+    parameter_schema = {
+        "key": {"type": "string", "default": None, "description": "Audit event key."},
+        "user": {"type": "string", "default": None, "description": "Audit user name or numeric UID."},
+        "start": {"type": "string", "default": None, "description": "Audit search start time."},
+        "end": {"type": "string", "default": None, "description": "Audit search end time."},
+    }
 
     def manual_commands(self, params: Dict[str, Any], context: ExecutionContext) -> list[str]:
         args = []

tests/test_documentation_and_regressions.py

@@ -663,6 +663,24 @@ def test_plugin_smoke_runbooks_match_archive_decompress_parameters():
 
     assert offenders == []
 
+
+def test_plugin_smoke_runbooks_match_auditd_search_user_schema():
+    from automax.plugins.registry import build_builtin_registry
+
+    plugin = build_builtin_registry().get("auditd.search")
+    plugin.validate({"key": "automax", "user": "deploy", "start": "recent", "end": "now"})
+
+    runbook = yaml.safe_load(Path("examples/runbooks/runbooks/05-auditd.check.yaml").read_text(encoding="utf-8"))
+    search_substeps = [
+        substep
+        for task in runbook.get("tasks", [])
+        for step in task.get("steps", [])
+        for substep in step.get("substeps", [])
+        if substep.get("use") == "auditd.search"
+    ]
+    assert search_substeps
+    assert all(isinstance((substep.get("with") or {}).get("user"), str) for substep in search_substeps)
+
 def test_docs_show_sudo_password_env_for_runs_and_capability_installs():
     docs = "\n".join(
         path.read_text(encoding="utf-8")