Repository navigation
Conversation
LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
- Append-only, partitioned audit_events with hash-chain integrity, retention/archiving, and a scoped query layer. - Automatic middleware capture plus semantic events for auth, user/role, API key, organization, sensitive reads, and AI usage. - Super-admin/owner/member visibility rules, including a backfill for historical super-admin actions. - New Reports > Audit Log page with filters, live tail, exports, integrity checks, and a Reviews-style table. - Action catalog, routes guide, and audit documentation. LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%)
# Conflicts: # ui/package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This branch adds an enterprise audit log to LiveReview and a local end-to-end harness that verifies it with real roles, real API keys, and a real
lrcreview.The audit module is a framework primitive, not a one-off page:
audit_events/reports/auditUI for browsing, filtering, live tail, exports, retention, and integrityIt also adds a safe local E2E harness so the audit behavior can be exercised against a real generated owner/member/super-admin matrix without touching the developer's
~/.lrc.toml.Design
flowchart LR A[HTTP mutation] --> B[Echo audit middleware] B --> C{Route has audit.Spec?} C -- yes --> D[Semantic event] C -- no --> E[Generic HTTP event] D --> F[Sanitize details] E --> F F --> G[Recorder] G --> H[(audit_events<br/>monthly partitions)] G --> I[Per-org hash chain] G --> J[Audit-only key / SIEM] H --> K[Scoped query builder] K --> L[Org audit API] K --> M[Admin cross-org API] L --> N[/reports/audit] M --> NPrivileged changes are fail-closed: the business row and its audit row are written in the same transaction. If the audit write cannot be persisted, the business change rolls back.
sequenceDiagram participant U as User participant H as Handler participant DB as Postgres U->>H: PUT /orgs/:id/users/:user_id/role H->>DB: BEGIN H->>DB: update user_roles H->>DB: insert audit_events alt audit insert fails DB-->>H: error H->>DB: ROLLBACK H-->>U: 500, no business change else audit insert succeeds H->>DB: COMMIT H-->>U: 200 endScoping model
org_id = current org AND actor_user_id = selforg_id = current org, excludingactor_capacity=adminandactor_kind=super_adminEvery super-admin action is written with
actor_capacity=admin. Super-admin work is therefore recorded, visible to super admins, and hidden from owners.Main changes
1. Storage and integrity
db/migrations/20261025120000_create_audit_events.sqlUPDATErejected;DELETEonly for retention withapp.audit_purge=on)seq,prev_hash,hashchain columnsdb/migrations/20261025120100_add_api_key_kind.sqlstandardvsaudit_readerdb/migrations/20261025130000_backfill_super_admin_visibility.sqlactor_capacity=admininternal/auditlog/*2. Automatic and semantic capture
/api/v1request plus sensitive GETs.s.audited(...)registers mutating routes and their semantic action spec together.docs/audit-events.md.3. Read API and exports
Org-scoped:
Admin:
Exports, archive downloads, audit reads, and evidence packages emit their own sensitive-read events.
4. Retention and integrity
system_settings.audit_settings.5. UI
Reports → Audit Logpage (ui/src/pages/Reports/AuditLog.tsx).audit_readerkeys with a badge.6. Local E2E harness
make dev-upnow starts an isolated lrc/E2E window.~/.lrc.tomlis never touched by default.lrcreview submission and polling.manual-talent*URLs; full suite runs on one selected target.See
docs/e2e-local-testing.md.Tests / validation
go test ./internal/auditlog/...— passnpx tsc --noEmit— pass./internal/... ./pkg/... ./storage/... ./network/... .— passlrcreview completedhttps://manual-talent3.apps.hexmos.com— passmake e2e-doctor— all checks OK~/.lrc.tomlhash unchangedA production UI build was not run as part of this PR validation.
Rollout notes
ACCESS EXCLUSIVElock on audit partitions; run it in a maintenance window on busy instances./reports/auditavailable.Known follow-ups
seq 1; fresh rows verify correctly. If historical chain integrity on upgraded instances is required, a chain-rebuild/chain-version migration should follow before claiming historical tamper-evidence.audit_readerremains a separate hardening project.Checklist
Notes for reviewers
Focus areas:
internal/auditlog/query.go— visibility rules and tenant isolation.internal/auditlog/recorder.go+ privileged handlers — fail-closed transaction behavior.internal/api/audit_middleware.go+audit_allowlist.go— route coverage and sensitive-read handling.internal/api/audit_retention.go— partition/archive/anchor lifecycle.🔍 LiveReview
⚙️ Customize risk-based approval policy for this repository or your organization.