wizardchen
766a6c482f
PR 1-5 of the multi-tenant RBAC series enforce the role matrix; what they don't do is keep a durable record of who did what. Today the RBAC middleware logs "[rbac] role insufficient ..." to stderr - perishable, not searchable. Operators cannot answer "who removed Alice from tenant T-foo on Tuesday" or "did we 403 a probing user 200 times last hour" after the fact. This PR adds a generic per-tenant audit log that: - Captures mutating RBAC actions (member add/remove/role-change/leave) durably from the tenant_member service after the repo write succeeds. - Captures enforcement rejections (RequireRole / RequireOwnershipOrRole denies under EnableRBAC=true) via a gin-context-injected hook. - Sliding-window dedup (1 minute) on (tenant, actor, action, path) for denied events so a probing client cannot flood audit_logs. - Default-on - no extra env flag. Schema is generic enough for future KB / agent / datasource events to reuse via new action namespaces without another migration. Schema (migration 000044) mirrors wiki_log_entries' shape: a single audit_logs table with action, target_type/id, request path/method, outcome, and a JSONB details column. Three indexes: (tenant_id, id DESC) for the per-tenant cursor feed, actor_user_id for "what did Alice do", (tenant_id, action) for both the action filter and the dedup lookup. Sqlite mirror added for Lite mode. Wiring is nil-safe: the audit field on tenantMemberService and the gin-context lookup in rbac.go both tolerate a nil service so existing tests construct without a stub and dormant deployments degrade gracefully if the provider is misconfigured. The query API is GET /tenants/:id/audit-log, gated by Admin+ on top of the existing PathTenantMatch (denial histories should not surface to ordinary members). Cursor-paginated by descending id (sidesteps the duplicate-timestamp tie-breaking that BIGSERIAL trivially solves). Frontend: TenantMembers.vue gets a t-tabs wrapper with Members (existing) and Audit log (new) tabs; the audit tab is gated to Admin+ to mirror the server, lazy-loads on first open, paginates via the next_cursor pattern, and renders coloured chips per action/outcome so an operator can scan for anomalies. i18n keys added in all four locales. Tests: 14 new tests across service (6), middleware (4), and handler (4). Service tests pin the dedup window behaviour (writes again after expiry, dedup is per-actor-per-path, degrades on lookup error). Middleware tests pin both reject sites' audit hook and the "dormant mode does not fire" + "nil audit does not panic" invariants. Handler tests pin the cursor envelope and that an empty page returns next_cursor=0. Out of scope: per-action ACL on the audit log, retention/TTL job, KB/agent/datasource event wiring (schema supports it - just no emitters yet), async writes, frontend filter UI.
22 lines
749 B
SQL
22 lines
749 B
SQL
DROP TABLE IF EXISTS tenant_disabled_shared_agents;
|
|
DROP TABLE IF EXISTS agent_shares;
|
|
DROP TABLE IF EXISTS organization_join_requests;
|
|
DROP TABLE IF EXISTS kb_shares;
|
|
DROP TABLE IF EXISTS organization_members;
|
|
DROP TABLE IF EXISTS organizations;
|
|
DROP TABLE IF EXISTS custom_agents;
|
|
DROP TABLE IF EXISTS mcp_tool_approvals;
|
|
DROP TABLE IF EXISTS mcp_services;
|
|
DROP TABLE IF EXISTS knowledge_tags;
|
|
DROP TABLE IF EXISTS auth_tokens;
|
|
DROP TABLE IF EXISTS audit_logs;
|
|
DROP TABLE IF EXISTS tenant_members;
|
|
DROP TABLE IF EXISTS users;
|
|
DROP TABLE IF EXISTS chunks;
|
|
DROP TABLE IF EXISTS messages;
|
|
DROP TABLE IF EXISTS sessions;
|
|
DROP TABLE IF EXISTS knowledges;
|
|
DROP TABLE IF EXISTS knowledge_bases;
|
|
DROP TABLE IF EXISTS models;
|
|
DROP TABLE IF EXISTS tenants;
|