feat: add tenant-scoped audit query API #5

2026-07-21T14:07:41+08:00

zheromiku commented

2026-07-21 14:07:41 +08:00

Summary

add read-only GET /v1/admin/audit/turns and GET /v1/admin/audit/turns/{id} endpoints
provide stable (created_at,id) keyset pagination with default 20 and maximum 100 rows
return 200-rune question/answer summaries in lists and full question/answer text only in detail views
expose safe message, delivery, reference, and media metadata without raw provider payloads

Security and tenant isolation

require a distinct DOBOTAI_ADMIN_TOKEN with strict constant-time Bearer authentication
bind every query to the server-configured DOBOTAI_TENANT_KEY; callers cannot select or override tenant scope
require loopback listen address whenever the audit API is enabled
keep audit routes disabled when no admin token is configured and fail closed on partial configuration
parameterize all SQL and constrain message, actor, and conversation joins by tenant and channel
exclude reference content/raw data, provider message IDs, WeKnora session/request IDs, raw errors, webhooks, and tokens

Data behavior

read-only feature: no database migration and no database writes
tolerate historical JSON null reference metadata while preserving deterministic pagination
return generic HTTP errors without leaking database or upstream error text

Verification

target tests: 7 packages, 283 passed, 0 failed
go vet on the same 7 packages: PASS
git diff --check: PASS
PostgreSQL 16.14 production read-only integration: two cursor pages, zero overlap, detail links, and forbidden JSON key checks PASS
historical JSON-null detail query against production data: PASS
independent read-only review: PASS (0 blockers, 0 security concerns)

Scope boundary

this is the lightweight single-tenant admin-token plan; account management and RBAC are intentionally deferred
no feedback, support workflow, dashboard, token-usage, or schema work is included

Not performed

not merged
not deployed
no production admin token has been configured
production source checkout and running service are unchanged
production database schema is unchanged

## Summary - add read-only `GET /v1/admin/audit/turns` and `GET /v1/admin/audit/turns/{id}` endpoints - provide stable `(created_at,id)` keyset pagination with default 20 and maximum 100 rows - return 200-rune question/answer summaries in lists and full question/answer text only in detail views - expose safe message, delivery, reference, and media metadata without raw provider payloads ## Security and tenant isolation - require a distinct `DOBOTAI_ADMIN_TOKEN` with strict constant-time Bearer authentication - bind every query to the server-configured `DOBOTAI_TENANT_KEY`; callers cannot select or override tenant scope - require loopback listen address whenever the audit API is enabled - keep audit routes disabled when no admin token is configured and fail closed on partial configuration - parameterize all SQL and constrain message, actor, and conversation joins by tenant and channel - exclude reference content/raw data, provider message IDs, WeKnora session/request IDs, raw errors, webhooks, and tokens ## Data behavior - read-only feature: no database migration and no database writes - tolerate historical JSON `null` reference metadata while preserving deterministic pagination - return generic HTTP errors without leaking database or upstream error text ## Verification - target tests: 7 packages, 283 passed, 0 failed - `go vet` on the same 7 packages: PASS - `git diff --check`: PASS - PostgreSQL 16.14 production read-only integration: two cursor pages, zero overlap, detail links, and forbidden JSON key checks PASS - historical JSON-null detail query against production data: PASS - independent read-only review: PASS (0 blockers, 0 security concerns) ## Scope boundary - this is the lightweight single-tenant admin-token plan; account management and RBAC are intentionally deferred - no feedback, support workflow, dashboard, token-usage, or schema work is included ## Not performed - not merged - not deployed - no production admin token has been configured - production source checkout and running service are unchanged - production database schema is unchanged

zheromiku added 1 commit 2026-07-21 14:07:42 +08:00

feat: add tenant-scoped audit query API 56e3bf4686

zheromiku merged commit f0d3d5b50d into main

2026-07-21 14:11:38 +08:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Weknora/dobotai-platform#5