mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-22 10:02:17 -05:00
Donkie
b4d7955eaa
Phase 1 created auth_audit_log and deliberately left spoolman/auth/audit.py unwritten, because an empty stub fails the docstring lint. This writes it. What is recorded is every sign-in attempt plus anything that alters permissions. Ordinary data changes are deliberately excluded: creating a spool is already visible in the spool, and mixing those in would bury the handful of security-relevant events under thousands of routine ones, which is how audit logs stop being read. Three properties are load-bearing: Writing never breaks the operation it describes. record() swallows and logs its own failures, and uses its own database session rather than the caller's. Login attempts have already committed by the time they are audited, several call sites hold no session at all, and sharing one would let an audit write roll back the thing it was recording. The response and the log disagree on purpose. A failed sign-in tells the caller only "incorrect username or password" -- distinguishing the cases would let anyone enumerate accounts -- while the audit entry records which case it was. Its readers are administrators who already know which accounts exist, and "somebody is trying to sign in to the account you disabled" is exactly what a log is for. Entries outlive their subjects. Deleting a user detaches their entries rather than cascading, since a log that erases what an account did the moment the account is removed is not evidence of anything. The username survives in the target column, so the trail stays readable. Retention is a database setting rather than an environment variable: it is a policy an administrator revises, not a deployment parameter, and changing it should not need a restart. The nightly sweep is only scheduled when auth is enabled, so existing instances do not grow a job that can never do anything. It runs half an hour after the backup so the two do not contend for SQLite's single write lock. Reading the log needs admin. It holds addresses, user agents and the list of accounts, so serving it at 'read' would hand an anonymous browser a map of the instance's users. Claude-Session: https://claude.ai/code/session_01J3YgMAnSapoXqS9iU8Xnmk