ced4568
37230d4ef1
New audit_events table, distinct from the Provisioner's environment_events (Lab-lifecycle only). recordAudit() is called from the auth/RBAC/admin layers added in this phase — login success/failure, logout, password change, instructor CRUD, role changes, session revocation, cohort/roster changes, curriculum assignment, Prepare/Destroy Labs, and every 403 authorization denial (recorded centrally by the RBAC middleware, not per-route). Never records plaintext passwords, raw session tokens, Provisioner secrets, or raw routing tokens.
21 lines
1.0 KiB
JavaScript
21 lines
1.0 KiB
JavaScript
// Platform-level security/admin audit log — distinct from the Provisioner's environment_events
|
|
// (Lab lifecycle only). Never pass plaintext passwords, raw session tokens, Provisioner
|
|
// secrets, or raw routing tokens into `metadata` — callers are responsible for that, this
|
|
// module doesn't scrub input.
|
|
|
|
async function recordAudit(pool, { actorType, actorId, action, resourceType, resourceId, result, sourceIp, metadata }) {
|
|
try {
|
|
await pool.query(
|
|
`INSERT INTO audit_events (actor_type, actor_id, action, resource_type, resource_id, result, source_ip, metadata)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
|
|
[actorType, actorId ? String(actorId) : null, action, resourceType || null, resourceId ? String(resourceId) : null,
|
|
result, sourceIp || null, metadata ? JSON.stringify(metadata) : null]
|
|
);
|
|
} catch (e) {
|
|
// Audit logging must never take down the request it's describing.
|
|
console.error('[audit] failed to record event:', action, e.message);
|
|
}
|
|
}
|
|
|
|
module.exports = { recordAudit };
|