diff --git a/alembic/versions/0039_audit_events.py b/alembic/versions/0039_audit_events.py new file mode 100644 index 0000000..9737b79 --- /dev/null +++ b/alembic/versions/0039_audit_events.py @@ -0,0 +1,41 @@ +"""audit_events: the audit log + +Revision ID: 0039 +Revises: 0038 +Create Date: 2026-10-08 + +Credential events were only written to the app log, which is not queryable and is +gone at the container's log rotation (#2939 §5). This keeps them in the database for +`audit_retention_days`, for admins to read in Settings → Activity. + +## Downgrade + +Drops the table and every event in it. +""" +import sqlalchemy as sa +from alembic import op +from sqlalchemy.dialects.postgresql import UUID + +revision = "0039" +down_revision = "0038" +branch_labels = None +depends_on = None + + +def upgrade() -> None: + op.create_table( + "audit_events", + sa.Column("id", UUID(as_uuid=True), primary_key=True), + sa.Column("at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()), + sa.Column("event", sa.Text(), nullable=False), + sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True), + sa.Column("email", sa.Text(), nullable=True), + sa.Column("address", sa.Text(), nullable=True), + sa.Column("detail", sa.Text(), nullable=True), + ) + op.create_index("ix_audit_events_at", "audit_events", ["at"]) + + +def downgrade() -> None: + op.drop_index("ix_audit_events_at", table_name="audit_events") + op.drop_table("audit_events") diff --git a/docs/public-hosting.md b/docs/public-hosting.md index 3161c0c..f5b6716 100644 --- a/docs/public-hosting.md +++ b/docs/public-hosting.md @@ -4,7 +4,7 @@ Inkwell is built to run on a LAN and works fine there with no ceremony. Exposing it changes the threat model: anyone can now reach the login form, and any account is one guessed password away from someone's whole note history. -This is what the app does about that on its own, and the four things it cannot do for +This is what the app does about that on its own, and the three things it cannot do for you. ## Do these five things first @@ -154,6 +154,24 @@ page shows how much an account uses. `max_attachment_mb` still caps any single file. +## Activity + +**Settings → Activity** lists what has happened to accounts, newest first, with the +address each came from: + +- sign-ins and failed sign-ins; +- accounts created and sign-ups refused; +- password changes, resets and reset links; +- devices linked and unlinked; +- invites made and revoked. + +Events are kept for `audit_retention_days` (Settings → Security, 90 by default; 0 +keeps them forever). Admins only. + +A throttled attempt (429) is not listed, so that a flood of them costs no database +writes. Throttle trips are in the app log, with every event above: +`docker compose logs app`. + ## What it does not do Know these before you decide who gets an account. @@ -165,11 +183,6 @@ Know these before you decide who gets an account. - **An admin who forgets their own password**, with email off and no other admin, still needs a hand on the database. - **No second factor.** A password is the whole of it. -- **No audit TABLE.** Credential events — sign-ins, failures, throttle trips, new - accounts, device tokens issued — are written to the application log and readable - with `docker compose logs app`, which is enough to see whether anyone is knocking. - They are not queryable, not retained beyond the container's log rotation, and not - attributable after the fact. None of these are hard blockers for an instance whose accounts are you and people you know. They are the reason not to hand out open registration to strangers. diff --git a/frontend/src/components/ActivityList.vue b/frontend/src/components/ActivityList.vue new file mode 100644 index 0000000..15fb1f6 --- /dev/null +++ b/frontend/src/components/ActivityList.vue @@ -0,0 +1,128 @@ + + + diff --git a/frontend/src/views/SettingsView.vue b/frontend/src/views/SettingsView.vue index 875da8c..d6e8655 100644 --- a/frontend/src/views/SettingsView.vue +++ b/frontend/src/views/SettingsView.vue @@ -8,6 +8,7 @@ import BaseButton from "../components/BaseButton.vue"; import PageHeader from "../components/PageHeader.vue"; import InviteList from "../components/InviteList.vue"; import AccountList from "../components/AccountList.vue"; +import ActivityList from "../components/ActivityList.vue"; import GroupList from "../components/GroupList.vue"; import { errorMessage } from "../api/errors"; import { useUiStore } from "../stores/ui"; @@ -187,5 +188,6 @@ onMounted(load); + diff --git a/src/inkwell/accounts_api.py b/src/inkwell/accounts_api.py index 878423b..104c543 100644 --- a/src/inkwell/accounts_api.py +++ b/src/inkwell/accounts_api.py @@ -1,5 +1,5 @@ -"""Admin routes over the instance's accounts: list them, and make a password reset -link for one (#5173). +"""Admin routes over the instance's accounts: list them, make a password reset link +for one (#5173), and read what has happened to them (the audit log, #2939 §5). What a reset link is, and how it is used, is in `password_resets.py`. """ @@ -8,11 +8,12 @@ from __future__ import annotations import logging import uuid -from quart import Blueprint, g, jsonify +from quart import Blueprint, g, jsonify, request from sqlalchemy import select +from . import audit from .auth import require_admin -from .common import iso +from .common import iso, parse_dt from .db import session_scope from .models.user import User from .password_resets import issue @@ -20,7 +21,7 @@ from .proxy import client_address bp = Blueprint("accounts", __name__, url_prefix="/api/accounts") -# Credential events go to the app log, as in `auth` (there is no audit table yet). +# Credential events go to the app log and the audit log, as in `auth`. logger = logging.getLogger(__name__) @@ -56,6 +57,18 @@ async def create_reset_link(account_id: str): token, expires_at = await issue(db, uid, g.user_id) await db.commit() email = user.email + admin = await db.get(User, g.user_id) logger.info("password reset link made for=%s by=%s from=%s", email, g.user_id, client_address()) + await audit.record(audit.RESET_LINK_MADE, user_id=uid, email=email, detail=f"by {admin.email}") # The token goes back exactly once; the client builds the link from it, as for invites. return jsonify({"token": token, "expires_at": iso(expires_at)}), 201 + + +@bp.get("/activity") +@require_admin +async def activity(): + """The audit log, newest first, one page at a time: `?before=` pages back.""" + before = parse_dt(request.args.get("before")) + async with session_scope() as db: + events = await audit.recent(db, before) + return jsonify({"events": events, "more": len(events) == audit.PAGE}) diff --git a/src/inkwell/app.py b/src/inkwell/app.py index 3e3fadf..c85b37b 100644 --- a/src/inkwell/app.py +++ b/src/inkwell/app.py @@ -32,7 +32,7 @@ from .sync import bp as sync_bp, protocol_advertisement # Without this, `logger.info` from this package goes nowhere: hypercorn configures its # own access/error loggers and leaves the root logger at WARNING, so the credential # events in auth.py would be invisible in `docker compose logs` — which is exactly -# where they are meant to be read until an audit table exists (task 2939). +# where they are read live. (Settings → Activity keeps most of them, `audit.py`.) # # `force=False` (the default) so a host that has already configured logging keeps its # own setup; LOG_LEVEL lets an operator turn it up without a code change. diff --git a/src/inkwell/audit.py b/src/inkwell/audit.py new file mode 100644 index 0000000..fabd816 --- /dev/null +++ b/src/inkwell/audit.py @@ -0,0 +1,107 @@ +"""The audit log: what happened to accounts, kept where an admin can read it (#2939 §5). + +Sign-ins, failed sign-ins, password changes and resets, devices linked and +unlinked, invites made and revoked. Each is still written to the app log as it +happens; this keeps a copy in `audit_events` for `audit_retention_days`, which the +app log can't promise past the container's log rotation. + +What is NOT recorded here: a throttled attempt (429). That stays in the app log +only. A throttle trip is the answer to a flood, and a row per refused request +would make each one of the flood cost a database write. + +`record` opens its own session and commits on its own, so an event outlives the +caller's transaction. A refused registration rolls back, but its refusal is still +recorded. A failure to record is logged and swallowed: the audit log is never the +reason a sign-in fails. +""" +from __future__ import annotations + +import logging +import uuid +from datetime import datetime, timedelta, timezone + +from sqlalchemy import delete, select + +from .common import iso +from .db import session_scope +from .models.audit_event import AuditEvent +from .proxy import client_address +from .settings import get_setting + +logger = logging.getLogger(__name__) + +# The events, by name. The web Activity list words each one; a new event needs a +# line there too (`frontend/src/components/ActivityList.vue`). +SIGN_IN = "sign_in" +SIGN_IN_FAILED = "sign_in_failed" +REGISTERED = "registered" +REGISTRATION_REFUSED = "registration_refused" +RESET_REQUESTED = "reset_requested" +RESET_LINK_MADE = "reset_link_made" +PASSWORD_RESET = "password_reset" +RESET_REFUSED = "reset_refused" +PASSWORD_CHANGED = "password_changed" +PASSWORD_CHANGE_REFUSED = "password_change_refused" +SIGNED_OUT_ELSEWHERE = "signed_out_elsewhere" +DEVICE_LINKED = "device_linked" +DEVICE_UNLINKED = "device_unlinked" +INVITE_CREATED = "invite_created" +INVITE_REVOKED = "invite_revoked" + +# One page of the Activity list. Older events are reached with `before`. +PAGE = 100 + + +async def record( + event: str, + *, + user_id: uuid.UUID | None = None, + email: str | None = None, + detail: str | None = None, +) -> None: + """Keep one event. Call it from inside a request: the address is read from it.""" + try: + async with session_scope() as db: + db.add( + AuditEvent( + event=event, + user_id=user_id, + email=email or None, + address=client_address(), + detail=detail, + ) + ) + await db.commit() + except Exception: + logger.exception("audit event %s was not recorded", event) + + +def _serialize(e: AuditEvent) -> dict: + return { + "id": str(e.id), + "at": iso(e.at), + "event": e.event, + "email": e.email, + "address": e.address, + "detail": e.detail, + } + + +async def recent(db, before: datetime | None = None) -> list[dict]: + """The newest page of events, or the page older than `before`.""" + query = select(AuditEvent).order_by(AuditEvent.at.desc(), AuditEvent.id.desc()).limit(PAGE) + if before is not None: + query = query.where(AuditEvent.at < before) + return [_serialize(e) for e in (await db.scalars(query)).all()] + + +async def sweep_once(*, now: datetime | None = None) -> int: + """Delete events older than `audit_retention_days`; 0 keeps them forever.""" + async with session_scope() as db: + days = int(await get_setting(db, "audit_retention_days")) + if days <= 0: + return 0 + cutoff = (now or datetime.now(timezone.utc)) - timedelta(days=days) + deleted = (await db.execute(delete(AuditEvent).where(AuditEvent.at < cutoff))).rowcount + await db.commit() + return deleted diff --git a/src/inkwell/auth.py b/src/inkwell/auth.py index dcff987..c17d214 100644 --- a/src/inkwell/auth.py +++ b/src/inkwell/auth.py @@ -9,6 +9,7 @@ from datetime import datetime, timezone from quart import Blueprint, current_app, g, jsonify, request, session from sqlalchemy import delete, func, select +from . import audit from .common import iso from .db import session_scope from .invites import INVALID as INVALID_INVITE, record_redeemer, redeem @@ -30,10 +31,9 @@ from .storage import storage_limit, storage_used bp = Blueprint("auth", __name__, url_prefix="/api/auth") -# Every credential event goes to the app log — there is no audit TABLE yet (see task -# 2939), and until there is, `docker compose logs` is the only way to know whether -# anyone is knocking. That matters most in exactly the window this was written for: a -# freshly-exposed instance. +# Every credential event goes to the app log, which is the live view of whether +# anyone is knocking: `docker compose logs`. Most also go to the audit log +# (`audit.py`), which keeps them for admins to read in Settings → Activity. # # The attempted email is included deliberately. It is the operator's own server, and # "somebody failed a login" without saying against WHICH account tells you nothing you @@ -246,6 +246,7 @@ async def register(): is_first = user_count == 0 if is_first and time.monotonic() - current_app.config["STARTED_AT"] > SETUP_WINDOW_S: logger.warning("registration refused (setup window closed) email=%s from=%s", email, client_address()) + await audit.record(audit.REGISTRATION_REFUSED, email=email, detail="setup window closed") return json_error(SETUP_CLOSED, 403) # The first account bootstraps the admin and is allowed, inside the setup # window above, even when registration is otherwise closed. After that, an invite lets one person in @@ -257,9 +258,11 @@ async def register(): invite_id = await redeem(db, invite, email) if invite_id is None: logger.warning("registration refused (bad invite) email=%s from=%s", email, client_address()) + await audit.record(audit.REGISTRATION_REFUSED, email=email, detail="invite didn't hold") return json_error(INVALID_INVITE, 403) elif not is_first and not await get_setting(db, "allow_registration"): logger.warning("registration refused (closed) email=%s from=%s", email, client_address()) + await audit.record(audit.REGISTRATION_REFUSED, email=email, detail="registration closed") return json_error("registration is closed", 403) # Returning without a commit rolls back the redemption above with it, so a # taken email leaves the invite usable. @@ -296,6 +299,8 @@ async def register(): "account created email=%s admin=%s invite=%s from=%s", email, is_first, invite_id, client_address(), ) + detail = "first account, admin" if is_first else ("by invite" if invite_id else None) + await audit.record(audit.REGISTERED, user_id=user.id, email=email, detail=detail) return jsonify(_serialize_user(user)), 201 @@ -318,6 +323,9 @@ async def _check_credentials(db, email: str, password: str, route: str) -> User return user _sign_in_failed(email) logger.warning("%s failed (%s) email=%s from=%s", route, reason, email, client_address()) + await audit.record( + audit.SIGN_IN_FAILED, user_id=user.id if user else None, email=email, detail=f"{route}: {reason}" + ) return None @@ -341,6 +349,7 @@ async def login(): return _bad_credentials() _sign_in(user) logger.info("sign-in ok email=%s from=%s", email, client_address()) + await audit.record(audit.SIGN_IN, user_id=user.id, email=email) return jsonify(_serialize_user(user)) @@ -406,8 +415,10 @@ async def forgot_password(): reset_mail_by_account.record(email) send_later(mail_reset_link(email)) logger.info("password reset requested for=%s from=%s", email, client_address()) + await audit.record(audit.RESET_REQUESTED, email=email, detail="emailed") else: logger.warning("password reset email capped for=%s from=%s", email, client_address()) + await audit.record(audit.RESET_REQUESTED, email=email, detail="not emailed: over the cap") return jsonify({"ok": True, "message": FORGOT_SENT}) @@ -436,6 +447,7 @@ async def reset_password(): if user_id is None: _sign_in_failed("") logger.warning("password reset refused (bad link) from=%s", client_address()) + await audit.record(audit.RESET_REFUSED, detail="link didn't hold") return json_error(INVALID_RESET, 403) user = await db.get(User, user_id) user.password_hash = hash_password(password) @@ -444,6 +456,7 @@ async def reset_password(): logger.info( "password reset email=%s devices_unlinked=%s from=%s", user.email, unlinked, client_address() ) + await audit.record(audit.PASSWORD_RESET, user_id=user.id, email=user.email, detail=_unlinked(unlinked)) return jsonify(_serialize_user(user)) @@ -465,6 +478,10 @@ async def _sign_out_elsewhere(db, user: User, keep_token: str | None) -> int: return unlinked +def _unlinked(count: int) -> str: + return f"{count} device{'' if count == 1 else 's'} unlinked" + + def _stay_signed_in(user: User) -> None: """Keep the browser making this request signed in after `_sign_out_elsewhere`. A device has no session to keep, and isn't given one.""" @@ -501,11 +518,13 @@ async def change_password(): if not user.password_hash or not verify_password(current, user.password_hash): _sign_in_failed(user.email) logger.warning("password change refused (wrong password) email=%s from=%s", user.email, client_address()) + await audit.record(audit.PASSWORD_CHANGE_REFUSED, user_id=user.id, email=user.email) return json_error("your current password isn't right", 403) user.password_hash = hash_password(password) unlinked = await _sign_out_elsewhere(db, user, keep_token=_bearer_token()) _stay_signed_in(user) logger.info("password changed email=%s devices_unlinked=%s from=%s", user.email, unlinked, client_address()) + await audit.record(audit.PASSWORD_CHANGED, user_id=user.id, email=user.email, detail=_unlinked(unlinked)) return jsonify({"ok": True, "devices_unlinked": unlinked}) @@ -522,12 +541,21 @@ async def sign_out_elsewhere(): unlinked = await _sign_out_elsewhere(db, user, keep_token=_bearer_token()) _stay_signed_in(user) logger.info("signed out elsewhere email=%s devices_unlinked=%s from=%s", user.email, unlinked, client_address()) + await audit.record( + audit.SIGNED_OUT_ELSEWHERE, user_id=user.id, email=user.email, detail=_unlinked(unlinked) + ) return jsonify({"ok": True, "devices_unlinked": unlinked}) # --- Device (bearer) tokens for native clients — M8 sync hub --- +async def _email_of(db) -> str | None: + """The signed-in account's address, for the audit log.""" + user = await db.get(User, g.user_id) + return user.email if user else None + + def _serialize_device(d: DeviceToken) -> dict: return { "id": str(d.id), @@ -578,6 +606,7 @@ async def device_login(): "device token issued email=%s device=%s from=%s", email, row.name, client_address() ) await db.commit() + await audit.record(audit.DEVICE_LINKED, user_id=user.id, email=email, detail=row.name) return jsonify({"token": token, "device": _serialize_device(row), "user": _serialize_user(user)}), 201 @@ -589,6 +618,7 @@ async def create_device(): async with session_scope() as db: row, token = await _issue_device_token(db, g.user_id, data.get("name") or "") await db.commit() + await audit.record(audit.DEVICE_LINKED, user_id=g.user_id, email=await _email_of(db), detail=row.name) return jsonify({"token": token, "device": _serialize_device(row)}), 201 @@ -638,6 +668,7 @@ async def revoke_own_device(): return not_found() await db.delete(row) await db.commit() + await audit.record(audit.DEVICE_UNLINKED, user_id=g.user_id, email=await _email_of(db), detail=row.name) return jsonify({"ok": True}) @@ -655,4 +686,5 @@ async def revoke_device(device_id: str): return not_found() await db.delete(row) await db.commit() + await audit.record(audit.DEVICE_UNLINKED, user_id=g.user_id, email=await _email_of(db), detail=row.name) return jsonify({"ok": True}) diff --git a/src/inkwell/invites_api.py b/src/inkwell/invites_api.py index b9b5e2e..0420fea 100644 --- a/src/inkwell/invites_api.py +++ b/src/inkwell/invites_api.py @@ -12,6 +12,7 @@ from quart import Blueprint, g, jsonify, request from sqlalchemy import select from sqlalchemy.orm import aliased +from . import audit from .auth import require_admin from .db import session_scope from .invites import MAX_DAYS, lifetime_days, serialize @@ -22,7 +23,7 @@ from .security import generate_token, hash_token bp = Blueprint("invites", __name__, url_prefix="/api/invites") -# Credential events go to the app log, as in `auth` (there is no audit table yet). +# Credential events go to the app log and the audit log, as in `auth`. logger = logging.getLogger(__name__) @@ -49,10 +50,14 @@ async def create_invite(): db.add(invite) await db.commit() await db.refresh(invite) + admin = await db.get(User, g.user_id) logger.info( "invite created id=%s for=%s days=%s by=%s from=%s", invite.id, email or "anyone", days, g.user_id, client_address(), ) + await audit.record( + audit.INVITE_CREATED, user_id=g.user_id, email=admin.email, detail=f"for {email or 'anyone'}, {days} days" + ) # The token goes back exactly once. The client builds the link from it, since only # the browser knows the address people actually reach this server at. return jsonify({"invite": serialize(invite, now), "token": token}), 201 @@ -92,4 +97,8 @@ async def revoke_invite(invite_id: str): invite.revoked_at = now await db.commit() logger.info("invite revoked id=%s by=%s from=%s", iid, g.user_id, client_address()) + admin = await db.get(User, g.user_id) + await audit.record( + audit.INVITE_REVOKED, user_id=g.user_id, email=admin.email, detail=f"for {invite.email or 'anyone'}" + ) return jsonify(serialize(invite, now)) diff --git a/src/inkwell/models/all.py b/src/inkwell/models/all.py index 7aa4a18..50dad4a 100644 --- a/src/inkwell/models/all.py +++ b/src/inkwell/models/all.py @@ -4,6 +4,7 @@ Imported for side effects only (model registration on Base.metadata). """ from . import ( # noqa: F401 + audit_event, device_token, group, invite, diff --git a/src/inkwell/models/audit_event.py b/src/inkwell/models/audit_event.py new file mode 100644 index 0000000..da63af0 --- /dev/null +++ b/src/inkwell/models/audit_event.py @@ -0,0 +1,37 @@ +from __future__ import annotations + +import uuid +from datetime import datetime + +from sqlalchemy import DateTime, ForeignKey, Index, Text, func +from sqlalchemy.dialects.postgresql import UUID +from sqlalchemy.orm import Mapped, mapped_column + +from . import Base + + +class AuditEvent(Base): + """One thing that happened to an account: a sign-in, a failed one, a password + changed, a device linked (#2939 §5). Written by `audit.record`, read by admins in + Settings → Activity, and deleted after `audit_retention_days`. + """ + + __tablename__ = "audit_events" + __table_args__ = (Index("ix_audit_events_at", "at"),) + + id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4) + at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, server_default=func.now()) + # What happened, as a short fixed name (`audit.py` lists them). + event: Mapped[str] = mapped_column(Text(), nullable=False) + # The account it happened to, when there is one. SET NULL so the record outlives + # a deleted account; `email` keeps saying whose it was. + user_id: Mapped[uuid.UUID | None] = mapped_column( + UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True + ) + # The address the event names, as typed. For a failed sign-in against no account, + # it is the only thing that says who was being tried. + email: Mapped[str | None] = mapped_column(Text(), nullable=True) + # The client address under the trusted-proxy rule (`proxy.client_address`). + address: Mapped[str | None] = mapped_column(Text(), nullable=True) + # A few words more: why a sign-in failed, which device, who made an invite. + detail: Mapped[str | None] = mapped_column(Text(), nullable=True) diff --git a/src/inkwell/retention.py b/src/inkwell/retention.py index 2dcafc4..6dc5d11 100644 --- a/src/inkwell/retention.py +++ b/src/inkwell/retention.py @@ -27,6 +27,7 @@ from datetime import datetime, timedelta, timezone from sqlalchemy import delete as sa_delete from sqlalchemy import select +from . import audit from .config import Config from .db import session_scope from .models.label import NoteLabel @@ -168,4 +169,13 @@ async def run_sweeper() -> None: raise except Exception: logger.exception("trash retention sweep failed; will retry next pass") + # Its own try: a failed trash sweep must not keep the audit log growing. + try: + dropped = await audit.sweep_once() + if dropped: + logger.info("audit retention: deleted %d old event(s)", dropped) + except asyncio.CancelledError: + raise + except Exception: + logger.exception("audit retention sweep failed; will retry next pass") await asyncio.sleep(SWEEP_INTERVAL_SECONDS) diff --git a/src/inkwell/settings.py b/src/inkwell/settings.py index 899cbc9..8deddd2 100644 --- a/src/inkwell/settings.py +++ b/src/inkwell/settings.py @@ -187,6 +187,17 @@ REGISTRY: list[SettingDef] = [ minimum=1, maximum=1440, ), + SettingDef( + "audit_retention_days", + "int", + 90, + "Activity kept (days)", + "How long sign-ins, password changes and linked devices stay in Settings → " + "Activity. Set to 0 to keep them forever.", + "Security", + minimum=0, + maximum=3650, + ), SettingDef( "register_limit_per_address", "int", diff --git a/tests/test_integration.py b/tests/test_integration.py index 746ee85..85653b3 100644 --- a/tests/test_integration.py +++ b/tests/test_integration.py @@ -26,10 +26,11 @@ import pytest import pytest_asyncio from sqlalchemy import delete, func, select, text, update -from inkwell import mailer, ratelimit +from inkwell import audit, mailer, ratelimit from inkwell.app import create_app from inkwell.config import Config from inkwell.db import dispose_engine, session_scope +from inkwell.models.audit_event import AuditEvent from inkwell.models.invite import Invite from inkwell.models.password_reset import PasswordReset from inkwell.models.settings import Setting @@ -51,7 +52,7 @@ pytestmark = pytest.mark.integration # Every table the tests touch, child-first so FKs never block the truncate. # RESTART IDENTITY + CASCADE keeps this honest if a table gains children later. -_TABLES = "notes, note_revisions, note_labels, note_link_previews, labels, shares, share_revocations, note_user_state, group_members, groups, invites, password_resets, users" +_TABLES = "notes, note_revisions, note_labels, note_link_previews, labels, shares, share_revocations, note_user_state, group_members, groups, invites, password_resets, audit_events, users" @pytest_asyncio.fixture @@ -481,6 +482,7 @@ async def test_the_security_group_reaches_the_admin_ui(app_client, db): "register_window_minutes", "reset_emails_per_account", "client_downloads_per_hour", + "audit_retention_days", } # The UI renders a number input from these, and it cannot offer a safe range it # was never told about. @@ -1274,10 +1276,24 @@ async def test_an_admin_and_a_zero_setting_have_no_storage_limit(app_client, db) admin_use = await (await app_client.get("/api/auth/storage")).get_json() assert admin_use["limit_bytes"] is None + await _set_for_the_test("storage_quota_gb", 0) + try: + assert (await (await guest.get("/api/auth/storage")).get_json())["limit_bytes"] is None + finally: + await _back_to_default("storage_quota_gb") + + +async def _set_for_the_test(key: str, value) -> None: + """Settings outlive the per-test truncate: pair this with `_back_to_default`.""" async with session_scope() as fresh: - await set_settings(fresh, {"storage_quota_gb": 0}) + await set_settings(fresh, {key: value}) + await fresh.commit() + + +async def _back_to_default(key: str) -> None: + async with session_scope() as fresh: + await fresh.execute(delete(Setting).where(Setting.key == key)) await fresh.commit() - assert (await (await guest.get("/api/auth/storage")).get_json())["limit_bytes"] is None # --- Changing a password, and signing out everywhere else (#5105, practice 4) --- @@ -1375,6 +1391,74 @@ async def test_revoking_this_device_from_a_web_session_is_a_bad_request(app_clie assert resp.status_code == 400 +# --- The audit log (#2939 §5) -------------------------------------------------- + + +async def _activity(client) -> list[dict]: + resp = await client.get("/api/accounts/activity") + assert resp.status_code == 200, await resp.get_data(as_text=True) + return (await resp.get_json())["events"] + + +async def test_the_activity_list_keeps_what_happened_to_accounts(app_client, db): + other, bearer = await _elsewhere(app_client) + wrong = await create_app().test_client().post( + "/api/auth/login", json={"email": "owner@example.test", "password": "not-the-password"} + ) + assert wrong.status_code == 401 + await app_client.post( + "/api/auth/password", json={"current_password": _PASSWORD, "new_password": "a-brand-new-password"} + ) + + events = await _activity(app_client) + # Newest first. + assert [e["event"] for e in events] == [ + audit.PASSWORD_CHANGED, + audit.SIGN_IN_FAILED, + audit.DEVICE_LINKED, + audit.SIGN_IN, + audit.REGISTERED, + ] + by_name = {e["event"]: e for e in events} + assert by_name[audit.SIGN_IN_FAILED]["detail"] == "sign-in: bad password" + assert by_name[audit.DEVICE_LINKED]["detail"] == "Phone" + assert by_name[audit.PASSWORD_CHANGED]["detail"] == "1 device unlinked" + assert by_name[audit.REGISTERED]["detail"] == "first account, admin" + assert all(e["email"] == "owner@example.test" and e["address"] for e in events) + + +async def test_a_refused_registration_is_kept_though_its_transaction_rolled_back(app_client, db): + await _admin_with_invite(app_client) + refused = await _register("stranger@example.test", invite="not-a-real-invite") + assert refused.status_code == 403 + + refusals = [e for e in await _activity(app_client) if e["event"] == audit.REGISTRATION_REFUSED] + assert [(e["email"], e["detail"]) for e in refusals] == [("stranger@example.test", "invite didn't hold")] + + +async def test_only_an_admin_reads_the_activity_list(app_client, db): + guest, _ = await _admin_and_guest(app_client) + assert (await guest.get("/api/accounts/activity")).status_code == 403 + + +async def test_activity_older_than_its_retention_is_swept(app_client, db): + await app_client.post("/api/auth/register", json={"email": "owner@example.test", "password": _PASSWORD}) + now = datetime.now(timezone.utc) + async with session_scope() as fresh: + fresh.add(AuditEvent(event=audit.SIGN_IN, email="old@example.test", at=now - timedelta(days=91))) + await fresh.commit() + + await _set_for_the_test("audit_retention_days", 0) + try: + assert await audit.sweep_once() == 0, "0 keeps every event" + finally: + await _back_to_default("audit_retention_days") + + assert await audit.sweep_once() == 1 + emails = {e["email"] for e in await _activity(app_client)} + assert emails == {"owner@example.test"} + + # --- Sharing a note (#5174) --------------------------------------------------- # # Owner, a recipient, and a stranger who is on the instance but not shared with.