Repository navigation
Read-only accounts and an activity log - #101
Merged
Merged
Conversation
- Accounts are admin (the default, existing ones too) or viewer: viewers see everything and change nothing, except watching live logs. The server refuses their writes (API tokens act with their account's role); the dashboard hides the controls. CLI: create-user --role, set-role; list-users shows roles. - Every write through the UI API is logged once answered (who, through a token or not, what, the HTTP status), by a plain ASGI middleware that leaves streams alone. The main endpoints describe what they did in words; command arguments and configuration values stay out. Kept 90 days, shown under Activity in the dashboard. Fixes #100
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #100
Roles
users.role(migration 0022):admin(default, also for existing accounts) orviewer.require_userrefuses viewers' non-GET requests with 403, except/api/devices/{id}/logs/watch|stop. API tokens act with their account's role./api/auth/statusreturns the role; the dashboard hides every control that changes something for viewers and shows "read-only" next to the name.create-user --role viewer,set-role <user> <role>, roles inlist-users.Activity log
audit_events(same migration), written byAuditMiddleware: a plain ASGI middleware (SSE and long polls pass straight through) recording each UI-API write once answered: user, via token or not, method, path, HTTP status, and a readable text.describe()what they did: deployments (to which devices or tags), uploads, deletions, commands (name only, never arguments), configuration (keys only, never values), tags/renames/channels, access changes, staged rollouts and their actions. Others fall back to the endpoint name and ids.GET /api/audit; an Activity dialog in the header. Pruned after 90 days.Tests: viewer refused on writes but allowed to read and watch logs,
set-role, readable log entries with no secret in them. Checked in Chromium as admin and viewer.🤖 Generated with Claude Code