Operator feedback on the Security view's two log tables:
- Recent Config Changes groups only by a single "All (newest first)" dropdown — not a friendly way to navigate weeks of entries. A date-range picker (or preset ranges like the chart's 1Hr/24Hr/1Wk/1Mo/All row) would fit the house idiom better.
- Both tables (access log + config changes) need a way to jump to a specific time — following high-volume logs by scrolling doesn't scale, and incident review starts from "what happened around T".
- A search bar over both logs (user, action, path, status, outcome — plain substring is enough for a first cut).
Design sketch to evaluate when picking this up: reuse the chart's existing range-preset component for consistency; server-side ?from&to&q filtering on the existing /api/access and /api/audit endpoints (both read SQLite — LIKE + ts BETWEEN is cheap) rather than shipping the full log to the client; keep the newest-first default. Needs the usual tiering: builder logic at tier 1, endpoint contract in test_views/web tests.
Operator feedback on the Security view's two log tables:
Design sketch to evaluate when picking this up: reuse the chart's existing range-preset component for consistency; server-side
?from&to&qfiltering on the existing/api/accessand/api/auditendpoints (both read SQLite — LIKE + ts BETWEEN is cheap) rather than shipping the full log to the client; keep the newest-first default. Needs the usual tiering: builder logic at tier 1, endpoint contract in test_views/web tests.