[P2] Add Audit Logging #12

New issue

Closed

opened 2025-12-05 13:49:33 +00:00 by blightbow · 1 comment

blightbow commented

2025-12-05 13:49:33 +00:00

Owner

Problem

API configuration changes not logged
No record of who changed what, when
Component/template CRUD untracked

Suggested Fix

Log all configuration changes with user, timestamp, old/new values.

Priority

P2 — Medium Priority

Source

Architecture Audit 2025-12-03, Critical Gaps Section 2: No Audit Logging

## Problem - API configuration changes not logged - No record of who changed what, when - Component/template CRUD untracked ## Suggested Fix Log all configuration changes with user, timestamp, old/new values. ## Priority **P2 — Medium Priority** ## Source Architecture Audit 2025-12-03, Critical Gaps Section 2: No Audit Logging

blightbow added the

labels

2025-12-05 13:49:33 +00:00

blightbow commented

2025-12-08 07:03:36 +00:00

Author

Owner

Implementation complete in commit 6b89e23f8.

Approach: Medium - AuditLoggingMixin + structured JSON logging (no DB model)

Changes:

Created AuditLoggingMixin in api/views/mixins/audit_logging.py
Intercepts dispatch() for POST/PATCH/PUT/DELETE requests
Logs structured JSON with [AI_AUDIT] prefix via Evennia logger
Sensitive field masking (API keys, tokens, passwords)
Value truncation for large payloads
Applied to AssistantViewSet, ComponentViewSet, TemplateViewSet

Log format example:

[AI_AUDIT] {
  "timestamp": "2025-01-01T12:00:00Z",
  "user": "admin",
  "method": "PATCH",
  "endpoint": "/api/ai-assistants/mybot/configuration/update/",
  "assistant_key": "mybot",
  "action": "configuration_update",
  "field": "llm_model",
  "new_value": "gpt-4",
  "status_code": 200,
  "success": true
}

Tests: 16 tests added in test_api_audit.py covering mixin functionality and integration.

Implementation complete in commit `6b89e23f8`. **Approach**: Medium - AuditLoggingMixin + structured JSON logging (no DB model) **Changes:** - Created `AuditLoggingMixin` in `api/views/mixins/audit_logging.py` - Intercepts `dispatch()` for POST/PATCH/PUT/DELETE requests - Logs structured JSON with `[AI_AUDIT]` prefix via Evennia logger - Sensitive field masking (API keys, tokens, passwords) - Value truncation for large payloads - Applied to `AssistantViewSet`, `ComponentViewSet`, `TemplateViewSet` **Log format example:** ```json [AI_AUDIT] { "timestamp": "2025-01-01T12:00:00Z", "user": "admin", "method": "PATCH", "endpoint": "/api/ai-assistants/mybot/configuration/update/", "assistant_key": "mybot", "action": "configuration_update", "field": "llm_model", "new_value": "gpt-4", "status_code": 200, "success": true } ``` **Tests**: 16 tests added in `test_api_audit.py` covering mixin functionality and integration.

blightbow closed this issue

2025-12-08 07:03:42 +00:00