Add audit logs by varmar05 · Pull Request #647 · MerginMaps/server

varmar05 · 2026-07-01T06:55:45Z

Introduce a pluggable audit module with NullSink default and emit() API.

Wire SQLAlchemy listeners for user and project lifecycle events, explicit emits for auth and sync endpoints (login, password, access grants/revocations, version push, soft/hard delete, restore).

Add actor_context()/request_context() helpers, device_id capture, scope_id for workspace-scoped filtering, and target_type auto-derivation.

Introduce a pluggable audit module with NullSink default and emit() API. Wire SQLAlchemy listeners for user and project lifecycle events, explicit emits for auth and sync endpoints (login, password, access grants/revocations, version push, soft/hard delete, restore). Add actor_context()/request_context() helpers, device_id capture, scope_id for workspace-scoped filtering, and target_type auto-derivation. This is groundwork for adding more events and to be extended in EE with custom sinks, query API, and retention policy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coveralls · 2026-07-01T07:09:32Z

Coverage Report for CI Build 30524900752

Coverage increased (+0.3%) to 92.496%

Details

Coverage increased (+0.3%) from the base build.
Patch coverage: 13 uncovered changes across 4 files (550 of 563 lines covered, 97.69%).
2 coverage regressions across 1 file.

Uncovered Changes

File	Changed	Covered	%
server/mergin/audit/listeners.py	46	41	89.13%
server/mergin/utils.py	12	8	66.67%
server/mergin/auth/listeners.py	26	24	92.31%
server/mergin/tests/test_audit_events.py	266	264	99.25%
Total (25 files)	563	550	97.69%

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
server/mergin/sync/utils.py	2	85.4%

Coverage Stats


Relevant Lines:	10807
Covered Lines:	9996
Line Coverage:	92.5%
Coverage Strength:	0.92 hits per line

💛 - Coveralls

Implements structured audit event emission for all relevant user and project actions. Update AuditEvent dataclass with new target columns: project_id, workspace_id and user_id. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…events Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Also simplify test_get_projects_by_uuids to avoid the fake-workspace-id hack. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… events Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harminius

Some minor questions.

harminius · 2026-07-30T17:26:21Z

+        .with_entities(User.id, User.email)
+        .first()
+    )
+    return (found.email, found.id) if found else (None, None)


how about return ... else (login_str, None) to know at least something?

harminius · 2026-07-30T17:46:24Z

+            )
            return "", 200
        else:
            abort(403, "You do not have permissions")


we don't want to log this?
we do log login fail..

harminius · 2026-07-30T17:56:35Z

+
+    if old_active and not user.active:
+        emit(
+            AuthEventType.USER_DEACTIVATED,
+            **actor_context(),
+            user_id=user.id,
+            target_email=user.email,
+        )
+    elif not old_active and user.active:
+        emit(
+            AuthEventType.USER_RESTORED,
+            **actor_context(),
+            user_id=user.id,
+            target_email=user.email,
+        )
+


we don't log superadmin assignment?

harminius · 2026-07-30T17:59:26Z

    db.session.add(user)
    db.session.commit()
+
+    if old_active and not user.active:


should we re-querry the user?

harminius · 2026-07-30T18:02:43Z

+    emit(
+        AuthEventType.USER_MARKED_FOR_DELETION,
+        **actor_context(),
+        user_id=user.id,
+        target_email=user.email,
+    )


shall we emit after the action?

harminius · 2026-07-30T19:25:00Z

+            **actor_context(),
+            project_id=project.id,
+            workspace_id=project.workspace_id,
+            target_email=requester.email if requester else None,


we should get the actor email when they are authenticated, no?
(applies also for the following emits)

harminius · 2026-07-30T19:27:01Z

+            project_id=project.id,
+            workspace_id=project.workspace_id,
+            target_email=requester.email if requester else None,
+            role=permission,


the project name could be useful here

harminius · 2026-07-30T19:34:17Z

    project.delete()
+    db.session.info.pop("audit_skip_project_update", None)


it would be safer to put his in try: and finally: to avoid stale info message, but that's rather a theoretical risk

harminius · 2026-07-30T19:39:12Z

+        project_id=project.id,
+        workspace_id=project.workspace_id,
+        target_email=user.email if user else None,
+        role=removed_role.value,


again, the project name

harminius · 2026-07-30T19:42:38Z

+                project_id=p.id,
+                workspace_id=p.workspace_id,
+                project_name=f"{p.workspace.name}/{p.name}",
+            )


could we add info it was done by this celery task?

MarcelGeo · 2026-08-05T08:33:59Z

 *.crt
+
+# Local Claude Code skills
+.claude/commands/


Share it with us :) If usefull.

MarcelGeo · 2026-08-05T08:35:21Z


 import json
 import shutil
+from typing import List


Do we need this typing If python is bumped?

MarcelGeo · 2026-08-05T09:28:03Z

+        "disk_usage",
+        "latest_version",
+        "updated",
+        "storage_params",


I think when storage params are updated, this is like critical bug.

MarcelGeo · 2026-08-05T09:29:57Z

+# storage_params, locked_until), or covered by dedicated events with their own emit
+# (removed_at/removed_by are suppressed via audit_skip_project_update instead).
+# frozenset prevents accidental mutation of module-level state.
+_SKIP = frozenset(


Do we have alternatives in other events to this columns?

rename this variable to something meaningful.

MarcelGeo · 2026-08-05T09:30:37Z

+        "updated",
+        "storage_params",
+        "tags",
+        "locked_until",


Yes, we are not locking projects using flask, but in future it should be critical to have it in audits

MarcelGeo · 2026-08-05T10:50:22Z

    )
    if not project.removed_at:
        abort(400, "Failed to remove: Project is still active")
+    emit(


Why is this not handled in project.delete() method after commit? I Think We have multiple cases like this - project deleted, user deleted ...

MarcelGeo · 2026-08-05T11:35:58Z


    user.reset_lockout()
    db.session.commit()
+    emit(


Not better to add to db event? Or we do not know how to check columns in db events?

MarcelGeo · 2026-08-05T11:37:52Z

+    return ctx
+
+
+def emit_safe(event_type, **kwargs):


Why not use emit_safe in controllers? We want to break endpoints if something is wrong with audit logs write?

varmar05 and others added 6 commits July 6, 2026 16:45

Add audit logging for auth and sync events

96491c7

Implements structured audit event emission for all relevant user and project actions. Update AuditEvent dataclass with new target columns: project_id, workspace_id and user_id. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add login_method to password login events and project transfer audit …

691faa5

…events Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Align AuditEvent fields with DB sink column names

cc70bba

Also simplify test_get_projects_by_uuids to avoid the fake-workspace-id hack. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add missing project.version.created emits

1d005d2

Merge branch 'develop' into audit_logs

d1c7c20

Add user.locked and user.unlocked audit events

1dc2d1c

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

varmar05 marked this pull request as ready for review July 30, 2026 07:25

varmar05 requested review from MarcelGeo and harminius and removed request for MarcelGeo July 30, 2026 07:25

Fix: Populate actor email on user.created and user.login.failed audit…

7721b35

… events Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

varmar05 changed the base branch from master to develop July 30, 2026 08:03

harminius approved these changes Jul 30, 2026

View reviewed changes

MarcelGeo requested changes Aug 5, 2026

View reviewed changes

		project.delete()
		db.session.info.pop("audit_skip_project_update", None)

Uh oh!

Conversation

varmar05 commented Jul 1, 2026

Uh oh!

coveralls commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 30524900752

Coverage increased (+0.3%) to 92.496%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

harminius left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coveralls commented Jul 1, 2026 •

edited

Loading

harminius left a comment •

edited

Loading