mirror of
https://github.com/suitenumerique/meet.git
synced 2026-10-14 09:01:21 +00:00
briquet
dddbd34ee6
Every ModelAdmin now emits an ECS audit event when an object is created, changed or deleted, and when a bulk action runs. Actions are templated as admin.<target>.<verb>, after the model name. A signed-in account without staff access reaching the admin is recorded as a denied admin.access. The wiring is a custom AdminSite installed through AdminConfig.default_site: it mixes the auditing into every admin class at registration, including the ones Django declares, so a new ModelAdmin is covered without doing anything. It hangs off log_addition, log_change, log_deletions and get_actions, which Django calls in every path, rather than off save_model. Deletions noted by log_deletions are emitted from delete_model and delete_queryset, once their outcome is known. Changed field names are always reported; their values only for the admin_values each model is registered with, and never for anything that looks like a secret. An account acted upon is reported as user.target: the target itself when it is a user, else the account its model registers as user_target, as the user an access grants a role to. The emitter derives it for every event, so user.provision names the user it creates as well.
30 lines
884 B
Python
30 lines
884 B
Python
"""Application configurations of the audit facility."""
|
|
|
|
from django.apps import AppConfig
|
|
from django.contrib.admin.apps import AdminConfig
|
|
from django.utils.module_loading import autodiscover_modules
|
|
|
|
from .signals import connect_auth_signals
|
|
|
|
|
|
class AuditConfig(AppConfig):
|
|
"""Audit Django's authentication signals and load the project's declarations."""
|
|
|
|
name = "core.audit"
|
|
label = "audit"
|
|
|
|
def ready(self):
|
|
"""Connect the login, failed login and logout receivers.
|
|
|
|
Then import the ``auditing`` module of every installed app, where the
|
|
project registers its models and authentication classes.
|
|
"""
|
|
connect_auth_signals()
|
|
autodiscover_modules("auditing")
|
|
|
|
|
|
class AuditedAdminConfig(AdminConfig):
|
|
"""Serve the admin from the site that audits every write."""
|
|
|
|
default_site = "core.audit.admin.AuditedAdminSite"
|