mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-02 15:09:26 +00:00
Anso
1799030060
* feat: audit logging, secrets at rest, and legacy cleanup - Add Team Pro audit log: records all mutating API actions with user attribution, searchable timeline UI with filtering and pagination - Add AES-256-GCM encryption at rest for node API tokens via CryptoService - Drop 9 legacy SSH/TLS columns from nodes table (dead since v0.7) - Remove orphaned MaintenanceModal.tsx (dead code, never imported) - Add requireTeamPro backend guard for team-tier features - Add audit log cleanup (90-day retention) to MonitorService - Add docs page and navigation entry for audit log feature * fix: remove unused AUTH_TAG_LENGTH constant from CryptoService
59 lines
2.3 KiB
Plaintext
59 lines
2.3 KiB
Plaintext
---
|
|
title: Audit Log
|
|
description: Track all mutating actions across your Sencho instance with a searchable audit trail for team accountability.
|
|
---
|
|
|
|
<Note>
|
|
The Audit Log requires a Sencho **Team Pro** license. Personal Pro and Community Edition do not include this feature.
|
|
</Note>
|
|
|
|
Sencho Team Pro records every mutating action (deploy, stop, delete, settings changes, user management) with full attribution. The audit log answers the question every team eventually asks: **"Who changed what, and when?"**
|
|
|
|
## What gets logged
|
|
|
|
Every `POST`, `PUT`, `DELETE`, and `PATCH` request to the Sencho API is automatically recorded with:
|
|
|
|
| Field | Description |
|
|
|-------|-------------|
|
|
| **Timestamp** | When the action occurred |
|
|
| **User** | The authenticated username that performed the action |
|
|
| **Method** | HTTP method (`POST`, `PUT`, `DELETE`, `PATCH`) |
|
|
| **Action** | Human-readable summary (e.g., "Deployed stack: nginx-proxy") |
|
|
| **Status** | HTTP response status code |
|
|
| **Node** | Which node the action targeted |
|
|
|
|
### Example actions tracked
|
|
|
|
- Stack lifecycle: deploy, stop, start, restart, pull, delete
|
|
- Stack creation and file edits
|
|
- Node management: add, update, delete
|
|
- User management: create, delete, role changes
|
|
- Settings changes
|
|
- System prune operations
|
|
- License activation/deactivation
|
|
- Webhook and notification agent configuration
|
|
- Fleet backup creation, restoration, and deletion
|
|
|
|
## Viewing the audit log
|
|
|
|
Navigate to the **Audit** tab in the sidebar (visible to Team Pro admins only).
|
|
|
|
<Frame>
|
|
<img src="/images/audit-log.png" alt="Audit Log view showing a timeline of actions" />
|
|
</Frame>
|
|
|
|
### Filtering
|
|
|
|
- **Username filter** — Search for actions by a specific user
|
|
- **Method filter** — Filter by HTTP method (POST, PUT, DELETE, PATCH)
|
|
|
|
Pagination is built in for navigating large audit histories.
|
|
|
|
## Data retention
|
|
|
|
Audit log entries are automatically cleaned up after **90 days**. This runs as part of Sencho's periodic maintenance cycle alongside metrics and notification cleanup.
|
|
|
|
## Security at rest
|
|
|
|
As of this release, sensitive database values (such as remote node API tokens) are encrypted at rest using AES-256-GCM. The encryption key is stored as a separate file outside the SQLite database, ensuring that database file exposure alone does not compromise secrets.
|