J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

Browse Source 
Audit writes stay best-effort — a LogAudit failure must never fail or abort
the request — but a failed write must no longer be silently discarded. Add
db.WriteAudit(auditor, actor, action, targetType, targetID, detail), which
logs a failed write with actor/action/target context (never the detail
string, which may be sensitive) and never propagates the error.

The Auditor interface is satisfied structurally by both *db.DB and the
service-layer Store, so api/admin/ws/service all reach the helper without an
import cycle. Converts all ~26 call sites from `_ = LogAudit(...)` (and the
two backup handlers' inline `if err` blocks) to db.WriteAudit. Pinned by
db/audit_test.go: failure logged and not propagated, success logs nothing,
detail never leaks.

Resolves the repo-wide LogAudit policy question flagged by the D8 note.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
J3vb
2026-07-20 10:48:05 +02:00
co-authored by Claude Fable 5
parent 5de92b9510
commit b60bc8d04b
14 changed files with 139 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Server/api/totp_handler.go
+3 -3
View File
@@ -131,7 +131,7 @@ func handleVerifyTOTP(database *db.DB, partialStore *auth.PartialAuthStore, limi
}
slog.Info("totp verified", "user_id", user.ID, "ip", challenge.IP)
_ = database.LogAudit(user.ID, "totp_verified", "user", user.ID,
db.WriteAudit(database, user.ID, "totp_verified", "user", user.ID,
"two-factor verification completed from "+challenge.IP)
writeJSON(w, http.StatusOK, authSuccessResponse{
@@ -296,7 +296,7 @@ func handleConfirmTOTP(database *db.DB, pendingStore *auth.PendingTOTPStore, use
}
slog.Info("totp enabled", "user_id", user.ID)
_ = database.LogAudit(user.ID, "totp_enabled", "user", user.ID,
db.WriteAudit(database, user.ID, "totp_enabled", "user", user.ID,
"two-factor authentication enrolled")
w.WriteHeader(http.StatusNoContent)
@@ -379,7 +379,7 @@ func handleDisableTOTP(database *db.DB, pendingStore *auth.PendingTOTPStore, lim
}
slog.Info("totp disabled", "user_id", user.ID)
_ = database.LogAudit(user.ID, "totp_disabled", "user", user.ID,
db.WriteAudit(database, user.ID, "totp_disabled", "user", user.ID,
"two-factor authentication disabled")
w.WriteHeader(http.StatusNoContent)