J3vbandClaude Fable 5 b60bc8d04b feat(audit): route every LogAudit call through a best-effort WriteAudit helper ...

Audit writes stay best-effort — a LogAudit failure must never fail or abort
the request — but a failed write must no longer be silently discarded. Add
db.WriteAudit(auditor, actor, action, targetType, targetID, detail), which
logs a failed write with actor/action/target context (never the detail
string, which may be sensitive) and never propagates the error.

The Auditor interface is satisfied structurally by both *db.DB and the
service-layer Store, so api/admin/ws/service all reach the helper without an
import cycle. Converts all ~26 call sites from `_ = LogAudit(...)` (and the
two backup handlers' inline `if err` blocks) to db.WriteAudit. Pinned by
db/audit_test.go: failure logged and not propagated, success logs nothing,
detail never leaks.

Resolves the repo-wide LogAudit policy question flagged by the D8 note.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-20 10:48:05 +02:00

..

static

fix(server): harden private-channel visibility propagation

2026-07-19 11:20:15 +00:00

admin_handler_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

admin.go

fix(admin): route admin-panel bans through ModerationService (W1-4)

2026-07-19 08:41:12 +02:00

api_edge_cases_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

api_test.go

refactor(server): remove the store abstraction layer (D3)

2026-07-19 16:33:58 +00:00

api.go

feat(server,admin): private channels via per-role permission overrides

2026-07-19 10:50:11 +00:00

handlers_backup_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

handlers_backup.go

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

handlers_channel_perms_test.go

chore(server): drop unnecessary int64 conversion in perms test

2026-07-19 11:03:59 +00:00

handlers_channel_perms.go

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

handlers_channels_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

handlers_channels.go

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

handlers_settings.go

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

handlers_users.go

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

helpers.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

logstream_test.go

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

logstream.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

middleware_and_spawn_test.go

feat(server,admin): private channels via per-role permission overrides

2026-07-19 10:50:11 +00:00

middleware_coverage_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

middleware.go

fix(phase-bc): address review findings — auth, SSRF, seq alignment

2026-04-06 09:29:29 +00:00

setup_handler_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

setup_handler.go

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

types.go

feat(server,admin): private channels via per-role permission overrides

2026-07-19 10:50:11 +00:00

update_handlers_test.go

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

update_handlers.go

refactor(updater): export FileSHA256 and reuse it for the update snapshot (W3-2)

2026-07-19 09:04:28 +02:00