diff --git a/docs/backend/audit-log.md b/docs/backend/audit-log.md new file mode 100644 index 000000000..7ee4f9eac --- /dev/null +++ b/docs/backend/audit-log.md @@ -0,0 +1,45 @@ +--- +title: Audit Log +--- + +# Audit Log + +To help maintain accountability for users with elevated permissions the DEV +application has a special model that records certain actions. + +For example, when a user with the `trusted` role creates a negative reaction on +an article a record is created with certain information about that action. + +That record (which we call an `AuditLog`) looks something like this: + +```ruby +#"create", "category"=>"vomit", "controller"=>"reactions", "reactable_id"=>"16", "reactable_type"=>"Article"}, + roles: ["trusted"], + slug: "create", + updated_at: Thu, 07 May 2020 20:25:31 UTC +00:00, + user_id: 21> +``` + +You can see from this record that the user with an id of `21` created a vomit +reaction on the article with an id of `16`. If that's not obvious to you from +this object, don't worry, just take our word on it. + +You can find an example of `Audit::Logger` in action in +`app/controllers/internal/reactions_controller.rb`: + +```ruby + after_action only: [:update] do + Audit::Logger.log(:moderator, current_user, params.dup) + end +``` + +This code creates a record to indicate that a someone modified a reaction from +the internal controller. + +It's a good idea to add a similar `after_action` to any controller action that +might benefit from increased transparency. diff --git a/docs/backend/readme.md b/docs/backend/readme.md index 56ee48b4e..9e73c33df 100644 --- a/docs/backend/readme.md +++ b/docs/backend/readme.md @@ -1,6 +1,7 @@ --- title: Backend Guide items: + - audit-log.md - authentication.md - auth-twitter.md - auth-github.md