1c566e0ec4
* First draft - all the big changes * Changing some more references to 'internal' * Relocate internal request tests to admin * Relocate internal system tests to admin * Fix trailing space * Test fix * Move queries from internal to admin * Docs updates * Rename internal stimuls controllers to admin (plus docs) * Rename admin layout * Fix routing after rebase * Fixes for latest added admin interfaces * Serviceworker ignore paths
65 lines
1.9 KiB
Markdown
65 lines
1.9 KiB
Markdown
---
|
|
title: Audit Log
|
|
---
|
|
|
|
# Audit Log
|
|
|
|
To help maintain accountability for users with elevated permissions the Forem
|
|
application has a special model that records certain actions.
|
|
|
|
For example, when a user with the `trusted` role creates a negative reaction on
|
|
an article a record is created with certain information about that action.
|
|
|
|
That record (which we call an `AuditLog`) looks something like this:
|
|
|
|
```ruby
|
|
#<AuditLog:0x00005629f019a490
|
|
id: 1,
|
|
category: "moderator.audit.log",
|
|
created_at: Thu, 07 May 2020 20:25:31 UTC +00:00,
|
|
data:
|
|
{"action"=>"create", "category"=>"vomit", "controller"=>"reactions", "reactable_id"=>"16", "reactable_type"=>"Article"},
|
|
roles: ["trusted"],
|
|
slug: "create",
|
|
updated_at: Thu, 07 May 2020 20:25:31 UTC +00:00,
|
|
user_id: 21>
|
|
```
|
|
|
|
You can see from this record that the user with an id of `21` created a vomit
|
|
reaction on the article with an id of `16`. If that's not obvious to you from
|
|
this object, don't worry, just take our word on it.
|
|
|
|
You can find an example of `Audit::Logger` in action in
|
|
`app/controllers/admin/reactions_controller.rb`:
|
|
|
|
```ruby
|
|
after_action only: [:update] do
|
|
Audit::Logger.log(:moderator, current_user, params.dup)
|
|
end
|
|
```
|
|
|
|
This code creates a record to indicate that a someone modified a reaction from
|
|
the admin controller.
|
|
|
|
It's a good idea to add a similar `after_action` to any controller action that
|
|
might benefit from increased transparency.
|
|
|
|
Additionally, the `AuditLog` is used to track important actions performed on a
|
|
user's account, e.g. adding or removing a credit card:
|
|
|
|
```ruby
|
|
#<AuditLog:0x00000001193ce348> {
|
|
category: "user.credit_card.edit",
|
|
created_at: Tue, 21 Jul 2020 06:35:13 +03 +03:00,
|
|
data: {
|
|
"action" => "create",
|
|
"controller" => "stripe_active_cards",
|
|
"user_action" => "add"
|
|
},
|
|
id: 4,
|
|
roles: [],
|
|
slug: "credit_card_add",
|
|
updated_at: Tue, 21 Jul 2020 06:35:13 +03 +03:00,
|
|
user_id: 53
|
|
}
|
|
```
|