golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: todo - audit-log admin action runs (18.1 AR-18.1-03)

Browse Source
This commit is contained in:
Jakub Zych
2026-10-16 20:17:21 +02:00
parent 5f1245f1e4
commit 6878be4e6a
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.planning/todos/pending/admin-action-audit-log.md Normal file
View File

@@ -0,0 +1,11 @@
---
title: Audit-log admin action runs with the admin id (toolbar actions)
date: 2026-10-16
priority: low
area: cabana / admin
g15office: xkujbsv4
---
cabana logs bulk action runs with `admin_id` (`modules/cabana/actions.go:166`), but a toolbar action such as pgsub's `sync_all_to_stripe` only logs failures (`runAction`, `actions.go:277-315`). A successful run leaves no record of which administrator triggered it; pgsub's per-plan "plan synced" line has no admin id.
Found by the Phase 18.1 security audit (T-18.1-22, accepted as AR-18.1-03 in `.planning/phases/18.1-payment-gateway-subscriptions/18.1-SECURITY.md`). Options the user named: a separate audit-log plugin, or extending cabana so every action run (toolbar, bulk, record) is logged or emitted as an event with the admin id, action name and controller.