952 B
title, date, priority, area, g15office
| title | date | priority | area | g15office |
|---|---|---|---|---|
| Audit-log admin action runs with the admin id (toolbar actions) | 2026-10-16 | low | cabana / admin | xkujbsv4 |
cabana logs bulk action runs with admin_id (modules/cabana/actions.go:166), but a toolbar action such as pgsub's sync_all_to_stripe only logs failures (runAction, actions.go:277-315). A successful run leaves no record of which administrator triggered it; pgsub's per-plan "plan synced" line has no admin id.
Found by the Phase 18.1 security audit (T-18.1-22, accepted as AR-18.1-03 in .planning/phases/18.1-payment-gateway-subscriptions/18.1-SECURITY.md). Options the user named: a separate audit-log plugin, or extending cabana so every action run (toolbar, bulk, record) is logged or emitted as an event with the admin id, action name and controller.
Closed 2026-10-28 by quick 261028-rqf (61d1043): successful toolbar and field action runs log admin_id, controller, action and kind.