mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Credential audit log viewer (stretch) #361

New Issue
Closed
opened 2026-02-07 17:12:44 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-07 17:12:44 +00:00
Owner
Copy Link

Phase 5c - Credential Audit Log Viewer (Stretch)

Problem

Credential access is audit-logged via ActivityService, but there is no UI to view these logs. Users and admins should be able to see who accessed what credentials and when.

Requirements

  1. Add credential audit log viewer in the settings UI
  2. Filter by: credential name, provider, action type, date range
  3. Show: timestamp, action (created/accessed/rotated/revoked), user, credential name
  4. Admin view: see all credential access across workspace
  5. User view: see access to own credentials only

Implementation Notes

  • Reuse existing ActivityLog model and ActivityModule
  • Filter by entityType = CREDENTIAL and relevant ActivityActions
  • API endpoint: GET /api/credentials/audit with query params for filtering
  • Follow existing activity log UI patterns if any exist
  • This is a stretch goal - implement if time permits

Files

  • apps/api/src/credentials/credentials.controller.ts (modify - add audit endpoint)
  • apps/api/src/credentials/credentials.service.ts (modify - add audit query method)
  • apps/web/src/app/(authenticated)/settings/credentials/audit/page.tsx (new)
  • apps/web/src/components/credentials/credential-audit-log.tsx (new)

Acceptance Criteria

  • Audit log page shows credential access history
  • Filterable by credential, action, date range
  • Respects RLS - users see only their own credential access
  • Admin sees workspace-wide credential access
  • Pagination for large audit logs

Dependencies

  • Depends on: Credential CRUD API with audit logging (Phase 3b)
  • Depends on: Frontend credential management (Phase 4)

Refs #346

## Phase 5c - Credential Audit Log Viewer (Stretch) ### Problem Credential access is audit-logged via ActivityService, but there is no UI to view these logs. Users and admins should be able to see who accessed what credentials and when. ### Requirements 1. Add credential audit log viewer in the settings UI 2. Filter by: credential name, provider, action type, date range 3. Show: timestamp, action (created/accessed/rotated/revoked), user, credential name 4. Admin view: see all credential access across workspace 5. User view: see access to own credentials only ### Implementation Notes - Reuse existing ActivityLog model and ActivityModule - Filter by entityType = CREDENTIAL and relevant ActivityActions - API endpoint: GET /api/credentials/audit with query params for filtering - Follow existing activity log UI patterns if any exist - This is a stretch goal - implement if time permits ### Files - apps/api/src/credentials/credentials.controller.ts (modify - add audit endpoint) - apps/api/src/credentials/credentials.service.ts (modify - add audit query method) - apps/web/src/app/(authenticated)/settings/credentials/audit/page.tsx (new) - apps/web/src/components/credentials/credential-audit-log.tsx (new) ### Acceptance Criteria - [ ] Audit log page shows credential access history - [ ] Filterable by credential, action, date range - [ ] Respects RLS - users see only their own credential access - [ ] Admin sees workspace-wide credential access - [ ] Pagination for large audit logs ### Dependencies - Depends on: Credential CRUD API with audit logging (Phase 3b) - Depends on: Frontend credential management (Phase 4) Refs #346
jason.woltje added this to the M9-CredentialSecurity (0.0.9) milestone 2026-02-07 17:12:44 +00:00
jason.woltje added the p3securityweb labels 2026-02-07 17:12:44 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label p3 security web
Milestone
No items
No Milestone M9-CredentialSecurity (0.0.9)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#361
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?