Audit trail

backend/tests/test_api.py

@@ -266,6 +266,26 @@ def test_admin_can_reset_another_users_otp():
     assert client.post('/api/admin/users/missing-user/otp/reset', headers=admin_headers).status_code == 404
 
 
+def test_security_audit_events_are_append_only_and_do_not_store_secrets():
+    admin_headers = login_headers()
+    response = client.put('/api/admin/themes', headers=admin_headers, json={'themes': ['plain-day']})
+    assert response.status_code == 200
+    with get_connection() as conn:
+        event = conn.execute(
+            '''SELECT actor_id, action, target_type, outcome, details
+               FROM security_audit_events
+               WHERE action = 'themes_updated'
+               ORDER BY created_at DESC, rowid DESC LIMIT 1''',
+        ).fetchone()
+        assert event is not None
+        assert event['actor_id'] == 'user-1'
+        assert event['target_type'] == 'application'
+        assert event['outcome'] == 'success'
+        assert 'password' not in event['details'].lower()
+        assert 'token' not in event['details'].lower()
+        assert 'secret' not in event['details'].lower()
+
+
 def test_new_user_must_verify_email_before_login():
     headers = login_headers()
     username = f'unverified-{uuid4().hex}'

backend/tests/test_database.py

@@ -10,7 +10,7 @@ def test_database_migrations_are_versioned_and_idempotent():
     connection = sqlite3.connect(':memory:')
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 16
+    assert get_schema_version(connection) == 17
     tables = {
         row[0]
         for row in connection.execute(
@@ -27,6 +27,6 @@ def test_database_migrations_are_versioned_and_idempotent():
     assert set(DEFAULT_TAGS) <= seeded_tags
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 16
+    assert get_schema_version(connection) == 17
 
     connection.close()