arc53-machine 57b9034f2d feat(audit): record data-plane events, not just identity ones ...

Logins, role grants and provisioning were audited from the first release;
creating and deleting sources, agents, agent keys and conversations were not.
An operator reviewing the trail could see who signed in but not who deleted
the source they were asking about.

Adds docsgpt/api/audit.py: one helper that records an event inside the
caller's transaction, in a savepoint, swallowing failures -- an audit write
must never be able to fail the action it describes -- and tolerating the
absence of a Flask request so a Celery task can record too.

Events added: source.created (upload and wiki), source.deleted,
source.reingested, agent.created, agent.updated, agent.deleted,
agent.key_regenerated, conversation.deleted, conversation.deleted_all.
agent.updated records field names only, never values, which can carry prompts
and credentials.

The same module carries the event -> category map (identity / access / config
/ data) that the admin activity feed filters on.

2026-09-22 10:18:22 +01:00

..

__init__.py

refactor: rename the application package to docsgpt

2026-09-07 10:20:43 +01:00

routes.py

feat(audit): record data-plane events, not just identity ones

2026-09-22 10:18:22 +01:00