v0.6.16: audit logging runtime admin toggle (#186) #204

Merged

Cordy merged 4 commits from ship-v0.6.16 into main

2026-08-12 21:25:39 +00:00

Cordy commented

2026-08-12 21:24:24 +00:00

Owner

Closes #186 — audit logging moves from a boot-time config flag to an admin Settings toggle, persisted in the state-backend (same pattern as peering-enable and the v0.6.15 quotas).

Mechanism: the audit Logger gains a live enabled() predicate that gates Append at its single chokepoint (the audit driver calls it on every op), so no call sites change. The logger is now always constructed and wrapped around the store (previously skipped when audit.enabled was false), so it can start logging the instant it's switched on — no restart. Wired via auditLog.SetEnabled(func() bool { return settingsStore.Get().AuditEnabled || cfg.Audit.Enabled }).

Config audit.enabled is a floor: a deployment can still mandate audit on (an admin can't switch below it); otherwise it's a pure admin toggle. Historical events stay queryable regardless.

UI: an "Enable access audit logging" checkbox in Settings; the audit-log viewer is always available (querying past events). go vet, go test ./..., node-check, dual-arch build green.

Closes #186 — audit logging moves from a boot-time config flag to an admin Settings toggle, persisted in the state-backend (same pattern as peering-enable and the v0.6.15 quotas). **Mechanism:** the audit `Logger` gains a live `enabled()` predicate that gates `Append` at its single chokepoint (the audit driver calls it on every op), so no call sites change. The logger is now **always constructed and wrapped** around the store (previously skipped when `audit.enabled` was false), so it can start logging the instant it's switched on — no restart. Wired via `auditLog.SetEnabled(func() bool { return settingsStore.Get().AuditEnabled || cfg.Audit.Enabled })`. **Config `audit.enabled` is a floor:** a deployment can still mandate audit on (an admin can't switch below it); otherwise it's a pure admin toggle. Historical events stay queryable regardless. **UI:** an "Enable access audit logging" checkbox in Settings; the audit-log viewer is always available (querying past events). `go vet`, `go test ./...`, node-check, dual-arch build green.

Cordy added 4 commits

2026-08-12 21:24:25 +00:00