Xconfess/Xconfess
[Wave 6] Add paginated audit log query and redacted export endpoint
Aperta
#1670 aperta il 28 lug 2026
Backendhelp wantedobservabilitysecurity
Metriche repository
- Star
- (14 stelle)
- Metriche merge PR
- (Metriche PR in attesa)
Descrizione
Problem
Audit logs are written but there's no endpoint to query or export them for a compliance/incident review. Anyone needing an audit trail today has to query the database directly, with no redaction of sensitive fields.
Tasks
- Add an admin-guarded, paginated audit log query endpoint (filter by actor, action type, date range)
- Add a CSV/JSON export option for a filtered result set
- Redact sensitive fields (raw confession content, tokens, IPs beyond a configurable retention policy) in the exported output
- Add rate limiting to the export endpoint given it can be a heavier query
Acceptance Criteria
- Querying by date range + actor returns paginated results in under an agreed latency budget on seed data
- Exported output does not contain raw confession content or auth tokens
- Endpoint is inaccessible to non-admin roles (test covers this)
Labels
Backend, observability, security, help wanted, Stellar Wave