Skip to content

feat(security): the audit log page in the Security hub - #2520

Merged
Makisuo merged 27 commits into
mainfrom
audit-trail/page
Nov 13, 2026
Merged

feat(security): the audit log page in the Security hub#2520
Makisuo merged 27 commits into
mainfrom
audit-trail/page

Merge branch 'audit-trail/table' into audit-trail/page

73fd519
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Nov 13, 2026 in 4m 46s

Confidence 10/10 · No issues found

🟢 Confidence 10/10 · safe to merge. No defects found; the paging and access state machines are pinned by 22 scene tests, and the kit extractions leave the existing pages rendering identically.
no findings · tests covered · risk medium · 1/1 new units observable

Adds the admin-only /security/audit-log page: events grouped by day, filters in the URL, per-event detail and cursor paging, with kit pieces extracted from the Settings audit log. Safe to merge. The listed McpQueryError issues come from the apps/ai MCP registry; this diff does not touch them.

  • /security/audit-log lists audit events by day, admin-only through audit_log:read.
  • Filters live in the URL; routeChanged re-reads the first page from them.
  • tableGroupRow, dayEyebrow, refusedBadge, jsonBlock, auditEntryHref move into shared kits.
  • nativeSelect accepts a controlled value so a filter change keeps focus.

Production impact

Open errors in the changed files (2)
Issue Service Occurrences File
@maple/mcp/errors/McpQueryError (7 issues) maple-ai 33 apps/web/src/page/registry.ts
@maple/mcp/errors/McpQueryError (3 issues) maple-chat 15 apps/web/src/page/registry.ts

After this merges, Maple checks whether they stop.

Production traffic of the changed files (last 7 days)
File Calls/day Busiest operations
apps/web/src/page/security/audit-log/view.ts 3.0k maple 3.0k/day, 2.1% err
apps/web/src/page/security/audit-log/command.ts 19 SecurityApiAuditLogFirstPage 19/day, 0.0% err
What was checked
  • Stale next-page answers are dropped on key, generation or cursor mismatch (audit-log/update.ts:147).
  • A session read that fails falls through to the API's refusal (model.ts:50), so admins are never locked out.
  • OUTCOME_ICONS.denied is CircleXmarkIcon, so refusedBadge renders the Settings badge unchanged.
Observability coverage: 1 of 1 changes observable
Change Kind Observable Evidence
Audit log first/next page reads (auditTrail.list) outbound HTTP from the dashboard yes Runs through MapleInternalApiClient; production shows maple-web SecurityApiAuditLogFirstPage spans at ~19 calls/day.

73fd519 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.

View more details on Maple Review Bot