@andrian.yablonskyy/thub-coordinator 1.1.3 → 1.1.4

package/bin/thub-admin.js

@@ -37,8 +37,21 @@ const { loadConfig } = require('../src/config'),
   { roleLabel, normalizeRole } = require('../src/services/admin-users'),
   { PACKAGES, fetchLatestVersion, isNewer, isValidVersion, npmBin, formatDateTime, parseDateTime } = require('@andrian.yablonskyy/thub-common'),
   { spawnSync } = require('node:child_process'),
+  os = require('node:os'),
   { version: installedVersion } = require('../package.json');
 
+// Who the audit log names for a change made here: the OS user running it.
+function cliActor(){
+  let name = process.env.SUDO_USER || '';
+  try {
+    name ||= os.userInfo().username;
+  }
+  catch {
+    // no passwd entry (a container's random uid)
+  }
+  return name ? `thub-admin (${name})` : 'thub-admin';
+}
+
 function usage(){
   console.log(`Usage:
   thub-admin user add <username> --email <email> [--role user|maintainer|admin] [--password <p>] [--key]
@@ -174,7 +187,7 @@ function main(){
   if (cmd === 'user'){
     const { positional, flags } = parseFlags(rest),
       [username, arg] = positional,
-      by = 'thub-admin',
+      by = cliActor(),
       need = (u) => {
         const row = adminUsers.getByUsername(u || '');
         if (!row){
@@ -221,7 +234,7 @@ function main(){
         if (!arg){
           return usage(), process.exit(4);
         }
-        adminUsers.resetPassword({ username: target.username, password: arg });
+        adminUsers.resetPassword({ username: target.username, password: arg }, { by });
         console.log(`Password of "${target.username}" set`);
       }
       else if (sub === 'key'){
@@ -252,7 +265,7 @@ function main(){
     if (!username || !password){
       return usage(), process.exit(4);
     }
-    adminUsers.create({ username, password, role: flags.role || 'admin' });
+    adminUsers.create({ username, password, role: flags.role || 'admin' }, { by: cliActor() });
     console.log(`Created ${roleLabel(normalizeRole(flags.role || 'admin'))} user "${username}"`);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/src/server.js

@@ -247,7 +247,7 @@ function ensureBootstrapAdmin(services){
     return;
   }
   const username = process.env.THUB_BOOTSTRAP_ADMIN_USER || 'admin';
-  services.adminUsers.resetPassword({ username, password });
+  services.adminUsers.resetPassword({ username, password }, { by: 'system (THUB_BOOTSTRAP_ADMIN_PASSWORD)' });
   console.log(`Reset password for admin user "${username}" from THUB_BOOTSTRAP_ADMIN_PASSWORD`);
 }
 

package/src/services/admin-users.js

@@ -123,7 +123,10 @@ function parseListPrefs(json){
 // access key for the Agent for anyone. `events` (the audit log) is optional
 // so the profile/password functions can be used on their own (tests).
 function createAdminUsersService(db, { events } = {}){
-  const audit = (id, type, data) => events?.record('user', id, type, data);
+  // Every user event names who did it (`by`): a username, `thub-admin
+  // (<os user>)`, or `system` for what no person did (the bootstrap reset,
+  // internal callers that pass none).
+  const audit = (id, type, data) => events?.record('user', id, type, { ...data, by: data.by || 'system' });
 
   function getByUsername(username){
     return db.prepare('SELECT * FROM users WHERE username = ?').get(username);
@@ -228,13 +231,14 @@ function createAdminUsersService(db, { events } = {}){
   // silently promote anyone to admin), or creates one as admin if the
   // named account doesn't exist yet — the original first-run bootstrap
   // case, now handled by the same path.
-  function resetPassword({ username, password, role = 'admin' }){
+  function resetPassword({ username, password, role = 'admin' }, { by } = {}){
     const existing = getByUsername(username);
     if (existing){
       db.prepare('UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?').run(hashPassword(password), existing.id);
+      audit(existing.id, 'user.password_set', { by });
       return { id: existing.id, username, role: existing.role };
     }
-    return create({ username, password, role });
+    return create({ username, password, role }, { by });
   }
 
   // Users page: a new temporary password for someone who lost theirs.
@@ -266,7 +270,7 @@ function createAdminUsersService(db, { events } = {}){
       throw bad('Choose a password different from the current one');
     }
     db.prepare('UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?').run(await hashPasswordAsync(newPassword), id);
-    audit(id, 'user.password_changed', {});
+    audit(id, 'user.password_changed', { by: row.username });
   }
 
   // Async (thread pool); the same work whether or not the user exists, or

package/src/web/routes.js

@@ -1205,7 +1205,58 @@ function createWebRouter({ services, config }){
     // dashboard role.
     isAdmin = (actor) => actor.role === 'admin',
     managesUser = (actor, u) => Boolean(u) && (isAdmin(actor) || u.role === 'user' || u.id === actor.id),
-    userFiltersFor = (actor) => (isAdmin(actor) ? USER_ROLE_FILTERS : ['user', 'blocked']);
+    userFiltersFor = (actor) => (isAdmin(actor) ? USER_ROLE_FILTERS : ['user', 'blocked']),
+    // The audit log's Action column names changed fields like this.
+    FIELD_LABEL = { username: 'username', email: 'email', role: 'role', first_name: 'first name', last_name: 'last name' };
+
+  // The audit log's Action column: what was done, to whom. `nameOf` gives
+  // the account's current username (else the one its events recorded).
+  function describeUserEvent(e, nameOf){
+    const name = nameOf(e.entity_id),
+      whose = e.data.by === name ? 'their own' : `${name}'s`;
+    switch (e.type){
+      case 'user.created': return `Created ${name} (${roleLabel(e.data.role)})`;
+      case 'user.updated': {
+        const parts = [];
+        if (e.data.role?.from){
+          parts.push(`role ${roleLabel(e.data.role.from)} → ${roleLabel(e.data.role.to)}`);
+        }
+        const fields = (e.data.changed || []).filter((f) => f !== 'role').map((f) => FIELD_LABEL[f] || f);
+        if (fields.length){
+          parts.push(fields.join(', '));
+        }
+        return `Edited ${name}${parts.length ? `: ${parts.join('; ')}` : ''}`;
+      }
+      case 'user.blocked': return `Blocked ${name}`;
+      case 'user.unblocked': return `Unblocked ${name}`;
+      case 'user.deleted': return `Deleted ${name}`;
+      case 'user.password_reset': return `Issued a temporary password for ${name}`;
+      case 'user.password_set': return `Set ${whose} password`;
+      case 'user.password_changed': return `Changed ${whose} password`;
+      case 'user.key_created': return `Created ${whose} access key`;
+      case 'user.key_rotated': return `Replaced ${whose} access key`;
+      case 'user.key_revoked': return `Revoked ${whose} access key`;
+      default: return `${e.type.replace('user.', '').replace(/_/g, ' ')} ${name}`;
+    }
+  }
+
+  // Rows for the audit log: Timestamp, User (who did it — always shown;
+  // events from before it was recorded for everything say `system`, or the
+  // account itself for its own password change), Action.
+  function auditRows(events){
+    const names = new Map(services.adminUsers.list().map((u) => [u.id, u.username]));
+    for (const e of services.adminUsers.recentEvents(1000)){
+      if (!names.has(e.entity_id) && e.data.username){
+        names.set(e.entity_id, e.data.username);
+      }
+    }
+    const nameOf = (id) => names.get(id) || id;
+    return events.map((e) => ({
+      ts: e.ts,
+      by: e.data.by || (e.type === 'user.password_changed' ? nameOf(e.entity_id) : 'system'),
+      action: describeUserEvent(e, nameOf)
+    }));
+  }
 
   // A maintainer's Recent activity: about the users they see, and deleted
   // ones that were Agent-only users when created — nothing about admins or
@@ -1266,7 +1317,7 @@ function createWebRouter({ services, config }){
         admin: 'Everything'
       },
       roleTone: { user: 'secondary', maintainer: 'info', admin: 'primary' },
-      events: isAdmin(me) ? services.adminUsers.recentEvents(30) : visibleEvents(me, visibleIds),
+      audit: auditRows(isAdmin(me) ? services.adminUsers.recentEvents(30) : visibleEvents(me, visibleIds)),
       ...extra
     });
   }

package/test/users.test.js

@@ -384,3 +384,57 @@ test('maintainers manage Agent-only users, their own account and CI tokens — n
     assert.match(await r.text(), new RegExp(`<title>${job.id} `));
   }
 });
+
+test('audit log: Timestamp, User (who did it — always), Action — from the dashboard, the profile, the Agent and thub-admin', async (t) => {
+  const { base, services, file } = await start(t),
+    u = services.adminUsers;
+  u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' }, { by: 'root' });
+  const login = async (name, pw) => (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: name, password: pw }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    root = await login('root', 'pw'),
+    post = (cookie, p, body = {}) => fetch(`${base}${p}`, { method: 'POST', headers: { cookie }, body: new URLSearchParams(body), redirect: 'manual' });
+
+  // Dashboard (an admin), then the profile (the user themselves).
+  await post(root, '/admin/users', { username: 'dev', email: 'd@example.com', role: 'user', issueKey: '1' });
+  const dev = u.getByUsername('dev');
+  await post(root, '/admin/users', { username: 'ops', email: 'o@example.com', role: 'maintainer' });
+  const ops = u.getByUsername('ops');
+  await post(root, `/admin/users/${ops.id}`, { username: 'ops', email: 'ops@example.com', role: 'admin', firstName: 'Olga' });
+  const temp = u.adminResetPassword(ops.id, { by: 'root' }),
+    opsCookie = await login('ops', temp);
+  await post(opsCookie, '/profile/password', { currentPassword: temp, newPassword: 'Ops-own-1', confirmPassword: 'Ops-own-1' });
+
+  // The Agent rotating its own key.
+  const devKey = u.issueKey(dev.id, { by: 'root' });
+  assert.equal((await fetch(`${base}/api/v1/me/key/rotate`, { method: 'POST', headers: { authorization: `Bearer ${devKey}` } })).status, 200);
+
+  // thub-admin on the Coordinator host, and an internal call naming no one.
+  const cli = spawnSync(process.execPath, [path.join(__dirname, '..', 'bin', 'thub-admin.js'), 'user', 'block', 'dev'], {
+    env: { ...process.env, THUB_COORDINATOR_CONFIG: file, SUDO_USER: 'alice' }, encoding: 'utf8'
+  });
+  assert.match(cli.stdout, /Blocked "dev"/);
+  u.setBlocked(dev.id, false);
+
+  // Every recorded event names who did it.
+  assert.ok(u.recentEvents(100).every((e) => e.data.by), 'every user event has `by`');
+
+  const html = await (await fetch(`${base}/admin/users`, { headers: { cookie: root } })).text(),
+    log = html.slice(html.indexOf('Recent activity'), html.indexOf('id="addUserModal"')),
+    rows = [...log.matchAll(/<tr><td[^>]*>[^<]*<\/td><td[^>]*>([^<]*)<\/td><td>([^<]*)<\/td><\/tr>/g)]
+      .map((m) => [m[1], m[2].replace(/&#39;/g, '\'').replace(/&gt;/g, '>')]).reverse(); // oldest first
+  assert.match(log, /<th class="text-nowrap">Timestamp<\/th><th>User<\/th><th>Action<\/th>/);
+  assert.deepEqual(rows, [
+    ['root', 'Created root (Admin)'],
+    ['root', 'Created dev (User)'],
+    ['root', 'Created dev\'s access key'],
+    ['root', 'Created ops (Maintainer)'],
+    ['root', 'Edited ops: role Maintainer → Admin; email, first name'],
+    ['root', 'Issued a temporary password for ops'],
+    ['ops', 'Changed their own password'],
+    ['root', 'Replaced dev\'s access key'],
+    ['dev', 'Replaced their own access key'],
+    ['thub-admin (alice)', 'Blocked dev'],
+    ['system', 'Unblocked dev']
+  ]);
+});

package/views/admin/users.pug

@@ -195,21 +195,22 @@ block content
         tr
           td.text-body-secondary(colspan="5")= q || roleFilter ? 'No user matches.' : 'No users yet.'
 
+  //- The audit log: who did what to which account (web/routes.js auditRows).
   h2.h6.mt-4 Recent activity
-  if events.length
-    ul.list-group.list-group-flush.small.mb-4
-      each e in events
-        li.list-group-item.px-0
-          span.text-body-secondary.me-2= fmtDate(e.ts)
-          strong= e.type.replace('user.', '').replace(/_/g, ' ')
-          if e.data.username
-            = ` ${e.data.username}`
-          if e.data.role && e.data.role.from
-            = ` — ${roleLabel(e.data.role.from)} → ${roleLabel(e.data.role.to)}`
-          else if e.data.role
-            = ` (${roleLabel(e.data.role)})`
-          if e.data.by
-            span.text-body-secondary= ` by ${e.data.by}`
+  if audit.length
+    .table-responsive.mb-4
+      table.table.table-sm.small.align-middle
+        thead
+          tr
+            th.text-nowrap Timestamp
+            th User
+            th Action
+        tbody
+          each e in audit
+            tr
+              td.text-nowrap.text-body-secondary= fmtDate(e.ts)
+              td.text-nowrap= e.by
+              td= e.action
   else
     p.small.text-body-secondary Nothing yet.
 

package/views/help/_coordinator.pug

@@ -131,6 +131,8 @@
     Maintainers use Users too, for Agent-only users and their own account only. They can create, edit, block
     and delete those users and issue or revoke their keys, but can't create or promote a maintainer or admin.
     They don't see admins or other maintainers. They also manage #[a(href="/admin/agents") CI tokens].
+    #[strong Recent activity] at the bottom of Users is the audit log: #[strong Timestamp | User | Action], where
+    User is who made the change (a username, #[code thub-admin (<OS user>)], or #[code system]).
   +note('warning').
     Forgot the admin password? Start the Coordinator once with #[code THUB_BOOTSTRAP_ADMIN_PASSWORD=…]
     (and optionally #[code THUB_BOOTSTRAP_ADMIN_USER], default #[code admin]). The password is reset on