strapi-cms-audit-log 1.1.0 → 1.2.1

package/CHANGELOG.md

@@ -5,6 +5,84 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.1] — 2026-11-06
+
+### Fixed
+- Building the list page's filter options no longer takes extra pooled
+  database connections. `readStoredOptions` ran its six `DISTINCT` queries on
+  raw `strapi.db.connection`, which from inside an open transaction takes a
+  second connection per query and can exhaust a small pool. The queries now run
+  in turn on a single transaction connection.
+
+### Changed
+- Removed the upper bound on the supported Node.js version; `engines.node` is
+  now `>=18.0.0`.
+
+## [1.2.0] — 2026-09-11
+
+Remediates every finding of the 10 September OWASP ASVS Level 2 (V7) assessment.
+The audit log can no longer be pruned by anyone, can prove it has not been, and
+carries a correlation id on every request-borne record.
+
+### Security
+
+**F-2 — audit records were deletable (HIGH, V7.3.1 / 7.3.3)**
+- The `DELETE /audit-log/logs/:id` route, its controller handler, the
+  `plugin::audit-log.delete` RBAC action and the per-row delete button are
+  **removed**. There is no permission an administrator could grant to bring
+  deletion back. Strapi drops the stale grants from the database at the first
+  boot after upgrading.
+- `strapi.documents(uid).delete()` on the audit type now throws, alongside
+  update, publish, unpublish, discardDraft and clone.
+- The retention purge — the one deletion that remains — **records itself** as
+  `retention.purge`, with the count, the cutoff and the configured window. It is
+  not gated by `securityEvents`; there is no configuration in which a purge
+  should be silent.
+- **Hash chain.** Every record stores `hash` (SHA-256 over its content fields,
+  `createdAt` and `prevHash`) and `prevHash`. Editing, removing or inserting a
+  record is detectable, and the verifier says at which row. Writes are
+  serialised — an in-process queue plus a PostgreSQL transaction-scoped
+  advisory lock for multi-replica deployments — so concurrent records cannot
+  fork the chain. `createdAt` is now set by the plugin rather than the database
+  so it can be part of the hash.
+- New `integrity` service with `verify()`, new `GET /audit-log/integrity` route
+  (behind `read`), and a verdict line at the top of the list page on every visit.
+- Rows written before 1.2.0 have no hash. They are counted as `legacy` and never
+  backfilled — a hash computed today over a row written last week vouches for
+  nothing about last week.
+
+**F-3 — no off-box copy (MEDIUM, V7.3.3)**
+- The forwarded log line now includes `id`, `hash` and `prevHash`, so the
+  collector's copy carries the chain and a row that has vanished from the
+  database is still provably in the external log. The consuming project should
+  set `forwardToLogger: true`; the mechanism was already there, switched off.
+
+**F-4 — correlation ids absent on ~90% of records (LOW, V7.1.x)**
+- New `correlation` middleware, registered ahead of the access middleware from
+  the plugin's `register` lifecycle: honours an inbound `x-request-id` /
+  `x-correlation-id` / `x-amzn-trace-id` when it is shaped like an id, mints a
+  UUID otherwise, and echoes it back as `X-Request-Id`. Every record written
+  inside a request now has one. New `correlationId` option, default `true`.
+
+**F-1 — failed logins not observed (HIGH, V7.2.1)**
+- No defect found: the listener is correct and the assessment created no
+  records to observe. A test now drives the exact shape Strapi's login
+  controller produces — an un-awaited `emit` followed by a synchronous throw —
+  and asserts the row lands. The README gains a one-line production check.
+
+### Added
+
+- `AuditMaintenanceAction` (`'retention.purge'`), `IntegrityReport`, and the
+  `admin::audit-log` subject.
+- `hash` and `prevHash` on `AuditLog`; both shown on the detail page.
+- ASVS V7 mapping table in the README.
+
+### Removed
+
+- `PERMISSIONS.delete`, `useDeleteAuditLog`, the `delete.*` translations, and
+  `audit.deleteOne()`. Consumers that referenced any of them will fail to compile,
+  which is the intended way to find out.
+
 ## [1.1.0] — 2026-09-03
 
 Adds the half of an audit trail that is not about content — authentication,

package/README.md

@@ -1,4 +1,4 @@
-# strapi-plugin-audit-log
+# strapi-cms-audit-log
 
 Automatic audit logging for **Strapi v5**, in two halves.
 
@@ -103,11 +103,11 @@ Mapped against the usual checklist:
 ## Installation
 
 ```bash
-npm install strapi-plugin-audit-log
+npm install strapi-cms-audit-log
 ```
 
 ```bash
-yarn add strapi-plugin-audit-log
+yarn add strapi-cms-audit-log
 ```
 
 Then enable it in `config/plugins.ts`:
@@ -126,7 +126,7 @@ sidebar entry are all created on boot.
 | | |
 |---|---|
 | Strapi | `^5.0.0` (developed and tested against 5.52) |
-| Node | `>=18 <=22` |
+| Node | `>=18` |
 | Database | Any Strapi v5 supports — PostgreSQL, MySQL/MariaDB, SQLite |
 
 There is one manual step after installing: **grant the permission**. See
@@ -503,7 +503,7 @@ Worth alerting on: repeated `login.failed` from one `ipAddress`, any
 Developing the plugin alongside a Strapi app usually means a path dependency:
 
 ```json
-{ "dependencies": { "strapi-plugin-audit-log": "file:../strapi-plugin-audit-log" } }
+{ "dependencies": { "strapi-cms-audit-log": "file:../strapi-cms-audit-log" } }
 ```
 
 That works, with **one thing you must clean up afterwards**.
@@ -511,7 +511,7 @@ That works, with **one thing you must clean up afterwards**.
 Yarn 1's `file:` protocol copies the directory wholesale. It does not honour the
 `files` field and it does not skip `node_modules`, so the plugin's *development*
 dependencies are installed into your app at
-`node_modules/strapi-plugin-audit-log/node_modules/` — `@strapi/strapi`,
+`node_modules/strapi-cms-audit-log/node_modules/` — `@strapi/strapi`,
 `@strapi/admin`, `react`, `react-dom`, `react-router-dom`, `react-intl` and
 `styled-components` among them.
 
@@ -539,13 +539,13 @@ nothing wrong to find in any of them.
 npm would have given you anyway:
 
 ```bash
-rm -rf node_modules/strapi-plugin-audit-log/node_modules
+rm -rf node_modules/strapi-cms-audit-log/node_modules
 ```
 
 Make it survive the next install with a `postinstall` script:
 
 ```json
-{ "scripts": { "postinstall": "rm -rf node_modules/strapi-plugin-audit-log/node_modules" } }
+{ "scripts": { "postinstall": "rm -rf node_modules/strapi-cms-audit-log/node_modules" } }
 ```
 
 Then clear Vite's dependency cache (`rm -rf node_modules/.strapi/vite`), restart
@@ -555,7 +555,7 @@ Two more things about a path install, unrelated to the above:
 
 - Yarn **copies** rather than links, so changes to the plugin need
   `npm run build` in the plugin followed by re-copying `dist/` into
-  `node_modules/strapi-plugin-audit-log/dist`. A bare `yarn install` will not
+  `node_modules/strapi-cms-audit-log/dist`. A bare `yarn install` will not
   refresh it — the resolution is unchanged, so yarn skips the copy.
 - Strapi loads plugins at boot, so a restart is always required.
 
@@ -748,7 +748,7 @@ trusting a spoofable header.
 ### Why admin and server types are separate
 
 The canonical types live in `server/src/types` and are re-exported from
-`strapi-plugin-audit-log/strapi-server`. The admin panel keeps its own copies of
+`strapi-cms-audit-log/strapi-server`. The admin panel keeps its own copies of
 the few shared unions in `admin/src/types.ts`.
 
 That is a build constraint, not an oversight. `@strapi/sdk-plugin` compiles the
@@ -941,7 +941,7 @@ import type {
   AuditUserConfig,
   AuditWriteMode,
   ContentTypeSelector,
-} from 'strapi-plugin-audit-log/strapi-server';
+} from 'strapi-cms-audit-log/strapi-server';
 ```
 
 `PLUGIN_ID`, `AUDIT_LOG_UID`, `PERMISSIONS` and `DEFAULT_IGNORED_FIELDS` are
@@ -979,7 +979,7 @@ two-field edit on a 173-widget page does not populate 173 widgets.
 npm run watch:link
 
 # in your Strapi project
-npx yalc add --link strapi-plugin-audit-log && npm install
+npx yalc add --link strapi-cms-audit-log && npm install
 npm run develop
 ```
 

package/dist/admin/{App-BLt4lqEM.js → App-CmbG2k9E.js}

@@ -3,7 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const jsxRuntime = require("react/jsx-runtime");
 const admin = require("@strapi/strapi/admin");
 const reactRouterDom = require("react-router-dom");
-const index = require("./index-BYi8OPTw.js");
+const index = require("./index-BsVOGSDf.js");
 const designSystem = require("@strapi/design-system");
 const reactIntl = require("react-intl");
 const React = require("react");
@@ -53,7 +53,9 @@ const ACTION_COLORS = {
   "media.delete": { background: "danger100", text: "danger600" },
   "media-folder.create": { background: "success100", text: "success600" },
   "media-folder.update": { background: "primary100", text: "primary600" },
-  "media-folder.delete": { background: "danger100", text: "danger600" }
+  "media-folder.delete": { background: "danger100", text: "danger600" },
+  // The log's own housekeeping. Neutral: expected, scheduled, and self-reported.
+  "retention.purge": { background: "neutral150", text: "neutral700" }
 };
 const actionColor = (action) => ACTION_COLORS[action] ?? { background: "neutral150", text: "neutral700" };
 const shortContentTypeName = (uid) => {
@@ -588,6 +590,30 @@ const useAuditFilterOptions = () => {
   }, [get]);
   return { options, isLoading };
 };
+const useAuditIntegrity = () => {
+  const { get } = admin.useFetchClient();
+  const [data, setData] = React__namespace.useState(null);
+  const [isLoading, setIsLoading] = React__namespace.useState(true);
+  const [error, setError] = React__namespace.useState(null);
+  React__namespace.useEffect(() => {
+    let cancelled = false;
+    const load = async () => {
+      try {
+        const { data: response } = await get(`/${index.PLUGIN_ID}/integrity`);
+        if (!cancelled) setData(response.data);
+      } catch (err) {
+        if (!cancelled) setError(message(err));
+      } finally {
+        if (!cancelled) setIsLoading(false);
+      }
+    };
+    void load();
+    return () => {
+      cancelled = true;
+    };
+  }, [get]);
+  return { data, isLoading, error };
+};
 const useAuditLog = (id) => {
   const { get } = admin.useFetchClient();
   const [data, setData] = React__namespace.useState(null);
@@ -622,15 +648,6 @@ const useAuditLog = (id) => {
   }, [get, id]);
   return { data, isLoading, error };
 };
-const useDeleteAuditLog = () => {
-  const { del } = admin.useFetchClient();
-  return React__namespace.useCallback(
-    async (id) => {
-      await del(`/${index.PLUGIN_ID}/logs/${id}`);
-    },
-    [del]
-  );
-};
 const MetaField = ({ label, value, mono = false }) => /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Item, { col: 4, s: 6, xs: 12, direction: "column", alignItems: "flex-start", gap: 1, children: [
   /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", textColor: "neutral600", children: label }),
   /* @__PURE__ */ jsxRuntime.jsx(
@@ -806,6 +823,25 @@ const AuditLogDetails = () => {
               value: log.userAgent,
               mono: true
             }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            MetaField,
+            {
+              label: formatMessage({ id: index.getTranslation("detail.hash"), defaultMessage: "Hash" }),
+              value: log.hash,
+              mono: true
+            }
+          ),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            MetaField,
+            {
+              label: formatMessage({
+                id: index.getTranslation("detail.prevHash"),
+                defaultMessage: "Previous hash"
+              }),
+              value: log.prevHash,
+              mono: true
+            }
           )
         ] }) })
       ] }),
@@ -1029,7 +1065,6 @@ const AuditLogTable = ({
   sort,
   onSortChange,
   onView,
-  onDelete,
   isLoading
 }) => {
   const { formatMessage, locale } = reactIntl.useIntl();
@@ -1084,36 +1119,69 @@ const AuditLogTable = ({
         /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral800", children: log.locale ?? "-" }) }),
         /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral600", children: log.source }) }),
         /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: log.outcome === "failure" ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { backgroundColor: "danger100", textColor: "danger600", children: log.outcome }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral600", children: log.outcome ?? "success" }) }),
-        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 1, justifyContent: "flex-end", onClick: (event) => event.stopPropagation(), children: [
-          /* @__PURE__ */ jsxRuntime.jsx(
-            designSystem.IconButton,
-            {
-              label: formatMessage({
-                id: index.getTranslation("list.view"),
-                defaultMessage: "View details"
-              }),
-              variant: "ghost",
-              onClick: () => onView(log),
-              children: /* @__PURE__ */ jsxRuntime.jsx(icons.Eye, {})
-            }
-          ),
-          onDelete ? /* @__PURE__ */ jsxRuntime.jsx(
-            designSystem.IconButton,
-            {
-              label: formatMessage({
-                id: index.getTranslation("list.delete"),
-                defaultMessage: "Delete this record"
-              }),
-              variant: "ghost",
-              onClick: () => onDelete(log),
-              children: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {})
-            }
-          ) : null
-        ] }) })
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { gap: 1, justifyContent: "flex-end", onClick: (event) => event.stopPropagation(), children: /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.IconButton,
+          {
+            label: formatMessage({
+              id: index.getTranslation("list.view"),
+              defaultMessage: "View details"
+            }),
+            variant: "ghost",
+            onClick: () => onView(log),
+            children: /* @__PURE__ */ jsxRuntime.jsx(icons.Eye, {})
+          }
+        ) }) })
       ] }, log.id);
     }) })
   ] });
 };
+const IntegrityStatus = () => {
+  const { formatMessage, locale } = reactIntl.useIntl();
+  const { data, isLoading, error } = useAuditIntegrity();
+  if (isLoading) {
+    return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: formatMessage({
+      id: index.getTranslation("integrity.checking"),
+      defaultMessage: "Verifying the audit chain…"
+    }) });
+  }
+  if (error || !data) {
+    return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "warning600", children: formatMessage(
+      {
+        id: index.getTranslation("integrity.unavailable"),
+        defaultMessage: "Integrity check unavailable: {error}"
+      },
+      { error: error ?? "no report" }
+    ) });
+  }
+  if (!data.ok) {
+    return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { background: "danger100", hasRadius: true, padding: 3, borderColor: "danger200", borderWidth: "1px", borderStyle: "solid", children: [
+      /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 2, wrap: "wrap", children: [
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { backgroundColor: "danger600", textColor: "neutral0", children: formatMessage({ id: index.getTranslation("integrity.broken"), defaultMessage: "CHAIN BROKEN" }) }),
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger700", fontWeight: "bold", children: formatMessage(
+          {
+            id: index.getTranslation("integrity.brokenAt"),
+            defaultMessage: "Record #{id}: {reason}"
+          },
+          { id: data.brokenAt?.id ?? "?", reason: data.brokenAt?.reason ?? "" }
+        ) })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { paddingTop: 1, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger700", children: formatMessage({
+        id: index.getTranslation("integrity.brokenHint"),
+        defaultMessage: "A record was modified, removed or inserted after it was written. Treat everything from this point as unverified and compare against the forwarded copy."
+      }) }) })
+    ] });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 2, wrap: "wrap", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { backgroundColor: "success100", textColor: "success700", children: formatMessage({ id: index.getTranslation("integrity.ok"), defaultMessage: "Chain verified" }) }),
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: formatMessage(
+      {
+        id: index.getTranslation("integrity.summary"),
+        defaultMessage: "{hashed, plural, one {# linked record} other {# linked records}}{legacy, plural, =0 {} one { · # pre-chain record} other { · # pre-chain records}} · checked {when}"
+      },
+      { hashed: data.hashed, legacy: data.legacy, when: formatDate(data.verifiedAt, locale) }
+    ) })
+  ] });
+};
 const toSearchParams = (query) => {
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(query)) {
@@ -1125,17 +1193,10 @@ const toSearchParams = (query) => {
 const AuditLogs = () => {
   const { formatMessage } = reactIntl.useIntl();
   const navigate = reactRouterDom.useNavigate();
-  const { toggleNotification } = admin.useNotification();
   const [{ query }, setQuery] = admin.useQueryParams({ page: 1, pageSize: 20 });
-  const {
-    allowedActions: { canDelete },
-    isLoading: isLoadingPermissions
-  } = admin.useRBAC(index.PERMISSIONS);
   const search = React__namespace.useMemo(() => toSearchParams(query), [query]);
-  const { data, pagination, isLoading, error, refresh } = useAuditLogs(search);
+  const { data, pagination, isLoading, error } = useAuditLogs(search);
   const { options } = useAuditFilterOptions();
-  const deleteLog = useDeleteAuditLog();
-  const [pendingDelete, setPendingDelete] = React__namespace.useState(null);
   const updateQuery = React__namespace.useCallback(
     (patch) => {
       setQuery({ ...patch, page: 1 });
@@ -1159,33 +1220,6 @@ const AuditLogs = () => {
       "remove"
     );
   }, [setQuery]);
-  const confirmDelete = React__namespace.useCallback(async () => {
-    if (!pendingDelete) return;
-    try {
-      await deleteLog(pendingDelete.id);
-      toggleNotification({
-        type: "success",
-        message: formatMessage({
-          id: index.getTranslation("delete.success"),
-          defaultMessage: "Audit record deleted."
-        })
-      });
-      refresh();
-    } catch {
-      toggleNotification({
-        type: "danger",
-        message: formatMessage({
-          id: index.getTranslation("delete.error"),
-          defaultMessage: "Could not delete this audit record."
-        })
-      });
-    } finally {
-      setPendingDelete(null);
-    }
-  }, [deleteLog, formatMessage, pendingDelete, refresh, toggleNotification]);
-  if (isLoadingPermissions) {
-    return /* @__PURE__ */ jsxRuntime.jsx(admin.Page.Loading, {});
-  }
   return /* @__PURE__ */ jsxRuntime.jsxs(admin.Page.Main, { children: [
     /* @__PURE__ */ jsxRuntime.jsx(admin.Page.Title, { children: formatMessage({ id: index.getTranslation("plugin.name"), defaultMessage: "Audit Logs" }) }),
     /* @__PURE__ */ jsxRuntime.jsx(
@@ -1216,6 +1250,7 @@ const AuditLogs = () => {
       }
     ),
     /* @__PURE__ */ jsxRuntime.jsxs(admin.Layouts.Content, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { paddingBottom: 4, children: /* @__PURE__ */ jsxRuntime.jsx(IntegrityStatus, {}) }),
       /* @__PURE__ */ jsxRuntime.jsx(
         AuditLogFilters,
         {
@@ -1233,8 +1268,7 @@ const AuditLogs = () => {
           isLoading,
           sort: String(query.sort ?? "createdAt:desc"),
           onSortChange: (sort) => setQuery({ sort, page: 1 }),
-          onView: (log) => navigate(`${log.id}`),
-          onDelete: canDelete ? setPendingDelete : null
+          onView: (log) => navigate(`${log.id}`)
         }
       ),
       /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { paddingTop: 4, children: /* @__PURE__ */ jsxRuntime.jsx(
@@ -1249,31 +1283,7 @@ const AuditLogs = () => {
           ] })
         }
       ) })
-    ] }),
-    /* @__PURE__ */ jsxRuntime.jsx(
-      designSystem.Dialog.Root,
-      {
-        open: pendingDelete !== null,
-        onOpenChange: (open) => {
-          if (!open) setPendingDelete(null);
-        },
-        children: /* @__PURE__ */ jsxRuntime.jsx(
-          admin.ConfirmDialog,
-          {
-            title: formatMessage({
-              id: index.getTranslation("delete.title"),
-              defaultMessage: "Delete audit record"
-            }),
-            onConfirm: confirmDelete,
-            onCancel: () => setPendingDelete(null),
-            children: formatMessage({
-              id: index.getTranslation("delete.confirm"),
-              defaultMessage: "Audit records are evidence of what happened to your content. Deleting one cannot be undone. Are you sure?"
-            })
-          }
-        )
-      }
-    )
+    ] })
   ] });
 };
 const App = () => /* @__PURE__ */ jsxRuntime.jsx(admin.Page.Protect, { permissions: index.PERMISSIONS.read, children: /* @__PURE__ */ jsxRuntime.jsxs(reactRouterDom.Routes, { children: [