Add searchable admin audit history
This commit is contained in:
Jonathan Sykes
@@ -115,6 +115,11 @@
|
||||
pre { margin: 0; padding: 14px; border-radius: 14px; background: rgba(0,0,0,.35); border: 1px solid var(--line); overflow: auto; font: 12px/1.55 var(--mono); white-space: pre-wrap; word-break: break-word; max-height: 60vh; }
|
||||
.newtoken { margin-top: 12px; padding: 12px; border: 1px solid var(--ok); border-radius: 12px; background: rgba(74,222,128,.07); word-break: break-all; }
|
||||
.src { font: 11px var(--mono); color: var(--text-dim); } .src.api, .src.auto { color: var(--warn); } .src.restore { color: var(--ok); }
|
||||
.audit-filters { display:grid; grid-template-columns:repeat(5,minmax(0,1fr)); gap:10px; align-items:end; }
|
||||
.audit-filters label { display:grid; gap:5px; color:var(--text-2); font-size:12px; }
|
||||
.audit-tools { display:flex; gap:8px; align-items:center; flex-wrap:wrap; }
|
||||
.audit-detail { color:var(--text-2); font:12px/1.4 var(--mono); max-width:36ch; overflow-wrap:anywhere; }
|
||||
@media(max-width:720px) { .audit-filters { grid-template-columns:repeat(2,minmax(0,1fr)); } }
|
||||
|
||||
/* ---------- upload card ---------- */
|
||||
.sr-file { position: absolute; width: 1px; height: 1px; opacity: 0; overflow: hidden; clip: rect(0 0 0 0); }
|
||||
@@ -659,6 +664,24 @@
|
||||
<div class="card"><div class="row"><h2 style="margin:0">Runs</h2><span class="grow"></span><button class="btn sm" type="button" id="deepRefresh">Refresh</button></div><p class="muted" id="deepIndexStatus"></p><div id="deepJobs"></div></div>
|
||||
</section>
|
||||
|
||||
<section id="p-audit" class="panel">
|
||||
<h1 class="page">Audit log</h1>
|
||||
<p class="lead">A searchable record of admin changes, with the actor and target kept alongside each action.</p>
|
||||
<div class="card">
|
||||
<form id="auditFilterForm" class="audit-filters">
|
||||
<label>Search<input class="field" id="auditSearch" type="search" maxlength="160" placeholder="target or detail" /></label>
|
||||
<label>Actor<input class="field" id="auditActor" type="search" maxlength="120" placeholder="admin" /></label>
|
||||
<label>Action<input class="field" id="auditAction" type="search" maxlength="120" placeholder="lyrics.save" /></label>
|
||||
<label>From<input class="field" id="auditFrom" type="date" /></label>
|
||||
<label>Through<input class="field" id="auditTo" type="date" /></label>
|
||||
<div class="audit-tools"><button class="btn pri" type="submit">Filter</button><a class="btn sm" id="auditJson" href="/api/admin/audit?format=json">Export JSON</a><a class="btn sm" id="auditCsv" href="/api/admin/audit?format=csv">Export CSV</a></div>
|
||||
<span class="grow"></span><span class="muted" id="auditCount" role="status" aria-live="polite"></span>
|
||||
</form>
|
||||
<div class="scroll"><table class="tbl" id="auditTable"></table></div>
|
||||
<div class="row"><button class="btn" id="auditPrev" type="button">Previous</button><button class="btn" id="auditNext" type="button">Next</button><span class="grow"></span><span class="muted">50 events per page</span></div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section id="p-access" class="panel">
|
||||
<h1 class="page">API access</h1>
|
||||
<p class="lead">Tokens let scripts write shared lyrics and chapters. A token is shown once — store it in your secrets vault.</p>
|
||||
@@ -715,9 +738,10 @@
|
||||
history: '<path d="M3 12a9 9 0 109-9 9 9 0 00-6.4 2.6L3 8"/><path d="M3 3v5h5M12 7v5l3 2"/>',
|
||||
analytics: '<path d="M4 20h16M7 16V9M12 16V4M17 16v-5"/>',
|
||||
'deep-search': '<circle cx="10.5" cy="10.5" r="6.5"/><path d="m15.5 15.5 5 5M8 10.5h5M10.5 8v5"/>',
|
||||
audit: '<path d="M5 4h14v16H5zM8 8h8M8 12h8M8 16h5"/>',
|
||||
access: '<circle cx="8" cy="15" r="4"/><path d="M11 12l9-9M16 7l3 3M14 9l2 2"/>',
|
||||
};
|
||||
const TABS = [['editor', 'Editor'], ['reports', 'Reports'], ['library', 'Library'], ['peers', 'P2P'], ['history', 'History'], ['analytics', 'Stats'], ['deep-search', 'Deep search'], ['access', 'API']];
|
||||
const TABS = [['editor', 'Editor'], ['reports', 'Reports'], ['library', 'Library'], ['peers', 'P2P'], ['history', 'History'], ['analytics', 'Stats'], ['deep-search', 'Deep search'], ['audit', 'Audit log'], ['access', 'API']];
|
||||
let tab = 'editor';
|
||||
function buildTabs() {
|
||||
const html = TABS.map(([k, l]) => `<button class="tab" role="tab" data-tab="${k}" aria-selected="false"><svg viewBox="0 0 24 24">${ICONS[k]}</svg><span>${l}</span>${k === 'reports' ? '<span class="badge hidden" data-badge>0</span>' : ''}</button>`).join('');
|
||||
@@ -738,6 +762,7 @@
|
||||
if (name === 'access') loadTokens();
|
||||
if (name === 'analytics') loadAnalytics();
|
||||
if (name === 'deep-search') loadDeepSearch();
|
||||
if (name === 'audit') loadAudit();
|
||||
window.scrollTo({ top: 0 });
|
||||
}
|
||||
function setBadge(n) {
|
||||
@@ -889,6 +914,37 @@
|
||||
const rows = (j.tokens || []).map((t) => `<tr><td>${esc(t.label)}</td><td class="muted">${when(t.createdAt)}</td><td class="muted">${t.lastUsedAt ? when(t.lastUsedAt) : 'never'}</td><td><button class="btn sm dng" data-revoke="${esc(t.id)}">Revoke</button></td></tr>`).join('');
|
||||
$('tokenTable').innerHTML = rows ? `<tr><th>Label</th><th>Created</th><th>Last used</th><th></th></tr>${rows}` : '<tr><td class="muted">No tokens yet.</td></tr>';
|
||||
}
|
||||
|
||||
/* ---------------- audit history ---------------- */
|
||||
let auditOffset = 0;
|
||||
function auditQuery(format = '') {
|
||||
const p = new URLSearchParams(format ? {} : { limit: '50', offset: String(auditOffset) });
|
||||
const search = $('auditSearch').value.trim(); if (search) p.set('q', search);
|
||||
for (const [key, id] of [['actor', 'auditActor'], ['action', 'auditAction']]) {
|
||||
const value = $(id).value.trim(); if (value) p.set(key, value);
|
||||
}
|
||||
for (const [key, id, end] of [['from', 'auditFrom', false], ['to', 'auditTo', true]]) {
|
||||
const value = $(id).value;
|
||||
if (value) p.set(key, String(Math.floor(new Date(`${value}T${end ? '23:59:59' : '00:00:00'}Z`).getTime() / 1000)));
|
||||
}
|
||||
if (format) p.set('format', format);
|
||||
return p.toString();
|
||||
}
|
||||
async function loadAudit() {
|
||||
const table = $('auditTable'); table.innerHTML = '<tr><td class="muted">Loading audit events…</td></tr>';
|
||||
try {
|
||||
const j = await api('/api/admin/audit?' + auditQuery());
|
||||
if (!j.ok) throw Error(j.error || 'Audit log unavailable.');
|
||||
const rows = j.events.map(event => `<tr><td>${when(event.ts)}</td><td>${esc(event.actor)}</td><td><code>${esc(event.action)}</code></td><td>${esc(event.target || '—')}</td><td class="audit-detail">${esc(JSON.stringify(event.detail || {}))}</td></tr>`).join('');
|
||||
table.innerHTML = rows ? `<tr><th>When</th><th>Actor</th><th>Action</th><th>Target</th><th>Details</th></tr>${rows}` : '<tr><td class="muted">No matching events.</td></tr>';
|
||||
$('auditCount').textContent = `${j.total.toLocaleString()} events · ${j.events.length ? auditOffset + 1 : 0}–${auditOffset + j.events.length}`;
|
||||
$('auditPrev').disabled = auditOffset === 0; $('auditNext').disabled = auditOffset + j.events.length >= j.total;
|
||||
$('auditJson').href = '/api/admin/audit?' + auditQuery('json'); $('auditCsv').href = '/api/admin/audit?' + auditQuery('csv');
|
||||
} catch (error) { table.innerHTML = `<tr><td class="err">${esc(error.message)}</td></tr>`; }
|
||||
}
|
||||
$('auditFilterForm').addEventListener('submit', event => { event.preventDefault(); auditOffset = 0; loadAudit(); });
|
||||
$('auditPrev').addEventListener('click', () => { auditOffset = Math.max(0, auditOffset - 50); loadAudit(); });
|
||||
$('auditNext').addEventListener('click', () => { auditOffset += 50; loadAudit(); });
|
||||
$('tokenForm').addEventListener('submit', async (e) => {
|
||||
e.preventDefault();
|
||||
const label = $('tokenLabel').value.trim();
|
||||
|
||||
3
playwright.admin-audit.config.js
Normal file
3
playwright.admin-audit.config.js
Normal file
@@ -0,0 +1,3 @@
|
||||
const { defineConfig } = require('@playwright/test');
|
||||
const classic = require('./playwright.classic.config');
|
||||
module.exports = defineConfig({ ...classic, testMatch: /admin-audit\.spec\.js/ });
|
||||
53
server/audit-log.js
Normal file
53
server/audit-log.js
Normal file
@@ -0,0 +1,53 @@
|
||||
const asJson = value => {
|
||||
try { return JSON.stringify(value ?? {}); } catch { return '{}'; }
|
||||
}
|
||||
|
||||
export async function audit(db, actor, action, target = '', detail = {}) {
|
||||
const client = typeof db?.execute === 'function' ? db : db?.db;
|
||||
if (!client?.execute) throw new TypeError('audit database client is unavailable');
|
||||
await client.execute({
|
||||
sql: 'INSERT INTO audit_log (ts,actor,action,target,detail) VALUES (unixepoch(),?,?,?,?)',
|
||||
args: [String(actor || 'admin').slice(0, 120), String(action).slice(0, 120), String(target || '').slice(0, 300), asJson(detail).slice(0, 8000)],
|
||||
});
|
||||
}
|
||||
|
||||
export function registerAuditRoutes(app, { db, adminAuth }) {
|
||||
const client = typeof db?.execute === 'function' ? db : db?.db;
|
||||
app.get('/api/admin/audit', adminAuth, async c => {
|
||||
const format = c.req.query('format');
|
||||
const limit = Math.max(1, Math.min(format ? 10000 : 200, Number(c.req.query('limit')) || (format ? 10000 : 50)));
|
||||
const offset = format ? 0 : Math.max(0, Math.min(1_000_000, Number(c.req.query('offset')) || 0));
|
||||
const filters = [];
|
||||
const args = [];
|
||||
for (const key of ['actor', 'action']) {
|
||||
const value = String(c.req.query(key) || '').trim().slice(0, 120);
|
||||
if (value) { filters.push(`${key} LIKE ?`); args.push(`%${value.replace(/[\\%_]/g, '\\$&')}%`); }
|
||||
}
|
||||
const search = String(c.req.query('q') || '').trim().slice(0, 160);
|
||||
if (search) { filters.push('(actor LIKE ? OR action LIKE ? OR target LIKE ? OR detail LIKE ?)'); args.push(...Array(4).fill(`%${search.replace(/[\\%_]/g, '\\$&')}%`)); }
|
||||
const from = Number(c.req.query('from'));
|
||||
const to = Number(c.req.query('to'));
|
||||
if (Number.isFinite(from) && from > 0) { filters.push('ts >= ?'); args.push(Math.floor(from)); }
|
||||
if (Number.isFinite(to) && to > 0) { filters.push('ts <= ?'); args.push(Math.floor(to)); }
|
||||
const where = filters.length ? `WHERE ${filters.join(' AND ')}` : '';
|
||||
const [rows, count] = await Promise.all([
|
||||
client.execute({ sql: `SELECT id,ts,actor,action,target,detail FROM audit_log ${where} ORDER BY ts DESC,id DESC LIMIT ? OFFSET ?`, args: [...args, limit, offset] }),
|
||||
client.execute({ sql: `SELECT COUNT(*) AS total FROM audit_log ${where}`, args }),
|
||||
]);
|
||||
const events = rows.rows.map(row => ({
|
||||
id: Number(row.id), ts: Number(row.ts), actor: row.actor, action: row.action, target: row.target,
|
||||
detail: (() => { try { return JSON.parse(row.detail || '{}'); } catch { return {}; } })(),
|
||||
}));
|
||||
if (format === 'json') {
|
||||
c.header('Content-Disposition', 'attachment; filename="ytplayer-audit.json"');
|
||||
return c.json({ events, total: Number(count.rows[0]?.total) || 0 });
|
||||
}
|
||||
if (format === 'csv') {
|
||||
const quote = value => `"${String(value ?? '').replaceAll('"', '""')}"`;
|
||||
const body = ['id,ts,actor,action,target,detail', ...events.map(row => [row.id, new Date(row.ts * 1000).toISOString(), row.actor, row.action, row.target, JSON.stringify(row.detail)].map(quote).join(','))].join('\n');
|
||||
c.header('Content-Disposition', 'attachment; filename="ytplayer-audit.csv"');
|
||||
return c.text(body, 200, { 'Content-Type': 'text/csv; charset=utf-8' });
|
||||
}
|
||||
return c.json({ ok: true, events, total: Number(count.rows[0]?.total) || 0, limit, offset }, 200, { 'Cache-Control': 'no-store' });
|
||||
});
|
||||
}
|
||||
35
server/audit-log.test.js
Normal file
35
server/audit-log.test.js
Normal file
@@ -0,0 +1,35 @@
|
||||
import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
|
||||
import { mkdtempSync, rmSync } from 'node:fs';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { join } from 'node:path';
|
||||
import { Hono } from 'hono';
|
||||
|
||||
const root = mkdtempSync(join(tmpdir(), 'ytp-audit-test-'));
|
||||
process.env.DB_PATH = join(root, 'audit.db');
|
||||
const db = await import('./db.js');
|
||||
const { audit, registerAuditRoutes } = await import('./audit-log.js');
|
||||
const app = new Hono();
|
||||
const auth = async (c, next) => c.req.header('x-admin') === 'yes' ? next() : c.json({ ok: false }, 401);
|
||||
|
||||
beforeAll(async () => {
|
||||
await db.initDb();
|
||||
registerAuditRoutes(app, { db, adminAuth: auth });
|
||||
await audit(db, 'admin', 'notes.save.lyrics', 'video_1', { rev: 2 });
|
||||
await audit(db, 'editor@example.test', 'report.resolve', '42', { batch: true });
|
||||
});
|
||||
afterAll(() => rmSync(root, { recursive: true, force: true }));
|
||||
|
||||
describe('admin audit log', () => {
|
||||
test('is authenticated, filtered, paged and exports CSV/JSON', async () => {
|
||||
expect((await app.request('/api/admin/audit')).status).toBe(401);
|
||||
const headers = { 'x-admin': 'yes' };
|
||||
const filtered = await (await app.request('/api/admin/audit?actor=editor&action=resolve', { headers })).json();
|
||||
expect(filtered.total).toBe(1);
|
||||
expect(filtered.events[0]).toMatchObject({ actor: 'editor@example.test', action: 'report.resolve', target: '42', detail: { batch: true } });
|
||||
const csv = await app.request('/api/admin/audit?format=csv', { headers });
|
||||
expect(csv.headers.get('content-type')).toContain('text/csv');
|
||||
expect(await csv.text()).toContain('notes.save.lyrics');
|
||||
const json = await (await app.request('/api/admin/audit?format=json', { headers })).json();
|
||||
expect(json.events).toHaveLength(2);
|
||||
});
|
||||
});
|
||||
11
server/db.js
11
server/db.js
@@ -265,6 +265,17 @@ export async function initDb() {
|
||||
created_at INTEGER NOT NULL DEFAULT (unixepoch()),
|
||||
last_used_at INTEGER
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS audit_log (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
ts INTEGER NOT NULL DEFAULT (unixepoch()),
|
||||
actor TEXT NOT NULL,
|
||||
action TEXT NOT NULL,
|
||||
target TEXT NOT NULL DEFAULT '',
|
||||
detail TEXT NOT NULL DEFAULT '{}'
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit_log (ts DESC, id DESC);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_actor_action ON audit_log (actor, action, ts DESC);
|
||||
`);
|
||||
await migrateVideoMeta();
|
||||
// Uploads shared from devices (PWA share target): who sent it, and whether it
|
||||
|
||||
@@ -3,6 +3,7 @@ import { db as defaultDb } from './db.js';
|
||||
import * as catalog from './video-catalog.js';
|
||||
import * as innertube from './innertube.js';
|
||||
import * as searchCache from './search-cache.js';
|
||||
import { audit } from './audit-log.js';
|
||||
|
||||
const MAX_SEEDS = 200, MAX_PLAN = 500, MAX_ERRORS = 50;
|
||||
const clean = value => String(value || '').replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, 200);
|
||||
@@ -191,6 +192,7 @@ export function createDeepSearchService({ db = defaultDb, searchDeep = innertube
|
||||
const options = { resultsPerQuery: Math.max(1, Math.min(200, Number(body.resultsPerQuery) || 50)), relatedDepth: Math.max(0, Math.min(2, Number(body.relatedDepth) || 0)), relatedTop: Math.max(1, Math.min(10, Number(body.relatedTop) || 3)), delayMs: Math.max(1000, Math.min(300000, (Number(body.delaySeconds) || 10) * 1000)), jitterMs: Math.max(0, Math.min(300000, (Number(body.jitterSeconds) || 3) * 1000)), dailyCap: Math.max(1, Math.min(10000, Number(body.dailyCap) || 1000)), channels: (Array.isArray(body.channels) ? body.channels : []).map(clean).filter(Boolean).slice(0, 25), playlists: (Array.isArray(body.playlists) ? body.playlists : []).map(clean).filter(Boolean).slice(0, 25) };
|
||||
const id = randomUUID(), time = now();
|
||||
await db.execute({ sql: "INSERT INTO deep_search_jobs(id,status,plan,options,state,created_at,updated_at) VALUES(?,'queued',?,?,?,?,?)", args: [id, JSON.stringify(plan), JSON.stringify(options), JSON.stringify({ queriesDone: 0, newVideos: 0, errors: [], log: [] }), time, time] });
|
||||
await audit(db, 'admin', 'deep-search.start', id, { queries: plan.length });
|
||||
if (autoStart) kick(); return c.json({ ok: true, id }, 202);
|
||||
});
|
||||
for (const action of ['pause', 'resume', 'cancel']) app.post(`/api/admin/deep-search/:id/${action}`, adminAuth, async c => {
|
||||
@@ -199,6 +201,7 @@ export function createDeepSearchService({ db = defaultDb, searchDeep = innertube
|
||||
const target = action === 'pause' ? 'paused' : action === 'resume' ? 'queued' : 'cancelled';
|
||||
const marks = allowed.map(() => '?').join(',');
|
||||
const r = await db.execute({ sql: `UPDATE deep_search_jobs SET status=?,updated_at=? WHERE id=? AND status IN (${marks})`, args: [target, now(), id, ...allowed] });
|
||||
if (r.rowsAffected) await audit(db, 'admin', `deep-search.${action}`, id);
|
||||
if (action === 'resume' && r.rowsAffected && autoStart) kick();
|
||||
return c.json({ ok: !!r.rowsAffected, status: r.rowsAffected ? target : undefined }, r.rowsAffected ? 200 : 409);
|
||||
});
|
||||
|
||||
@@ -44,6 +44,7 @@ import { join } from 'node:path';
|
||||
import { getCookie, setCookie, deleteCookie } from 'hono/cookie';
|
||||
import { registerAnalyticsRoutes } from './admin-analytics.js';
|
||||
import { registerTranscriptionRoutes } from './transcriptions.js';
|
||||
import { audit, registerAuditRoutes } from './audit-log.js';
|
||||
|
||||
export const NOTE_KINDS = new Set(['lyrics', 'chapters']);
|
||||
// A YouTube id or one of the server's own uploads (see uploads.js).
|
||||
@@ -507,6 +508,7 @@ export function registerNoteRoutes(app, deps) {
|
||||
if (!r.lines.length) return c.json({ ok: false, error: 'this video has no usable captions' }, 404);
|
||||
const data = sanitizeLyrics({ lines: r.lines.map((l) => ({ ...l, kind: 'line' })), tags: [], offset: 0 });
|
||||
const saved = await db.saveNote({ videoId: id, kind: 'lyrics', data, source: 'auto', updatedBy: who.by, force: true });
|
||||
await audit(db, who.by, 'lyrics.save.auto-captions', id, { rev: saved.rev, lines: data.lines.length });
|
||||
return c.json({ ok: true, rev: saved.rev, lines: data.lines.length, lang: r.lang, auto: r.auto });
|
||||
} catch (err) {
|
||||
return c.json({ ok: false, error: err.message }, 502);
|
||||
@@ -551,6 +553,7 @@ export function registerNoteRoutes(app, deps) {
|
||||
offset: 0,
|
||||
});
|
||||
const saved = await db.saveNote({ videoId: id, kind: 'lyrics', data, source: 'auto', updatedBy: who.by, force: true });
|
||||
await audit(db, who.by, 'lyrics.save.lrclib', id, { rev: saved.rev, lines: data.lines.length });
|
||||
return c.json({ ok: true, rev: saved.rev, lines: data.lines.length, synced: hit.synced, match: { track: hit.meta.trackName, artist: hit.meta.artistName, duration: hit.meta.duration } });
|
||||
} catch (err) {
|
||||
return c.json({ ok: false, error: err.message }, 502);
|
||||
@@ -578,6 +581,7 @@ export function registerNoteRoutes(app, deps) {
|
||||
});
|
||||
if (!r.ok) return c.json({ ok: false, error: 'someone else saved a newer version', conflict: true, current: r.current }, 409);
|
||||
if (kind === 'lyrics') autoResolve(id, data);
|
||||
await audit(db, who.by, `notes.save.${kind}`, id, { rev: r.rev, source: who.via });
|
||||
return c.json({ ok: true, rev: r.rev, data });
|
||||
} catch (err) {
|
||||
return c.json({ ok: false, error: err.message }, 500);
|
||||
@@ -658,11 +662,13 @@ export function registerNoteRoutes(app, deps) {
|
||||
const token = newApiToken();
|
||||
const id = randomBytes(6).toString('hex');
|
||||
await db.createApiToken({ id, label, tokenHash: hashToken(token) });
|
||||
await audit(db, 'admin', 'token.create', id, { label });
|
||||
return c.json({ ok: true, id, label, token });
|
||||
});
|
||||
|
||||
app.delete('/api/admin/tokens/:tid', requireAdmin, async (c) => {
|
||||
const ok = await db.deleteApiToken(c.req.param('tid'));
|
||||
if (ok) await audit(db, 'admin', 'token.revoke', c.req.param('tid'));
|
||||
return ok ? c.json({ ok: true }) : c.json({ ok: false, error: 'not found' }, 404);
|
||||
});
|
||||
|
||||
@@ -673,6 +679,8 @@ export function registerNoteRoutes(app, deps) {
|
||||
await next();
|
||||
};
|
||||
|
||||
registerAuditRoutes(app, { db, adminAuth: requireAdminOrToken });
|
||||
|
||||
if (deps.analytics) registerAnalyticsRoutes(app, { adminAuth: requireAdminOrToken, runYtdlp, ...deps.analytics });
|
||||
|
||||
registerTranscriptionRoutes(app, {
|
||||
@@ -707,7 +715,11 @@ export function registerNoteRoutes(app, deps) {
|
||||
|
||||
app.post('/api/admin/media/:id/redownload', requireAdminOrToken, async c => {
|
||||
if (!media) return c.json({ ok: false, error: 'media cache unavailable' }, 503);
|
||||
try { return c.json({ ok: true, ...(await media.redownload(c.req.param('id'))) }, 202); }
|
||||
try {
|
||||
const result = await media.redownload(c.req.param('id'));
|
||||
await audit(db, 'admin', 'media.redownload', c.req.param('id'), result);
|
||||
return c.json({ ok: true, ...result }, 202);
|
||||
}
|
||||
catch (err) { return c.json({ ok: false, error: err.message }, 400); }
|
||||
});
|
||||
|
||||
@@ -727,6 +739,7 @@ export function registerNoteRoutes(app, deps) {
|
||||
updatedBy: `admin (rev ${old.rev})`, force: true,
|
||||
});
|
||||
if (kind === 'lyrics') autoResolve(id, restored);
|
||||
await audit(db, 'admin', `notes.restore.${kind}`, id, { fromRev: old.rev, newRev: r.rev });
|
||||
return c.json({ ok: true, rev: r.rev });
|
||||
});
|
||||
|
||||
@@ -763,11 +776,14 @@ export function registerNoteRoutes(app, deps) {
|
||||
try { body = await c.req.json(); } catch { /* status required below */ }
|
||||
if (!Number.isInteger(fid) || !['open', 'resolved'].includes(body.status)) return c.json({ ok: false, error: 'bad request' }, 400);
|
||||
const ok = await db.setFlagStatus(fid, body.status, 'admin');
|
||||
if (ok) await audit(db, 'admin', `report.${body.status}`, String(fid));
|
||||
return ok ? c.json({ ok: true, open: await db.countOpenFlags() }) : c.json({ ok: false, error: 'not found' }, 404);
|
||||
});
|
||||
|
||||
app.delete('/api/admin/flags/:fid', requireAdmin, async (c) => {
|
||||
const ok = await db.deleteFlag(Number(c.req.param('fid')));
|
||||
const id = Number(c.req.param('fid'));
|
||||
const ok = await db.deleteFlag(id);
|
||||
if (ok) await audit(db, 'admin', 'report.delete', String(id));
|
||||
return ok ? c.json({ ok: true, open: await db.countOpenFlags() }) : c.json({ ok: false, error: 'not found' }, 404);
|
||||
});
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
"scripts": {
|
||||
"start": "bun server.js",
|
||||
"dev": "bun --hot server.js",
|
||||
"test": "bun test ./recommendations.test.js && bun test --timeout 60000 ./media-cache.test.js && bun test ./notes.test.js && bun test ./transcriptions.test.js && bun test ./admin-analytics.test.js && bun test ./remote.test.js && bun test ./party.test.js && bun test ./uploads.test.js && bun test ./innertube.test.js && bun test ./related.test.js && bun test ./ytdlp-pool.test.js && bun test ./warm-queue.test.js && bun test ./p2p-db.test.js && bun test ./p2p-admit.test.js && bun test ./p2p-retention.test.js && bun test ./p2p-routes.test.js && bun test ./p2p-hub.test.js && bun test --timeout 60000 ./p2p-intake.test.js && bun test ./flags.test.js && bun test ./asset-manifest.test.js && bun test ./static-delivery.test.js && bun test ./video-catalog.test.js && bun test ./search-cache.test.js && bun test --timeout 60000 ./deep-search.test.js"
|
||||
"test": "bun test ./recommendations.test.js && bun test --timeout 60000 ./media-cache.test.js && bun test ./notes.test.js && bun test ./audit-log.test.js && bun test ./transcriptions.test.js && bun test ./admin-analytics.test.js && bun test ./remote.test.js && bun test ./party.test.js && bun test ./uploads.test.js && bun test ./innertube.test.js && bun test ./related.test.js && bun test ./ytdlp-pool.test.js && bun test ./warm-queue.test.js && bun test ./p2p-db.test.js && bun test ./p2p-admit.test.js && bun test ./p2p-retention.test.js && bun test ./p2p-routes.test.js && bun test ./p2p-hub.test.js && bun test --timeout 60000 ./p2p-intake.test.js && bun test ./flags.test.js && bun test ./asset-manifest.test.js && bun test ./static-delivery.test.js && bun test ./video-catalog.test.js && bun test ./search-cache.test.js && bun test --timeout 60000 ./deep-search.test.js"
|
||||
},
|
||||
"dependencies": {
|
||||
"@hono/node-server": "^1.14.0",
|
||||
|
||||
27
tests/admin-audit.spec.js
Normal file
27
tests/admin-audit.spec.js
Normal file
@@ -0,0 +1,27 @@
|
||||
const { test, expect } = require('@playwright/test');
|
||||
|
||||
test('audit tab filters, pages and links filtered exports', async ({ page }) => {
|
||||
const requests = [];
|
||||
await page.route('**/api/**', async route => {
|
||||
const url = new URL(route.request().url()); requests.push(url.pathname + url.search);
|
||||
let body = { ok: true };
|
||||
if (url.pathname === '/api/admin/me') body = { ok: true, enabled: true, admin: true };
|
||||
if (url.pathname === '/api/admin/audit') body = {
|
||||
ok: true, total: 62, offset: Number(url.searchParams.get('offset')) || 0,
|
||||
events: [{ id: 9, ts: 1791900000, actor: 'admin', action: 'notes.save.lyrics', target: 'dQw4w9WgXcQ', detail: { rev: 4 } }],
|
||||
};
|
||||
if (url.pathname === '/api/admin/flags') body = { ok: true, open: 0, flags: [] };
|
||||
if (url.pathname === '/api/admin/media') body = { ok: true, media: [] };
|
||||
if (url.pathname === '/api/uploads') body = { ok: true, uploads: [] };
|
||||
await route.fulfill({ contentType: 'application/json', body: JSON.stringify(body) });
|
||||
});
|
||||
await page.goto('/admin.html#audit');
|
||||
await expect(page.locator('#p-audit')).toBeVisible();
|
||||
await expect(page.locator('#auditTable')).toContainText('notes.save.lyrics');
|
||||
await page.locator('#auditActor').fill('admin'); await page.locator('#auditAction').fill('lyrics');
|
||||
await page.locator('#auditFilterForm button[type=submit]').click();
|
||||
await expect.poll(() => requests.filter(x => x.startsWith('/api/admin/audit?')).length).toBeGreaterThan(1);
|
||||
await expect(page.locator('#auditJson')).toHaveAttribute('href', /actor=admin.*action=lyrics.*format=json/);
|
||||
await page.locator('#auditNext').click();
|
||||
await expect(page.locator('#auditCount')).toContainText('51–');
|
||||
});
|
||||
Reference in New Issue
Block a user