41 lines
1.1 KiB
Python
41 lines
1.1 KiB
Python
|
"""
|
||
|
|
Append-only audit log for local-identity.
|
||
|
|
|
||
|
|
All CLI commands and OIDC server events write one entry per operation to
|
||
|
|
~/.local-identity/audit.log (mode 600).
|
||
|
|
|
||
|
|
Format (TSV): ISO-timestamp command username outcome
|
||
|
|
Example:
|
||
|
|
2026-03-02T00:00:00Z init alice ok
|
||
|
|
2026-03-02T00:01:00Z serve/auth alice auth_request
|
||
|
|
2026-03-02T00:01:01Z serve/token alice token_issued
|
||
|
|
|
||
|
|
Failures (e.g. file permission errors) are silently swallowed — the audit
|
||
|
|
log must never interrupt the primary operation.
|
||
|
|
"""
|
||
|
|
|
||
|
|
import datetime
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from .store import _store_dir
|
||
|
|
|
||
|
|
|
||
|
|
def _audit_log_path() -> Path:
|
||
|
|
return _store_dir() / "audit.log"
|
||
|
|
|
||
|
|
|
||
|
|
def log_event(command: str, username: str | None, outcome: str) -> None:
|
||
|
|
"""Append one audit entry. Silent on any I/O failure."""
|
||
|
|
timestamp = datetime.datetime.now(datetime.timezone.utc).strftime(
|
||
|
|
"%Y-%m-%dT%H:%M:%SZ"
|
||
|
|
)
|
||
|
|
entry = f"{timestamp}\t{command}\t{username or '-'}\t{outcome}\n"
|
||
|
|
path = _audit_log_path()
|
||
|
|
try:
|
||
|
|
with open(path, "a", encoding="utf-8") as fh:
|
||
|
|
fh.write(entry)
|
||
|
|
os.chmod(path, 0o600)
|
||
|
|
except OSError:
|
||
|
|
pass
|