Skip to content

IAM - Audit writer

Purpose

When a tenant user signs in or changes identity data in the workspace, the platform appends an activity entry so the Activity log shows real history instead of fixed sample rows.

Users and permissions

There is no screen. Writers run inside IAM services after a successful action. Only the Activity log list API exposes entries (ACT). Callers never post an activity entry directly.

Requirements

ID Priority Requirement
AWR-01 Must Activity entries are stored in the tenant database (iam.activity_entries). The Activity log reader lists from that store. There is no public write API for entries.
AWR-02 Must A successful sign-in by a workspace member (tenant_owner or user) appends one sign-in entry for module iam with no record type, record id, or before/after values. The actor is the signed-in user. Platform operator roles (super_admin, admin, support) do not write tenant Activity log entries for sign-in, profile, or password changes; their portal actions stay on the admin Activity log.
AWR-03 Must Creating, updating, or deleting a workspace user appends one create, update, or delete entry for module iam, record type Người dùng, and the target user id. Create and update include before/after name, email, and status where relevant. The actor is the signed-in admin who performed the action.
AWR-04 Must Updating own profile appends one update entry for module iam, record type Người dùng, the user's id, and before/after full name and email.
AWR-05 Must Changing own password or completing a password reset appends one update entry for module iam, record type Người dùng, the user's id, and after { "password": "updated" } (never the hash).
AWR-06 Must Self-registration appends one create entry for module iam, record type Người dùng, the new user id, and after email, full name, and role. The actor is the new user.
AWR-07 Must On append (and when listing), entries older than 1 year from occurredAt are deleted so the store never retains them.
AWR-08 Must Outside production, when the store is empty, a seeder inserts at least 20 sample entries covering sign-in, create, update, and delete across iam, crm, contracts, and tasks so the Activity log screen is not empty.
AWR-09 Must The Activity log list omits entries whose actor is a platform operator account (super_admin, admin, or support). Sample rows that are not linked to a real user remain visible.

Screens

None. The Activity log screen (ACT) reads the same store.

Business rules

  • Actions and modules match ACT: actions sign-in, create, update, delete; IAM writes use module iam.
  • Append is best-effort after the business action succeeds; a failed append does not roll back the business change, but the failure is logged on the server.
  • Platform operator identity traffic belongs on the admin portal Activity log, not the tenant Activity log. User-management actions those operators perform in the customer workspace still record under AWR-03. A user denied BUSINESS MANAGEMENT APIs appends an update entry with record type Quyền (PRM-13).
  • Sample rows use @example.com addresses and are never written in production.

Acceptance criteria

  • AWR-01: Appending an entry makes it appear on the next Activity log list from the database-backed reader; no controller exposes a write route for activity entries.
  • AWR-02: After a successful login as tenant_owner or user, the store holds a sign-in / iam entry for that user. A successful login as admin does not append a tenant Activity log entry.
  • AWR-03: Creating a user, updating a user, and deleting a user each append the matching action with record type Người dùng.
  • AWR-04: Updating own profile appends an update with before and after full name and email.
  • AWR-05: Changing password or resetting password appends an update whose after value marks the password updated without storing a hash.
  • AWR-06: Registering a new account appends a create for that user.
  • AWR-07: An entry older than 1 year is removed when a newer entry is appended or when the list runs.
  • AWR-08: In development, with an empty store, startup leaves at least 20 sample entries.
  • AWR-09: Listing omits entries for platform operator user ids while still returning unlinked sample rows.

Not yet implemented

None.

Out of scope

  • CRM, contracts, or tasks writers (those modules call the same store when built).
  • Exporting the activity log.
  • Operator / admin-portal activity (see ACC).
  • Editing or deleting entries from the tenant Activity log UI.

Open questions

None.