aaronrene / knowtation public
local-auth-audit.mjs
41 lines 1.1 KB
Raw
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ breaking 10 days ago
1 /**
2 * Phase 8 P1b-b — local auth audit events (§7.3). No secrets in logs.
3 */
4
5 import fs from 'fs';
6 import path from 'path';
7
8 /**
9 * Append a local-auth audit event to data_dir/hub_audit.log.
10 * @param {string} dataDir
11 * @param {string} eventName
12 * @param {Record<string, unknown>} fields
13 */
14 export function appendLocalAuthAudit(dataDir, eventName, fields) {
15 if (!dataDir) return;
16 const logPath = path.join(dataDir, 'hub_audit.log');
17 const dir = path.dirname(logPath);
18 if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
19 const line =
20 JSON.stringify({
21 ts: new Date().toISOString(),
22 event: eventName,
23 ...fields,
24 }) + '\n';
25 fs.appendFileSync(logPath, line, 'utf8');
26 }
27
28 /**
29 * @param {import('express').Request} req
30 * @returns {{ ip: string, ua: string }}
31 */
32 export function requestAuditMeta(req) {
33 const ip =
34 (typeof req.ip === 'string' && req.ip) ||
35 (typeof req.headers['x-forwarded-for'] === 'string'
36 ? req.headers['x-forwarded-for'].split(',')[0].trim()
37 : '') ||
38 'unknown';
39 const ua = String(req.headers['user-agent'] || '').slice(0, 256);
40 return { ip, ua };
41 }
File History 1 commit
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ 10 days ago