Audit log: a permanent, tamper-evident record of admin actions

What administrators and the server itself do to the control plane is now
recorded, from inbuxa-drafts/specs/audit-hold-lock.md (AU-1 to AU-12):
settings, accounts, domains, roles and every other registry change, with
each field's before and after (secrets only as "changed"); the fork's own
settings objects; administrator sign-ins (and failed ones to administrator
accounts), master-user and recovery-admin sign-ins, once an hour per
account, method and address; access to another account's data through
impersonation or FetchAnyBlob, once an hour; exports and tamper checks;
and registry writes the server makes on its own, named by subsystem
(system:AcmeRenewal, system:auto-ban, system:directory-sync, ...), with a
spam rules update as one summary record.

No change without its record (AU-3): before a set method changes anything,
a pending record per requested create, update and destroy is written; if
that fails, the method is refused with serverFail. Its outcome follows as
a later entry. A change interrupted by a crash stays "unfinished".

Records live in the fork's subspace under L, as one SHA-256 hash chain per
node. The chain's head is stored, never cached, and every append asserts
it, so two writers can't take the same place. Nothing can edit or delete
a record; the daily purge removes the oldest past the retention (default
730 days, minimum 90) and records where the chain now starts, so
verification still passes. security.audit-recorded (647) copies each
record to webhooks, OpenTelemetry and the log; security.audit-write-failed
(648) reports a failed write.

New JMAP objects under urn:inbuxa:jmap: inbuxa:AuditEvent/get and /query
(filters: time, actor, action, target, account, tenant, outcome, address,
text), inbuxa:AuditSettings, inbuxa:AuditExport (CSV or JSON Lines built
on the server, each line with its chain hash, ending in a manifest; the
created object names the blob and its SHA-256) and
inbuxa:AuditVerification. New permissions sysAuditGet, sysAuditExport and
sysAuditSettingsUpdate: the Administrator role gets all three, the Tenant
Administrator role gets read and export, once, on existing installs too.
A tenant administrator sees records whose actor or target is in its
tenant, including a server administrator's changes there.

Sign-in method on the session: access tokens now remember how they signed
in (password, app password, API key, OAuth client, directory, master user,
recovery admin), including across the HTTP credential cache. New OAuth
access tokens carry their client id in the sealed claims; older ones show
as client "unknown" until they expire.

The schema gains the permissions, the two events and a Management >
Compliance > Audit Log link.

Stack: the request layer boxes every inner future where it's made. Without
that, a debug build overflowed the default 2 MB worker stack on a registry
set; measured with the same request, the branch and main now overflow at
the same stack size (between 1856 and 1920 KiB, debug), so the layer adds
nothing measurable.

Tests: unit tests in inbuxa-features and jmap; system::audit::audit_log_tests
(run with --ignored) passes on RocksDB, SQLite, PostgreSQL, PostgreSQL with a
read replica, MySQL, MySQL with a replica and FoundationDB. The system, JMAP
and SCIM suites pass. authorization.rs skipped fork permissions that guard
no registry object; the audit suite checks a plain user is refused instead.

crates/features/src/audit/record.rs

@@ -0,0 +1,349 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! What an audit entry holds (AU-4). Stored as JSON, so entries written by
+//! one version of the fork read back in the next.
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::net::IpAddr;
+
+/// Longest value kept for one side of a change; longer ones are cut, with
+/// their original length noted.
+pub const MAX_VALUE_LEN: usize = 2048;
+
+/// One thing that happened.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Record {
+    /// Milliseconds since the epoch.
+    pub at: u64,
+    pub actor: Actor,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub via: Option<Via>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub remote_ip: Option<IpAddr>,
+    pub action: Action,
+    pub target: Target,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub changes: Vec<Change>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub details: Option<String>,
+    /// Why, as the actor gave it: required for holds, locks and exports,
+    /// optional for everything else.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    pub outcome: Outcome,
+}
+
+/// Who acted: an account, named as it was then, or the server itself.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Actor {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub account_id: Option<u32>,
+    /// The account's name, or `system:<subsystem>`.
+    pub name: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tenant_id: Option<u32>,
+}
+
+impl Actor {
+    pub fn account(account_id: u32, name: impl Into<String>, tenant_id: Option<u32>) -> Self {
+        Actor {
+            account_id: Some(account_id),
+            name: name.into(),
+            tenant_id,
+        }
+    }
+
+    pub fn system(subsystem: &str) -> Self {
+        Actor {
+            account_id: None,
+            name: format!("system:{subsystem}"),
+            tenant_id: None,
+        }
+    }
+
+    pub fn is_system(&self) -> bool {
+        self.account_id.is_none()
+    }
+}
+
+/// How the actor signed in (AU-5).
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum Via {
+    Password,
+    AppPassword {
+        id: u32,
+    },
+    ApiKey {
+        id: u32,
+    },
+    #[serde(rename = "oauth")]
+    OAuth {
+        client: String,
+    },
+    /// A token from an external directory (OIDC).
+    Directory,
+    /// Signed in as someone else with a master user's password.
+    #[serde(rename_all = "camelCase")]
+    Master {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        account_id: Option<u32>,
+        name: String,
+    },
+    /// The recovery administrator from the server's own configuration.
+    Recovery,
+}
+
+/// What kind of thing happened.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Action {
+    Create,
+    Update,
+    Destroy,
+    SignIn,
+    SignInFailed,
+    /// JMAP access to another account through `Impersonate`.
+    AccountAccess,
+    /// A blob of another account read through `FetchAnyBlob`.
+    BlobAccess,
+    Export,
+    Verify,
+}
+
+impl Action {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Action::Create => "create",
+            Action::Update => "update",
+            Action::Destroy => "destroy",
+            Action::SignIn => "signIn",
+            Action::SignInFailed => "signInFailed",
+            Action::AccountAccess => "accountAccess",
+            Action::BlobAccess => "blobAccess",
+            Action::Export => "export",
+            Action::Verify => "verify",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        Some(match value {
+            "create" => Action::Create,
+            "update" => Action::Update,
+            "destroy" => Action::Destroy,
+            "signIn" => Action::SignIn,
+            "signInFailed" => Action::SignInFailed,
+            "accountAccess" => Action::AccountAccess,
+            "blobAccess" => Action::BlobAccess,
+            "export" => Action::Export,
+            "verify" => Action::Verify,
+            _ => return None,
+        })
+    }
+}
+
+/// What it happened to.
+#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Target {
+    /// An object type (`x:Domain`, `inbuxa:ProtocolPolicy`), or `account`
+    /// for sign-ins and access.
+    pub kind: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// The account the object belongs to, when it belongs to one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub account_id: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tenant_id: Option<u32>,
+}
+
+/// One property's change. A secret is never stored: `redacted` says it
+/// changed, and both sides are left out (AU-4).
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Change {
+    pub field: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub before: Option<Value>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub after: Option<Value>,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub redacted: bool,
+}
+
+impl Change {
+    pub fn new(field: impl Into<String>, before: Option<Value>, after: Option<Value>) -> Self {
+        Change {
+            field: field.into(),
+            before: before.map(shorten),
+            after: after.map(shorten),
+            redacted: false,
+        }
+    }
+
+    pub fn redacted(field: impl Into<String>) -> Self {
+        Change {
+            field: field.into(),
+            before: None,
+            after: None,
+            redacted: true,
+        }
+    }
+}
+
+/// How it ended.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(
+    tag = "status",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase"
+)]
+pub enum Outcome {
+    Success {
+        /// The id a create was given.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        created_id: Option<String>,
+    },
+    Refused {
+        /// The JMAP error type (`forbidden`, `invalidProperties`, …).
+        error: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<String>,
+    },
+    /// Written before the change was tried; its outcome follows in a later
+    /// entry, or never if the server stopped in between (AU-3).
+    Pending,
+}
+
+impl Outcome {
+    pub fn success() -> Self {
+        Outcome::Success { created_id: None }
+    }
+
+    pub fn refused(error: impl Into<String>, description: Option<String>) -> Self {
+        Outcome::Refused {
+            error: error.into(),
+            description: description.map(|d| shorten_str(d, 500)),
+        }
+    }
+
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Outcome::Success { .. } => "success",
+            Outcome::Refused { .. } => "refused",
+            Outcome::Pending => "pending",
+        }
+    }
+}
+
+/// Cuts a long value, keeping it valid JSON.
+pub fn shorten(value: Value) -> Value {
+    match value {
+        Value::String(s) if s.len() > MAX_VALUE_LEN => Value::String(shorten_str(s, MAX_VALUE_LEN)),
+        Value::String(_) | Value::Null | Value::Bool(_) | Value::Number(_) => value,
+        other => {
+            let text = other.to_string();
+            if text.len() > MAX_VALUE_LEN {
+                Value::String(shorten_str(text, MAX_VALUE_LEN))
+            } else {
+                other
+            }
+        }
+    }
+}
+
+fn shorten_str(s: String, max: usize) -> String {
+    if s.len() <= max {
+        return s;
+    }
+    let mut end = max;
+    while !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    format!("{}… ({} bytes in all)", &s[..end], s.len())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reads_back_as_written() {
+        let record = Record {
+            at: 1_800_000_000_000,
+            actor: Actor::account(3, "[email protected]", None),
+            via: Some(Via::OAuth {
+                client: "inbuxa-admin".into(),
+            }),
+            remote_ip: Some("192.0.2.1".parse().unwrap()),
+            action: Action::Update,
+            target: Target {
+                kind: "x:Domain".into(),
+                id: Some("b".into()),
+                name: Some("example.com".into()),
+                ..Default::default()
+            },
+            changes: vec![
+                Change::new("isEnabled", Some(true.into()), Some(false.into())),
+                Change::redacted("secret"),
+            ],
+            details: None,
+            reason: Some("Ticket 42".into()),
+            outcome: Outcome::Pending,
+        };
+        let json = serde_json::to_string(&record).unwrap();
+        assert!(json.contains("\"kind\":\"oauth\""));
+        let created = serde_json::to_string(&Outcome::Success {
+            created_id: Some("c".into()),
+        })
+        .unwrap();
+        assert_eq!(created, r#"{"status":"success","createdId":"c"}"#);
+        assert!(json.contains("\"redacted\":true"));
+        assert!(!json.contains("\"details\""));
+        assert_eq!(serde_json::from_str::<Record>(&json).unwrap(), record);
+    }
+
+    #[test]
+    fn long_values_are_cut() {
+        let long = "é".repeat(MAX_VALUE_LEN);
+        let Value::String(cut) = shorten(Value::String(long.clone())) else {
+            panic!()
+        };
+        assert!(cut.len() < long.len());
+        assert!(cut.ends_with(&format!("({} bytes in all)", long.len())));
+        let array = Value::Array((0..2000).map(Value::from).collect());
+        assert!(shorten(array).is_string());
+        assert_eq!(shorten(Value::from(5)), Value::from(5));
+    }
+
+    #[test]
+    fn actions_round_trip() {
+        for action in [
+            Action::Create,
+            Action::Update,
+            Action::Destroy,
+            Action::SignIn,
+            Action::SignInFailed,
+            Action::AccountAccess,
+            Action::BlobAccess,
+            Action::Export,
+            Action::Verify,
+        ] {
+            assert_eq!(Action::parse(action.as_str()), Some(action));
+            assert_eq!(
+                serde_json::to_value(action).unwrap(),
+                Value::String(action.as_str().into())
+            );
+        }
+    }
+}