Audit log: a permanent, tamper-evident record of admin actions

What administrators and the server itself do to the control plane is now
recorded, from inbuxa-drafts/specs/audit-hold-lock.md (AU-1 to AU-12):
settings, accounts, domains, roles and every other registry change, with
each field's before and after (secrets only as "changed"); the fork's own
settings objects; administrator sign-ins (and failed ones to administrator
accounts), master-user and recovery-admin sign-ins, once an hour per
account, method and address; access to another account's data through
impersonation or FetchAnyBlob, once an hour; exports and tamper checks;
and registry writes the server makes on its own, named by subsystem
(system:AcmeRenewal, system:auto-ban, system:directory-sync, ...), with a
spam rules update as one summary record.

No change without its record (AU-3): before a set method changes anything,
a pending record per requested create, update and destroy is written; if
that fails, the method is refused with serverFail. Its outcome follows as
a later entry. A change interrupted by a crash stays "unfinished".

Records live in the fork's subspace under L, as one SHA-256 hash chain per
node. The chain's head is stored, never cached, and every append asserts
it, so two writers can't take the same place. Nothing can edit or delete
a record; the daily purge removes the oldest past the retention (default
730 days, minimum 90) and records where the chain now starts, so
verification still passes. security.audit-recorded (647) copies each
record to webhooks, OpenTelemetry and the log; security.audit-write-failed
(648) reports a failed write.

New JMAP objects under urn:inbuxa:jmap: inbuxa:AuditEvent/get and /query
(filters: time, actor, action, target, account, tenant, outcome, address,
text), inbuxa:AuditSettings, inbuxa:AuditExport (CSV or JSON Lines built
on the server, each line with its chain hash, ending in a manifest; the
created object names the blob and its SHA-256) and
inbuxa:AuditVerification. New permissions sysAuditGet, sysAuditExport and
sysAuditSettingsUpdate: the Administrator role gets all three, the Tenant
Administrator role gets read and export, once, on existing installs too.
A tenant administrator sees records whose actor or target is in its
tenant, including a server administrator's changes there.

Sign-in method on the session: access tokens now remember how they signed
in (password, app password, API key, OAuth client, directory, master user,
recovery admin), including across the HTTP credential cache. New OAuth
access tokens carry their client id in the sealed claims; older ones show
as client "unknown" until they expire.

The schema gains the permissions, the two events and a Management >
Compliance > Audit Log link.

Stack: the request layer boxes every inner future where it's made. Without
that, a debug build overflowed the default 2 MB worker stack on a registry
set; measured with the same request, the branch and main now overflow at
the same stack size (between 1856 and 1920 KiB, debug), so the layer adds
nothing measurable.

Tests: unit tests in inbuxa-features and jmap; system::audit::audit_log_tests
(run with --ignored) passes on RocksDB, SQLite, PostgreSQL, PostgreSQL with a
read replica, MySQL, MySQL with a replica and FoundationDB. The system, JMAP
and SCIM suites pass. authorization.rs skipped fork permissions that guard
no registry object; the audit suite checks a plain user is refused instead.

crates/jmap-proto/src/object/inbuxa_audit.rs

@@ -0,0 +1,353 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! The audit log's JMAP objects under `urn:inbuxa:jmap`
+//! (`inbuxa-drafts/specs/audit-hold-lock.md`, AU-9 to AU-11):
+//!
+//! - `inbuxa:AuditEvent/get` and `/query`: the records, read-only.
+//! - `inbuxa:AuditSettings/get` and `/set`: how long records are kept.
+//! - `inbuxa:AuditExport/set`: create one to get a file of the records a
+//!   filter matches.
+//! - `inbuxa:AuditVerification/set`: create one to recheck every chain.
+//!
+//! They share one set of properties. Nested values (an event's actor, its
+//! target and changes, an export's filter) are plain JSON objects.
+
+use crate::{
+    object::{AnyId, JmapObject, JmapObjectId},
+    request::deserialize::DeserializeArguments,
+};
+use jmap_tools::{Element, Key, Property};
+use std::{borrow::Cow, str::FromStr};
+use types::id::Id;
+
+#[derive(Debug, Clone, Default)]
+pub struct AuditEvent;
+
+#[derive(Debug, Clone, Default)]
+pub struct AuditSettings;
+
+#[derive(Debug, Clone, Default)]
+pub struct AuditExport;
+
+#[derive(Debug, Clone, Default)]
+pub struct AuditVerification;
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum AuditProperty {
+    Id,
+    // AuditEvent
+    At,
+    Node,
+    Actor,
+    Via,
+    RemoteIp,
+    Action,
+    Target,
+    Changes,
+    Details,
+    Reason,
+    Outcome,
+    // AuditSettings
+    KeepForDays,
+    // AuditExport
+    Format,
+    Filter,
+    BlobId,
+    Count,
+    Size,
+    Sha256,
+    // AuditVerification
+    Verified,
+    Chains,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum AuditValue {
+    Id(Id),
+}
+
+impl Property for AuditProperty {
+    fn try_parse(parent: Option<&Key<'_, Self>>, value: &str) -> Option<Self> {
+        // Only the objects' own properties: keys inside a filter, an actor
+        // or a target stay plain keys
+        match parent {
+            None => AuditProperty::parse(value),
+            Some(_) => None,
+        }
+    }
+
+    fn to_cow(&self) -> Cow<'static, str> {
+        match self {
+            AuditProperty::Id => "id",
+            AuditProperty::At => "at",
+            AuditProperty::Node => "node",
+            AuditProperty::Actor => "actor",
+            AuditProperty::Via => "via",
+            AuditProperty::RemoteIp => "remoteIp",
+            AuditProperty::Action => "action",
+            AuditProperty::Target => "target",
+            AuditProperty::Changes => "changes",
+            AuditProperty::Details => "details",
+            AuditProperty::Reason => "reason",
+            AuditProperty::Outcome => "outcome",
+            AuditProperty::KeepForDays => "keepForDays",
+            AuditProperty::Format => "format",
+            AuditProperty::Filter => "filter",
+            AuditProperty::BlobId => "blobId",
+            AuditProperty::Count => "count",
+            AuditProperty::Size => "size",
+            AuditProperty::Sha256 => "sha256",
+            AuditProperty::Verified => "verified",
+            AuditProperty::Chains => "chains",
+        }
+        .into()
+    }
+}
+
+impl AuditProperty {
+    fn parse(value: &str) -> Option<Self> {
+        hashify::tiny_map!(value.as_bytes(),
+            b"id" => AuditProperty::Id,
+            b"at" => AuditProperty::At,
+            b"node" => AuditProperty::Node,
+            b"actor" => AuditProperty::Actor,
+            b"via" => AuditProperty::Via,
+            b"remoteIp" => AuditProperty::RemoteIp,
+            b"action" => AuditProperty::Action,
+            b"target" => AuditProperty::Target,
+            b"changes" => AuditProperty::Changes,
+            b"details" => AuditProperty::Details,
+            b"reason" => AuditProperty::Reason,
+            b"outcome" => AuditProperty::Outcome,
+            b"keepForDays" => AuditProperty::KeepForDays,
+            b"format" => AuditProperty::Format,
+            b"filter" => AuditProperty::Filter,
+            b"blobId" => AuditProperty::BlobId,
+            b"count" => AuditProperty::Count,
+            b"size" => AuditProperty::Size,
+            b"sha256" => AuditProperty::Sha256,
+            b"verified" => AuditProperty::Verified,
+            b"chains" => AuditProperty::Chains,
+        )
+    }
+}
+
+impl FromStr for AuditProperty {
+    type Err = ();
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        AuditProperty::parse(s).ok_or(())
+    }
+}
+
+impl Element for AuditValue {
+    type Property = AuditProperty;
+
+    fn try_parse<P>(key: &Key<'_, Self::Property>, value: &str) -> Option<Self> {
+        match key {
+            Key::Property(AuditProperty::Id) => Id::from_str(value).ok().map(AuditValue::Id),
+            _ => None,
+        }
+    }
+
+    fn to_cow(&self) -> Cow<'static, str> {
+        match self {
+            AuditValue::Id(id) => id.to_string().into(),
+        }
+    }
+}
+
+/// One condition of an `inbuxa:AuditEvent/query` filter. Several in one
+/// filter object must all hold.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AuditFilter {
+    /// From this time on (UTC date).
+    After(String),
+    /// Before this time (UTC date).
+    Before(String),
+    ActorId(Id),
+    Action(String),
+    TargetKind(String),
+    TargetId(String),
+    AccountId(Id),
+    TenantId(Id),
+    Outcome(String),
+    RemoteIp(String),
+    Text(String),
+    _T(String),
+}
+
+impl Default for AuditFilter {
+    fn default() -> Self {
+        AuditFilter::_T(String::new())
+    }
+}
+
+impl<'de> DeserializeArguments<'de> for AuditFilter {
+    fn deserialize_argument<A>(&mut self, key: &str, map: &mut A) -> Result<(), A::Error>
+    where
+        A: serde::de::MapAccess<'de>,
+    {
+        hashify::fnc_map!(key.as_bytes(),
+            b"after" => {
+                *self = AuditFilter::After(map.next_value()?);
+            },
+            b"before" => {
+                *self = AuditFilter::Before(map.next_value()?);
+            },
+            b"actorId" => {
+                *self = AuditFilter::ActorId(map.next_value()?);
+            },
+            b"action" => {
+                *self = AuditFilter::Action(map.next_value()?);
+            },
+            b"targetKind" => {
+                *self = AuditFilter::TargetKind(map.next_value()?);
+            },
+            b"targetId" => {
+                *self = AuditFilter::TargetId(map.next_value()?);
+            },
+            b"accountId" => {
+                *self = AuditFilter::AccountId(map.next_value()?);
+            },
+            b"tenantId" => {
+                *self = AuditFilter::TenantId(map.next_value()?);
+            },
+            b"outcome" => {
+                *self = AuditFilter::Outcome(map.next_value()?);
+            },
+            b"remoteIp" => {
+                *self = AuditFilter::RemoteIp(map.next_value()?);
+            },
+            b"text" => {
+                *self = AuditFilter::Text(map.next_value()?);
+            },
+            _ => {
+                *self = AuditFilter::_T(key.to_string());
+                let _ = map.next_value::<serde::de::IgnoredAny>()?;
+            }
+        );
+
+        Ok(())
+    }
+}
+
+/// Events sort newest first, by `at`; nothing else.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AuditComparator {
+    At,
+    _T(String),
+}
+
+impl Default for AuditComparator {
+    fn default() -> Self {
+        AuditComparator::_T(String::new())
+    }
+}
+
+impl<'de> DeserializeArguments<'de> for AuditComparator {
+    fn deserialize_argument<A>(&mut self, key: &str, map: &mut A) -> Result<(), A::Error>
+    where
+        A: serde::de::MapAccess<'de>,
+    {
+        if key == "property" {
+            let value = map.next_value::<Cow<str>>()?;
+            *self = if value == "at" {
+                AuditComparator::At
+            } else {
+                AuditComparator::_T(value.into_owned())
+            };
+        } else {
+            let _ = map.next_value::<serde::de::IgnoredAny>()?;
+        }
+        Ok(())
+    }
+}
+
+macro_rules! audit_object {
+    ($object:ty, $filter:ty, $comparator:ty) => {
+        impl JmapObject for $object {
+            type Property = AuditProperty;
+
+            type Element = AuditValue;
+
+            type Id = Id;
+
+            type Filter = $filter;
+
+            type Comparator = $comparator;
+
+            type GetArguments = ();
+
+            type SetArguments<'de> = ();
+
+            type QueryArguments = ();
+
+            type CopyArguments = ();
+
+            type ParseArguments = ();
+
+            const ID_PROPERTY: Self::Property = AuditProperty::Id;
+        }
+    };
+}
+
+audit_object!(AuditEvent, AuditFilter, AuditComparator);
+audit_object!(AuditSettings, (), ());
+audit_object!(AuditExport, (), ());
+audit_object!(AuditVerification, (), ());
+
+impl From<Id> for AuditValue {
+    fn from(id: Id) -> Self {
+        AuditValue::Id(id)
+    }
+}
+
+impl JmapObjectId for AuditValue {
+    fn as_id(&self) -> Option<Id> {
+        match self {
+            AuditValue::Id(id) => Some(*id),
+        }
+    }
+
+    fn as_any_id(&self) -> Option<AnyId> {
+        match self {
+            AuditValue::Id(id) => Some(AnyId::Id(*id)),
+        }
+    }
+
+    fn as_id_ref(&self) -> Option<&str> {
+        None
+    }
+
+    fn try_set_id(&mut self, new_id: AnyId) -> bool {
+        if let AnyId::Id(id) = new_id {
+            *self = AuditValue::Id(id);
+            true
+        } else {
+            false
+        }
+    }
+}
+
+impl JmapObjectId for AuditProperty {
+    fn as_id(&self) -> Option<Id> {
+        None
+    }
+
+    fn as_any_id(&self) -> Option<AnyId> {
+        None
+    }
+
+    fn as_id_ref(&self) -> Option<&str> {
+        None
+    }
+
+    fn try_set_id(&mut self, _: AnyId) -> bool {
+        false
+    }
+}

crates/jmap-proto/src/object/mod.rs

@@ -22,6 +22,7 @@ pub mod email;
 pub mod email_submission;
 pub mod fastmail_masked_email; // inbuxa: masked email
 pub mod inbuxa_ai_limits; // inbuxa: AI spam classification
+pub mod inbuxa_audit; // inbuxa: the audit log
 pub mod inbuxa_explanation; // inbuxa: "Explain this" with the local model
 pub mod inbuxa_protocol_policy; // inbuxa: legacy protocols off
 pub mod inbuxa_tenant_protocol_policy; // inbuxa: legacy protocols off, per tenant