Repository navigation
fix: audit log types, anchor bucket retention check, dead code - #148
Merged
Merged
Conversation
Fixes #139, fixes #140, fixes #141. Audit log types (#139): an admin action's entries take the action type of the route's permission scope (gateway or security) and the resource type of the action's prefix, instead of a guess from the action name. The audit page filters by convox/gateway/auth/security and lists the resource types the gateway writes. Anchor bucket retention (#140): the gateway reads the anchor bucket's Object Lock configuration at startup and refuses to start unless it locks objects in COMPLIANCE mode for at least AUDIT_ANCHOR_RETENTION_DAYS. audit verify runs the same check. The anchor writer no longer sets a per-object retention; the bucket default governs. The gateway's IAM role needs s3:GetBucketObjectLockConfiguration on the anchor bucket. Dead code (#141): removed users.suspended from the code (the column is dropped in a later release, #147), the plaintext column-encryption sweep (upgrade through v0.1.10 first), the unused suspicious-activity alert, the dev email outbox, the proxy's destructive-command switch, unused RBAC resources and actions, and Convox command catalog entries with no CLI command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Oct 13, 2026 2:58a.m. | Review ↗ |
| Go | |
Oct 13, 2026 2:58a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
…urce Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters (2)
📒 Files selected for processing (84)
✨ Finishing Touches
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #139, fixes #140, fixes #141.
Audit log types (#139)
An admin action's audit entries took their action type from a guess based on the action name, so the same request could land under different types. Now:
gatewayorsecurity). Requests outside the route table fall back togateway.user.lock→user).Elsewhere, literal type strings now use the
audit.ActionType*constants.The audit page filters by
convox,gateway,authandsecurity, and lists the resource types the gateway writes.Anchor bucket retention (#140)
The anchor writer used to set a retention on each object it wrote. Nothing checked that the bucket itself would keep anchors for as long as
AUDIT_ANCHOR_RETENTION_DAYSclaims. Now:AUDIT_ANCHOR_RETENTION_DAYS. If the configuration can't be read, it also refuses to start.audit verifyruns the same check and fails the report on it.Upgrade note: the gateway's IAM role needs
s3:GetBucketObjectLockConfigurationon the anchor bucket. Without it the new release won't start. The Terraform docs and the upgrade notes cover this.Dead code (#141)
users.suspendedis gone from the code; locking a user is the only way to disable an account. The column stays in the schema for one release because the previous release still selects it during a rollout. Drop the users.suspended column #147 drops it.deleteUserAuditLogs, and the proxy's destructive-command switch.cert,registry,resource,keyroll,addandremove. Their permission rows are gone from the docs.checkWebAuthnAvailabilityis used, despite what the issue says. I removed its recover wrapper instead.Testing
task go:lint: 0 issues.auditEntryTypesaudit verifyfailing on a bucket with too short a retention🤖 Generated with Claude Code
Summary by CodeRabbit
Security
Audit Logs
CLI