Repository navigation
FM-943 — Audit query API and audit log page #146
Description
Epic: #122 · Depends on: FM-901
Context
The append-only audit ledger has no query surface.
Goal
GET /api/v1/audit with actor/action/resource/outcome/time filters and cursor pagination, fleetctl audit list --output json, and an Audit page.
Architecture reference
FM-104 audit ledger; ADR-0004.
Dependencies
FM-901
Research required
None.
Acceptance criteria
- Metadata only; secrets never present by construction; new
audit.readpermission
Non-goals
- Export/SIEM integration
Tests
Storage query tests, authz, API contract, CLI snapshots.
Activity
Andreas-Froyland commentedon Sep 24, 2026
Split by model: the audit query API (storage query,
audit.readpermission, OpenAPI,fleetctl audit list) isagent:codex; the audit log page isagent:glmonce the API has landed.Andreas-Froyland commentedon Sep 24, 2026
Implementation approach: keep this Codex slice to the audit query API and
fleetctl; the issue comment assigns the Audit page toagent:glmafter the API lands. Add an application-layer authorized audit read use case and query port, with the SQLite adapter applying actor/action/resource/outcome/time filters before sequence cursor pagination. Expose the filtered page as metadata-only API DTOs, document it in OpenAPI, regenerate the TypeScript client, and addfleetctl audit list --output jsonwith the same filters/cursor. Keepaudit.readas the existing catalog permission, enforce it in the application layer, and cover storage filtering/pagination, denied authorization, API contract, and CLI output.