jared
b42597c927
- base.css: add --lt-border/--lt-surface aliases so dashboard.css respects
theme instead of using hardcoded fallback colors
- base.css: add lt-select-sm/lt-input-sm compact size variants (used in 15+
places), lt-msg-danger alias for lt-msg-error, lt-form-hint--warn,
lt-font-mono utility class
- audit_log.php: cap ?limit= at 500 to prevent DoS via oversized queries
- ApiKeysView.php: replace deprecated execCommand('copy') with lt.copy();
add integer casts on api_key_id in id attr and data-id
- AuditLogView.php: rebuild pagination with windowed prev/next/ellipsis
pattern matching DashboardView; integer cast on user_id select option
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
108 lines
3.9 KiB
PHP
108 lines
3.9 KiB
PHP
<?php
|
|
/**
|
|
* Audit Log API Endpoint
|
|
* Handles fetching filtered audit logs and CSV export
|
|
* Admin-only access
|
|
*/
|
|
|
|
require_once __DIR__ . '/bootstrap.php';
|
|
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
|
|
|
|
// Check admin status - audit log viewing is admin-only
|
|
if (!$isAdmin) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Admin access required']);
|
|
exit;
|
|
}
|
|
|
|
$auditLogModel = new AuditLogModel($conn);
|
|
|
|
// GET - Fetch filtered audit logs or export to CSV
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
|
|
// Check for CSV export request
|
|
if (isset($_GET['export']) && $_GET['export'] === 'csv') {
|
|
// Build filters
|
|
$filters = [];
|
|
if (isset($_GET['action_type'])) $filters['action_type'] = $_GET['action_type'];
|
|
if (isset($_GET['entity_type'])) $filters['entity_type'] = $_GET['entity_type'];
|
|
if (isset($_GET['user_id'])) $filters['user_id'] = $_GET['user_id'];
|
|
if (isset($_GET['entity_id'])) $filters['entity_id'] = $_GET['entity_id'];
|
|
if (isset($_GET['date_from'])) $filters['date_from'] = $_GET['date_from'];
|
|
if (isset($_GET['date_to'])) $filters['date_to'] = $_GET['date_to'];
|
|
if (isset($_GET['ip_address'])) $filters['ip_address'] = $_GET['ip_address'];
|
|
|
|
// Get all matching logs (no limit for CSV export)
|
|
$result = $auditLogModel->getFilteredLogs($filters, 10000, 0);
|
|
$logs = $result['logs'];
|
|
|
|
// Set CSV headers
|
|
header('Content-Type: text/csv');
|
|
header('Content-Disposition: attachment; filename="audit_log_' . date('Y-m-d_His') . '.csv"');
|
|
|
|
// Output CSV
|
|
$output = fopen('php://output', 'w');
|
|
|
|
// Write CSV header
|
|
fputcsv($output, ['Log ID', 'Timestamp', 'User', 'Action', 'Entity Type', 'Entity ID', 'IP Address', 'Details']);
|
|
|
|
// Write data rows
|
|
foreach ($logs as $log) {
|
|
$details = '';
|
|
if (is_array($log['details'])) {
|
|
$details = json_encode($log['details']);
|
|
}
|
|
|
|
fputcsv($output, [
|
|
$log['log_id'],
|
|
$log['created_at'],
|
|
$log['display_name'] ?? $log['username'] ?? 'N/A',
|
|
$log['action_type'],
|
|
$log['entity_type'],
|
|
$log['entity_id'] ?? 'N/A',
|
|
$log['ip_address'] ?? 'N/A',
|
|
$details
|
|
]);
|
|
}
|
|
|
|
fclose($output);
|
|
exit;
|
|
}
|
|
|
|
// Normal JSON response for filtered logs
|
|
try {
|
|
// Get pagination parameters
|
|
$page = max(1, (int)($_GET['page'] ?? 1));
|
|
$limit = min(500, max(1, (int)($_GET['limit'] ?? 50)));
|
|
$offset = ($page - 1) * $limit;
|
|
|
|
// Build filters
|
|
$filters = [];
|
|
if (isset($_GET['action_type'])) $filters['action_type'] = $_GET['action_type'];
|
|
if (isset($_GET['entity_type'])) $filters['entity_type'] = $_GET['entity_type'];
|
|
if (isset($_GET['user_id'])) $filters['user_id'] = $_GET['user_id'];
|
|
if (isset($_GET['entity_id'])) $filters['entity_id'] = $_GET['entity_id'];
|
|
if (isset($_GET['date_from'])) $filters['date_from'] = $_GET['date_from'];
|
|
if (isset($_GET['date_to'])) $filters['date_to'] = $_GET['date_to'];
|
|
if (isset($_GET['ip_address'])) $filters['ip_address'] = $_GET['ip_address'];
|
|
|
|
// Get filtered logs
|
|
$result = $auditLogModel->getFilteredLogs($filters, $limit, $offset);
|
|
|
|
echo json_encode([
|
|
'success' => true,
|
|
'logs' => $result['logs'],
|
|
'total' => $result['total'],
|
|
'pages' => $result['pages'],
|
|
'current_page' => $page
|
|
]);
|
|
} catch (Exception $e) {
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to fetch audit logs']);
|
|
}
|
|
exit;
|
|
}
|
|
|
|
// Method not allowed
|
|
http_response_code(405);
|
|
echo json_encode(['success' => false, 'error' => 'Method not allowed']);
|