stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Add a durable security activity center #493

New Issue
Closed
opened 2026-08-10 15:22:05 +00:00 by timmy · 0 comments
timmy commented 2026-08-10 15:22:05 +00:00
Owner
Copy Link

Problem

Stackchain now supports passkey/token sign-in, active-device revocation, fresh authorization, and sensitive issue/PR actions, but operators have no durable history showing when those controls were used. Revoking a session deletes the live record, so a suspicious-device investigation loses its timeline.

Evidence on current main (4749d15): src/login_attempt_store.py retains only the current failure window, src/session_store.py retains active sessions/grants only, and the Active devices sheet in frontend/index.html has no historical activity view. This behavior does not duplicate any of 249 historical issue titles, 240 PR titles, or recent commits; related #270, #287, #325, #341, and #485 implement controls rather than durable observability.

Vertical slice

Add a privacy-preserving, bounded security event journal and expose it in the existing Active devices flow. Record successful token/passkey sign-ins, sign-out/device revocation, and successful high-impact issue-close/PR-merge actions. Show reverse-chronological activity with a stable cursor and accessible mobile loading/empty/error states. Never persist or return tokens, cookies, session IDs, CSRF values, credential IDs, raw IPs, request bodies, or comment content. Retain at most 10,000 events and 90 days.

Acceptance tests

  • A successful sign-in records method and bounded device label without secret/session material.
  • Revoking a device removes its live session while prior activity and the revocation event remain visible.
  • Successful issue-close and PR-merge actions record only the bounded target (owner/repo#N) and action.
  • GET /api/v1/security-events requires authentication, applies a bounded limit, returns stable reverse-chronological cursor pages, and uses Cache-Control: no-store.
  • Active devices renders security activity at phone width with keyboard/screen-reader-accessible loading, empty, error/retry, and pagination states.
  • Inserts prune events older than 90 days and cap storage at 10,000 rows.
  • Focused behavioral tests and the full suite pass.

Delivery

Implement with strict RED-GREEN TDD on a deterministic issue branch and merge only after green Gitea Actions.

## Problem Stackchain now supports passkey/token sign-in, active-device revocation, fresh authorization, and sensitive issue/PR actions, but operators have no durable history showing when those controls were used. Revoking a session deletes the live record, so a suspicious-device investigation loses its timeline. Evidence on current main (`4749d15`): `src/login_attempt_store.py` retains only the current failure window, `src/session_store.py` retains active sessions/grants only, and the Active devices sheet in `frontend/index.html` has no historical activity view. This behavior does not duplicate any of 249 historical issue titles, 240 PR titles, or recent commits; related #270, #287, #325, #341, and #485 implement controls rather than durable observability. ## Vertical slice Add a privacy-preserving, bounded security event journal and expose it in the existing Active devices flow. Record successful token/passkey sign-ins, sign-out/device revocation, and successful high-impact issue-close/PR-merge actions. Show reverse-chronological activity with a stable cursor and accessible mobile loading/empty/error states. Never persist or return tokens, cookies, session IDs, CSRF values, credential IDs, raw IPs, request bodies, or comment content. Retain at most 10,000 events and 90 days. ## Acceptance tests - A successful sign-in records method and bounded device label without secret/session material. - Revoking a device removes its live session while prior activity and the revocation event remain visible. - Successful issue-close and PR-merge actions record only the bounded target (`owner/repo#N`) and action. - `GET /api/v1/security-events` requires authentication, applies a bounded limit, returns stable reverse-chronological cursor pages, and uses `Cache-Control: no-store`. - Active devices renders security activity at phone width with keyboard/screen-reader-accessible loading, empty, error/retry, and pagination states. - Inserts prune events older than 90 days and cap storage at 10,000 rows. - Focused behavioral tests and the full suite pass. ## Delivery Implement with strict RED-GREEN TDD on a deterministic issue branch and merge only after green Gitea Actions.
timmy self-assigned this 2026-08-10 15:22:05 +00:00
timmy closed this issue 2026-08-10 15:39:51 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#493
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?