Jul 22 - Update - add audit viewer, CSRF lifetime

2026-07-22 16:59:46 -04:00
parent 8533cbe27c
commit a39fa091fa
8 changed files with 170 additions and 2 deletions
@@ -27,7 +27,8 @@ Ubuntu 24.04. Fonts via Google Fonts (Bricolage Grotesque, IBM Plex Sans/Mono).

 - `app.py` — factory, models (`Section`, `Topic`, `AuditLog`), `log_action()`,
  ProxyFix wrap, `_configure_auth_logger()`, public routes `/`, `/healthz`.
- `admin.py` — blueprint `/admin`: session login, section/topic CRUD.
+- `admin.py` — blueprint `/admin`: session login, section/topic CRUD, `/admin/audit`
+  read-only audit viewer (filter by action/entity, 50/page).
 - `config.py` — env-driven config + `_load_dotenv()` (no-expansion loader).
 - `templates/` — public `index.html`; `admin/` base+login+dashboard+forms.
 - `static/css/style.css` (public), `static/css/admin.css`, `static/js/main.js`.
@@ -78,6 +79,9 @@ Public page orders sections by `sort_order, num`; topics by `sort_order`.
  local HTTP testing.
 - **Empty `SECRET_KEY` also kills sessions** → same CSRF error. Must be set,
  stable, secret. Changing it logs everyone out.
+- **CSRF token 1h default 400s long edits.** `WTF_CSRF_TIME_LIMIT` config: blank
+  → `None` (token valid for the whole session, cookie-bound); integer overrides.
+  `audit_log.created_at` is UTC (`datetime.utcnow`); the viewer labels it UTC.
 - **systemd reads `EnvironmentFile` only at start** → `systemctl restart` after
  any `.env` edit; `daemon-reload` after unit edits.
 - **Real client IP behind nginx:** `request.remote_addr` is 127.0.0.1 without