AshAuthentication.AddOn.AuditLog

Copy Markdown View Source

Audit logging support.

Provides audit-logging support for authentication strategies by adding changes and preparations to all their actions.

In order to use this add-on you must have at least one resource configured with the AshAuthentication.AuditLogResource extension added.

Example

defmodule MyApp.Accounts.User do
  use Ash.Resource,
    extensions: [AshAuthentication],
    domain: MyApp.Accounts

  authentication do
    add_ons do
      audit_log do
        audit_log_resource MyApp.Accounts.AuditLog
      end
    end
  end
end

Request metadata uses conn.remote_ip for remote_ip, so proxy-aware plugs can rewrite it from forwarded/proxy metadata before AshAuthentication runs.

authentication.add_ons.audit_log

audit_log name \\ :audit_log

Adds automatic audit logging for authentication events.

The audit log add-on records all authentication-related events (sign in, registration, password reset, etc.) to a dedicated audit log resource. This provides a comprehensive security trail that can be used for compliance, security monitoring, and user activity analysis.

Events are batched for performance and automatically expire based on configured retention periods. Sensitive fields are filtered by default but can be explicitly included when necessary. IP addresses can be hashed, truncated or excluded. See AshAuthentication.AddOn.AuditLog.IpPrivacy.

Examples

audit_log do
  audit_log_resource MyApp.Accounts.AuditLog
  include_strategies [:password, :oauth2]
  exclude_actions [:sign_in_with_token]
  ip_privacy_mode :truncate
  ipv4_truncation_mask 24
  ipv6_truncation_mask 48
end

Arguments

NameTypeDefaultDocs
nameatomUniquely identifies the add-on.

Options

NameTypeDefaultDocs
audit_log_resourcemoduleThe name of the Audit Log resource.
include_strategiesatom | list(atom)[:*]Explicitly allow events from the named strategies.
include_actionsatom | list(atom)[:*]Explicitly allow events from the named actions.
exclude_strategiesatom | list(atom)[]Explicitly ignore events from the named strategies.
exclude_actionsatom | list(atom)[]Explicitly ignore events from the named actions.
include_fieldsatom | list(atom)[]Explicitly include named attributes and arguments in the audit log regardless of their sensitivity setting.
ip_privacy_mode:none | :hash | :truncate | :exclude:noneHow to handle IP addresses for privacy - :none (store as-is), :hash (keyed digest), :truncate (network prefix), or :exclude (don't store). :hash requires a secret salt in config :my_app, audit_log_ip_salt: ..., where :my_app is the application which owns this resource. AshAuthentication.Supervisor refuses to start without one, because an IP address digest under a known salt can be reversed. Prefer :truncate or :exclude when you do not need to tell one address from another. See AshAuthentication.AddOn.AuditLog.IpPrivacy.
ipv4_truncation_maskpos_integer24IPv4 network mask bits for truncation (0-32). Default 24 keeps first 3 octets.
ipv6_truncation_maskpos_integer48IPv6 network prefix bits for truncation (0-128). Default 48 keeps first 3 segments.

Introspection

Target: AshAuthentication.AddOn.AuditLog