Key actions log available to clients

[anikbrazeau]

Problem

Clients collaborating on a form need to verify who did what, when—especially when something “goes wrong.” Today, we don’t provide a clear, shareable audit of critical actions taken. Clients often end up asking Support "what happened".

User story

As a client (form owner/collaborator), I need to see a reliable list of the most critical actions taken on my form (who/what/when), so I can resolve issues and maintain trust.

Context

As part of the security controls, login actions (failed and successful) must be logged, audit records must be stored and unusual activity should be identifiable, with timestamp and IP address, as per AU-3, AU-4, AU-11, AU-6.

Current state / constraints

• Events logged:

  platform-forms-client/lib/auditLogs.ts

  Line 24 in 9d66425

  // Form Response Events

• Key actions log is behind a feature flag that is ON in Staging and OFF in Production
• The shared API key does not allow the identification of which user did which action as the key is per form
• The current implementation in Staging only renders the 50-100 latest events and/or the last 30 days
• There are performance concerns of querying all events all time, but if it's set up right to only call for a subset of the data it should not be a problem.

Definitions

clarifying similar-sounding terminology

• access log = logging authentication actions for auditing/security
• audit log = internally, we collect and store this data
• server log = server actions printed on the server console, throws errors and alerts
• key actions log = externally, we surface and make this data available to clients

Links

https://forms-staging.cdssandbox.xyz/en/form-builder/cmkl8rwc90000jv0dt1zbgk7s/settings

https://github.com/cds-snc/forms-api/blob/f28f945a62199f1b473e18cc30c88c97a0be47b7/src/lib/logging/auditLogs.ts#L8

https://docs.google.com/document/d/1xNsFGVrIKNHCwIn1_s1r6mAoBn0As8KYrY6po81vo9I/edit?tab=t.0#heading=h.ekvzmfkvd4a

https://docs.google.com/spreadsheets/d/11h2vShehHparCyQ7VNCQ2qC-_h5jU8ZD/edit?gid=1278318464#gid=1278318464&range=159:159

https://docs.google.com/document/d/1PVvCpvMHWnudsDCUGxQcxcMvPxt0YaKWAgtN-Qbtm58/edit?tab=t.0#heading=h.yiygbq3clo61

https://docs.google.com/document/d/1uqCtN7LahS38qL9I1V7P0xQ2dvmMS1-nyqjhs4cT_XM/edit?tab=t.0#heading=h.bwmybscneuo0

https://docs.google.com/document/d/1H7Dszedo0NA0ce_uyFHy2vTlOXguU0yb12gyQZjkqDk/edit?tab=t.0#heading=h.lg4648ncz9xu

https://docs.google.com/document/d/1MjSFRS2u9FpGxbaLX2tqX_b4GRJ3GzU6TV_BEtWq5xI/edit?tab=t.0#heading=h.bgjelyrzppd5

https://docs.google.com/document/d/1FJn6ZkIg4zEGUXvWsD_id7hBcIUuLlsptn2qCljXsro/edit?tab=t.0