Audit only intentional auth actions, not automatic 401/403 gates.

Stop recording unauthorized/forbidden/password-gate and silent refresh; keep login, logout, and failed-login style events.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-09-01 21:51:59 +08:00
parent d35d3992c2
commit 61531e524f
5 changed files with 35 additions and 127 deletions

View file

@ -747,7 +747,10 @@ def list_audit_logs(
"api_tokens.get",
"auth.me",
"auth.sessions",
"auth.refresh",
"auth.unauthorized",
"auth.password_change_required",
"auth.forbidden_scope",
)
q = q.filter(~AuditLog.action.like("http.%"))
q = q.filter(~AuditLog.action.in_(noise_actions))