Add activity logs, sidebar badges, and logout with working alert colors.

Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.

service/internal/settings/auth_audit.go

@@ -0,0 +1,77 @@
+package settings
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// MaxAuthAuditEvents is the retention cap for auth-audit.json.
+const MaxAuthAuditEvents = 1000
+
+// LoadAuthAudit reads and parses auth-audit.json from dir.
+func LoadAuthAudit(dir string) (AuthAuditStore, error) {
+	path := filepath.Join(dir, AuthAuditFileName)
+	payload, err := os.ReadFile(path)
+	if err != nil {
+		return AuthAuditStore{}, err
+	}
+
+	var store AuthAuditStore
+	if err := json.Unmarshal(payload, &store); err != nil {
+		return AuthAuditStore{}, fmt.Errorf("parse auth audit: %w", err)
+	}
+	if store.Events == nil {
+		store.Events = []AuthAuditEvent{}
+	}
+	return store, nil
+}
+
+// LoadAuthAuditOrEmpty returns an empty store when auth-audit.json is missing.
+func LoadAuthAuditOrEmpty(dir string) (AuthAuditStore, error) {
+	store, err := LoadAuthAudit(dir)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return AuthAuditStore{Events: []AuthAuditEvent{}}, nil
+		}
+		return AuthAuditStore{}, err
+	}
+	return store, nil
+}
+
+// SaveAuthAudit writes auth-audit.json to dir with mode 0640.
+func SaveAuthAudit(dir string, store AuthAuditStore) error {
+	if err := ensureConfigDir(dir); err != nil {
+		return err
+	}
+	if store.Events == nil {
+		store.Events = []AuthAuditEvent{}
+	}
+
+	payload, err := json.MarshalIndent(store, "", "  ")
+	if err != nil {
+		return fmt.Errorf("encode auth audit: %w", err)
+	}
+	payload = append(payload, '\n')
+
+	path := filepath.Join(dir, AuthAuditFileName)
+	if err := os.WriteFile(path, payload, 0o640); err != nil {
+		return fmt.Errorf("write auth audit: %w", err)
+	}
+	return nil
+}
+
+// AppendAuthAuditEvent appends event and trims to MaxAuthAuditEvents (newest kept).
+func AppendAuthAuditEvent(dir string, event AuthAuditEvent) error {
+	store, err := LoadAuthAuditOrEmpty(dir)
+	if err != nil {
+		return err
+	}
+	store.Events = append(store.Events, event)
+	if len(store.Events) > MaxAuthAuditEvents {
+		store.Events = store.Events[len(store.Events)-MaxAuthAuditEvents:]
+	}
+	return SaveAuthAudit(dir, store)
+}

service/internal/settings/auth_audit_test.go

@@ -0,0 +1,81 @@
+package settings
+
+import (
+	"testing"
+	"time"
+)
+
+func TestAuthAuditRoundTripAndCap(t *testing.T) {
+	dir := t.TempDir()
+
+	store, err := LoadAuthAuditOrEmpty(dir)
+	if err != nil {
+		t.Fatalf("LoadAuthAuditOrEmpty: %v", err)
+	}
+	if len(store.Events) != 0 {
+		t.Fatalf("expected empty, got %d", len(store.Events))
+	}
+
+	event := AuthAuditEvent{
+		ID:       "evt-1",
+		At:       time.Now().UTC(),
+		Action:   "login",
+		Outcome:  AuthAuditOutcomeSuccess,
+		Category: AuthAuditCategoryAuth,
+		Actor:    "admin",
+	}
+	if err := AppendAuthAuditEvent(dir, event); err != nil {
+		t.Fatalf("AppendAuthAuditEvent: %v", err)
+	}
+
+	loaded, err := LoadAuthAudit(dir)
+	if err != nil {
+		t.Fatalf("LoadAuthAudit: %v", err)
+	}
+	if len(loaded.Events) != 1 || loaded.Events[0].Action != "login" {
+		t.Fatalf("loaded = %+v", loaded)
+	}
+	if loaded.Events[0].Outcome != AuthAuditOutcomeSuccess {
+		t.Fatalf("outcome = %q", loaded.Events[0].Outcome)
+	}
+}
+
+func TestAppendAuthAuditEventTrimsToCap(t *testing.T) {
+	dir := t.TempDir()
+	originalCap := MaxAuthAuditEvents
+	store := AuthAuditStore{Events: make([]AuthAuditEvent, 0, MaxAuthAuditEvents+5)}
+	for index := 0; index < MaxAuthAuditEvents+5; index++ {
+		store.Events = append(store.Events, AuthAuditEvent{
+			ID:       "evt",
+			At:       time.Now().UTC(),
+			Action:   "login",
+			Outcome:  AuthAuditOutcomeSuccess,
+			Category: AuthAuditCategoryAuth,
+			Actor:    "admin",
+			Detail:   string(rune('a' + (index % 26))),
+		})
+	}
+	if err := SaveAuthAudit(dir, store); err != nil {
+		t.Fatalf("SaveAuthAudit: %v", err)
+	}
+	if err := AppendAuthAuditEvent(dir, AuthAuditEvent{
+		ID:       "newest",
+		At:       time.Now().UTC(),
+		Action:   "logout",
+		Outcome:  AuthAuditOutcomeSuccess,
+		Category: AuthAuditCategoryAuth,
+		Actor:    "admin",
+	}); err != nil {
+		t.Fatalf("AppendAuthAuditEvent: %v", err)
+	}
+	loaded, err := LoadAuthAudit(dir)
+	if err != nil {
+		t.Fatalf("LoadAuthAudit: %v", err)
+	}
+	if len(loaded.Events) != originalCap {
+		t.Fatalf("len = %d, want %d", len(loaded.Events), originalCap)
+	}
+	if loaded.Events[len(loaded.Events)-1].ID != "newest" {
+		t.Fatalf("last id = %q", loaded.Events[len(loaded.Events)-1].ID)
+	}
+}

service/internal/settings/path.go

@@ -19,6 +19,7 @@ const (
 	NodesFileName     = "nodes.json"
 	NodeKeysFileName  = "node-keys.enc"
 	NodeAuditFileName = "node-audit.json"
+	AuthAuditFileName = "auth-audit.json"
 	ActionsFileName   = "actions.json"
 )
 

service/internal/settings/types.go

@@ -186,6 +186,41 @@ type NodeAuditStore struct {
 	Events []NodeAuditEvent `json:"events"`
 }
 
+// AuthAuditOutcome is success or failure for an auth/user/group audit event.
+type AuthAuditOutcome string
+
+const (
+	AuthAuditOutcomeSuccess AuthAuditOutcome = "success"
+	AuthAuditOutcomeFailure AuthAuditOutcome = "failure"
+)
+
+// AuthAuditCategory groups auth audit events for UI styling and filtering.
+type AuthAuditCategory string
+
+const (
+	AuthAuditCategoryAuth  AuthAuditCategory = "auth"
+	AuthAuditCategoryUser  AuthAuditCategory = "user"
+	AuthAuditCategoryGroup AuthAuditCategory = "group"
+	AuthAuditCategorySelf  AuthAuditCategory = "self"
+)
+
+// AuthAuditEvent is one append-only record of a login or user/group change.
+type AuthAuditEvent struct {
+	ID       string            `json:"id"`
+	At       time.Time         `json:"at"`
+	Action   string            `json:"action"`
+	Outcome  AuthAuditOutcome  `json:"outcome"`
+	Category AuthAuditCategory `json:"category"`
+	Actor    string            `json:"actor"`
+	Target   string            `json:"target,omitempty"`
+	Detail   string            `json:"detail,omitempty"`
+}
+
+// AuthAuditStore is the plain JSON payload in auth-audit.json.
+type AuthAuditStore struct {
+	Events []AuthAuditEvent `json:"events"`
+}
+
 // UserCredential is one account stored in passwords.enc.
 type UserCredential struct {
 	ID                 string    `json:"id"`