Module access_log 

Read and download log of restricted groups (#151, step 4).

Only groups whose need-to-know policy has read_log write here, so the volume stays bounded and nothing is logged for other groups. The log is separate from the audit log, which records changes. An entry says who viewed or downloaded what, through which channel, from which address.

Repeated reads of the same object by the same user through the same channel within COLLAPSE_MINUTES are one entry, so a resumed or ranged download (many requests) is logged once.

What is logged: item and revision pages (and the same data over the REST API), file downloads, Pack and Go, BOM exports, the desktop app’s Get (Kind::Workset) and the read tools of MCP clients and the built-in assistant that name an item (record_tool_read). Lists and searches are not logged, in no channel.

Structs

AccessCtx

Channel and client address of the request, set by the extractor auth::AccessCtx.

Entry

One entry of the log.

Filter

Filter of list.

FilterQuery

The filter as a query string sends it (REST API and the log page): every field optional, empty = not set. Times are RFC 3339 or a date (YYYY-MM-DD, UTC); a date until includes that whole day.

Page

One page of the log.

Subject

An object that was read.

Enums

Channel

The way a request came in.

Kind

What was done with the object.

Constants

COLLAPSE_MINUTES

Reads of one object within this window are logged once.

MAX_LIST

Most entries one listing returns.

Functions

list

The log of a group, newest first (managers of the group and administrators; a group the actor may not know answers “not found”).

page

Like list, with the cursor of the next page.

project_id_by_code

The id of a group by its code, for the CLI (no actor).

project_of_file

The group of a file (through its revision and item).

purge

Deletes old entries (the teamcraft access-log purge command; no actor, the operator of the server).

record

Logs a read when the object’s group logs reads. Without a group, or when the group does not log, nothing is written. A failing write is an error: a download of a logged group that cannot be logged does not happen.

record_revision

Logs a read of a revision (its page, package or BOM export).

record_structure

Logs the read of a whole structure (Pack and Go, BOM export): one entry per group of the structure that logs, labelled with the first revision of that group. revision_ids holds the root and every revision of the tree.

record_tool_read

Logs a read tool of an MCP client or the built-in assistant that named an item (item, as PRT-000012 or PRT-000012/B, plus an optional revision): one view of the item per tool, labelled with what the tool was asked for. Write tools, tools without an item (searches, lists, change orders) and items the actor may not see log nothing. The tool name is the entry’s detail (read_file_text adds the file).