Module access 

Who may do what on the admin API (18.22.0, #75): users, roles and the audit log.

• Users: the [admin] token_env token is user admin with role admin; [admin] users = ["deploy-bot:RWS_ADMIN_DEPLOY:operator"] adds named tokens (name:ENV_VAR:role), and OIDC sign-in maps groups to roles.
• Roles: viewer reads everything (every GET); operator also reloads, drains, switches maintenance, blocks IPs, flips flags, purges caches and renews certificates; admin also changes authorization tuples. required_role is the one table.
• Audit log: every change (and every refused attempt) as a JSON line — time, user, role, how they signed in, source address, method, path, the body with secrets redacted, the status — kept in memory (the last AUDIT_CAPACITY) and appended to [admin] audit_log when set. MCP tools that change the server record here too.

Structs

AuditEntry

One audited change.

McpAuditLayer

Audits tools/call requests for the named MCP tools (the ones that change the server) as user mcp, with the arguments redacted like an admin request body. Wrap the MCP server with it.

Principal

Who made a request.

TokenUser

A user with a bearer token.

Enums

Role

What a user may do; ordered (Viewer < Operator < Admin).

Constants

AUDIT_CAPACITY

Entries kept in memory.

Functions

node_name

This replica’s name in audit entries and cluster heartbeats.

parse_role_map

group=role entries (comma-separated): a group (or an email address, or * for anyone signed in) → role. First match in order wins.

parse_users

name:ENV_VAR:role entries (comma-separated) → users whose token is in ENV_VAR. Err names the first bad entry or unset variable.

recent_json

The n newest entries, newest first, as a JSON array.

record

Record a change.

record_change

Record a change made by principal from address.

redact

A request body for the log: a JSON object’s secret-looking values replaced by "(redacted)", anything longer than 2 KB cut.

required_role

The role a request needs: reads are viewer, authorization tuples admin, any other change operator.

role_for

The role map gives a user with email and groups: the highest of the entries that match; None when none does.

set_audit_file

Append audit entries to path too (empty: memory only).