Module access 

Available on non-WebAssembly only.

Who may do what on the admin API (18.22.0, #75): users, roles and the audit log.

• Users: the [admin] token_env token is user admin with role admin; [admin] users = ["deploy-bot:RWS_ADMIN_DEPLOY:operator"] adds named tokens (name:ENV_VAR:role), and OIDC sign-in maps groups to roles.
• Roles: viewer reads everything (every GET); operator also reloads, drains, switches maintenance, blocks IPs, flips flags, purges caches and renews certificates; admin also changes authorization tuples. required_role is the one table.
• Audit log: every change (and every refused attempt) as a JSON line — time, user, role, how they signed in, source address, method, path, the body with secrets redacted, the status — kept in memory (the last AUDIT_CAPACITY) and appended to [admin] audit_log when set. MCP tools that change the server record here too.
• Tamper evidence (18.33.0): each line appended to the file carries prev (the SHA-256 of the line before it) and hash (of itself), so verify_chain — GET /admin/api/v1/audit/verify, rws ctl audit --verify [FILE] — finds an edited, removed or inserted entry.

Structs

AuditEntry

One audited change.

ChainReport

What verify_chain found.

McpAuditLayer

Audits tools/call requests for the named MCP tools (the ones that change the server) as user mcp, with the arguments redacted like an admin request body. Wrap the MCP server with it.

Principal

Who made a request.

TokenUser

A user with a bearer token.

Enums

Role

What a user may do; ordered (Viewer < Operator < Admin).

Constants

AUDIT_CAPACITY

Entries kept in memory.

CHAIN_START

The prev of a chain’s first line.

Functions

chain_line

json (an AuditEntry::to_json object) as a chained file line after a line whose line_hash is prev.

line_hash

The SHA-256 of a whole line (without its newline), as the next line’s prev.

node_name

This replica’s name in audit entries and cluster heartbeats.

parse_role_map

group=role entries (comma-separated): a group (or an email address, or * for anyone signed in) → role. First match in order wins.

parse_users

name:ENV_VAR:role entries (comma-separated) → users whose token is in ENV_VAR. Err names the first bad entry or unset variable.

recent_json

The n newest entries, newest first, as a JSON array.

record

Record a change.

record_change

Record a change made by principal from address.

redact

A request body for the log: a JSON object’s secret-looking values replaced by "(redacted)", anything longer than 2 KB cut.

required_role

The role a request needs: reads are viewer, authorization tuples admin, any other change operator.

role_for

The role map gives a user with email and groups: the highest of the entries that match; None when none does.

set_audit_file

Append audit entries to path too (empty: memory only). The hash chain continues from the file’s last line.

verify_audit_file

verify_chain on the configured [admin] audit_log file; Err when none is configured or it can’t be read.

verify_chain

Check an audit log’s hash chain; stops at the first broken line.