Sub-issue A of #7675, split by the triage seat (session session_01GiG1DfMysjbbFLZErAo93G, 2026-08-12) carrying the maintainer ruling of 2026-08-12 (comment 5261744983 on #7675). Parent stays the coordination node; this card is the domain:identity half.
Ruling carried (verbatim, binding — not re-adjudicable)
补 writer(3 个):login / logout(auth 事件已有钩点,顺带解决那条 user_id null 的未归因 last_login_at diff 行)…
Scope
- Emit
sys_audit_log rows with action: 'login' / 'logout' from the auth session lifecycle hooks in packages/plugins/plugin-auth (the hook points already exist per the ruling).
- Fix the incidental defect named by the ruling: today the only trace of a login is an unattributed
update sys_user row (user_id null) diffing last_login_at — the login row must carry the actor, and the last_login_at system write should be attributed or excluded per existing audit conventions.
- Acceptance: the parent's reproduction inverts — fresh boot, sign-in, then
GET /api/v1/data/sys_audit_log?$filter={"action":"login"} returns the event with actor and tenant. The shipped auth_events list view starts showing rows.
Out of scope
- ⛔
config_change (sub-issue B, domain:services).
- ⛔ The enum retirement (sub-issue C). Note C edits
packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts — if this card also needs edits inside plugin-audit (e.g. audit-writers.ts), it shares a package with C: same-lane serialization applies, do not run A and C in flight together.
- ⛔ Console/objectui surfaces (sub-issue in objectui).
No Blocked-by: — login/logout remain enum members; this half is independent of the retirement ordering.
Size/model suggestion: M, opus.
Sub-issue A of #7675, split by the triage seat (session
session_01GiG1DfMysjbbFLZErAo93G, 2026-08-12) carrying the maintainer ruling of 2026-08-12 (comment 5261744983 on #7675). Parent stays the coordination node; this card is thedomain:identityhalf.Ruling carried (verbatim, binding — not re-adjudicable)
Scope
sys_audit_logrows withaction: 'login'/'logout'from the auth session lifecycle hooks inpackages/plugins/plugin-auth(the hook points already exist per the ruling).update sys_userrow (user_idnull) diffinglast_login_at— the login row must carry the actor, and thelast_login_atsystem write should be attributed or excluded per existing audit conventions.GET /api/v1/data/sys_audit_log?$filter={"action":"login"}returns the event with actor and tenant. The shippedauth_eventslist view starts showing rows.Out of scope
config_change(sub-issue B,domain:services).packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts— if this card also needs edits insideplugin-audit(e.g.audit-writers.ts), it shares a package with C: same-lane serialization applies, do not run A and C in flight together.No
Blocked-by:—login/logoutremain enum members; this half is independent of the retirement ordering.Size/model suggestion: M,
opus.