From b4f31aa0abdc8f292a8e27ac25b895da99959842 Mon Sep 17 00:00:00 2001
From: Jamie Banks <jamie@jdbnet.co.uk>
Date: Fri, 26 Jun 2026 18:40:25 +0100
Subject: [PATCH] feat: add toggleable audit log functionality based on server
 environment variable

---
 app.py               | 11 +++++++++--
 frontend/src/App.vue |  5 +++++
 frontend/src/api.ts  |  2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/app.py b/app.py
index f84d5e8..85eeb1c 100644
--- a/app.py
+++ b/app.py
@@ -883,7 +883,13 @@ def _connect_with_jump_chain(host_id: int) -> tuple[paramiko.SSHClient, paramiko
     raise RuntimeError("failed to build jump chain")
 
 
+def is_audit_log_enabled() -> bool:
+    return os.getenv("ENABLE_AUDIT_LOG", "true").lower() in ("1", "true", "yes")
+
+
 def _insert_connection_audit(host_row: dict[str, Any]) -> int | None:
+    if not is_audit_log_enabled():
+        return None
     try:
         with db_cursor() as (_, cur):
             cur.execute(
@@ -964,9 +970,10 @@ def api_logout():
 @app.route("/api/me", methods=["GET"])
 def api_me():
     version = app.config.get("VERSION", "unknown")
+    audit_enabled = is_audit_log_enabled()
     if session.get("logged_in"):
-        return jsonify({"logged_in": True, "app_version": version})
-    return jsonify({"logged_in": False, "app_version": version})
+        return jsonify({"logged_in": True, "app_version": version, "audit_log_enabled": audit_enabled})
+    return jsonify({"logged_in": False, "app_version": version, "audit_log_enabled": audit_enabled})
 
 
 @app.route("/api/identities", methods=["GET"])
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 1e4f5e5..a77b002 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -25,6 +25,7 @@ interface TabItem {
 const loggedIn = ref(false);
 const checking = ref(true);
 const appVersion = ref("unknown");
+const auditLogEnabled = ref(true);
 const identities = ref<IdentityRow[]>([]);
 const allHosts = ref<HostRow[]>([]);
 const allFolders = ref<FolderRow[]>([]);
@@ -347,6 +348,9 @@ onMounted(async () => {
     if (m.app_version) {
       appVersion.value = m.app_version;
     }
+    if (m.audit_log_enabled !== undefined) {
+      auditLogEnabled.value = m.audit_log_enabled;
+    }
     if (loggedIn.value) await refreshData();
   } catch {
     loggedIn.value = false;
@@ -918,6 +922,7 @@ async function deleteIdentityRow(id: number) {
           API keys
         </button>
         <button
+          v-if="auditLogEnabled"
           type="button"
           class="hidden rounded-lg px-3 py-1.5 text-xs text-slate-400 hover:bg-slate-800 hover:text-white md:inline-flex"
           @click="openAuditLog"
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index b074cec..1642243 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -21,7 +21,7 @@ function browseParams(folderId: number | null, q: string): string {
 }
 
 export const api = {
-  async me(): Promise<{ logged_in: boolean; app_version?: string }> {
+  async me(): Promise<{ logged_in: boolean; app_version?: string; audit_log_enabled?: boolean }> {
     const res = await fetch("/api/me", { credentials: "include" });
     return handle(res);
   },