webui (3)

dev/ad-entrypoint.sh

@@ -98,6 +98,7 @@ ensure_user carol "$AD_USER_PASSWORD" Carol Clark
 ensure_user dave "$AD_USER_PASSWORD" Dave Davis
 ensure_user eve "$AD_USER_PASSWORD" Eve Evans
 ensure_user "$AD_WEB_ADMIN_USER" "$AD_WEB_ADMIN_PASSWORD" Preview Administrator
+ensure_user report_svc "$AD_USER_PASSWORD" Report Service
 
 for group in Finance_Analysts Engineering_Leads FS_Finance FS_Engineering FS_Projects; do
   ensure_group "$group"
@@ -110,7 +111,7 @@ set_display_name FS_Engineering Engineering
 set_display_name FS_Projects Projects
 
 add_members Finance_Analysts alice
-add_members FS_Finance 'Finance_Analysts,bob'
+add_members FS_Finance 'Finance_Analysts,bob,report_svc'
 add_members Engineering_Leads carol
 add_members FS_Engineering 'Engineering_Leads,dave'
 add_members FS_Projects 'FS_Finance,FS_Engineering,eve'

dev/e2e.py

@@ -262,16 +262,42 @@ def main() -> int:
     check(int(users.get("alice", {}).get("fslogixBytes", 0)) > 0, "Alice FSLogix usage missing")
     check(int(storage_payload.get("totals", {}).get("dataBytes", 0)) > 0, "Data total is empty")
 
-    announce("live Samba audit ingestion, filters, facets, and pagination")
+    announce("high-level Samba audit ingestion, suffix exclusions, filters, facets, and pagination")
+    required_actions = {"read", "write", "move", "delete"}
     activity = eventually(
-        "live alice audit records",
-        lambda: http(query_path("/api/activity", {"user": "alice", "limit": "5"}), token=token),
-        lambda response: response.status == 200 and response.json().get("matched", 0) >= 2,
+        "all four live alice audit actions",
+        lambda: http(query_path("/api/activity", {"user": "alice", "limit": "100"}), token=token),
+        lambda response: (
+            response.status == 200
+            and required_actions.issubset(
+                {event.get("action") for event in response.json().get("events", [])}
+            )
+        ),
         timeout=60,
     )
     activity_payload = activity.json()
+    alice_actions = {event.get("action") for event in activity_payload["events"]}
     check(all("alice" in str(event.get("user", "")).casefold() for event in activity_payload["events"]), "activity user filter leaked unrelated events")
+    check(alice_actions == required_actions, f"unexpected alice audit actions: {sorted(alice_actions)}")
+    check(set(activity_payload.get("facets", {}).get("actions", [])) <= required_actions, "low-level activity category leaked into facets")
     check("Data" in activity_payload.get("facets", {}).get("shares", []), "activity share facets missing Data")
+
+    moved = http(query_path("/api/activity", {"user": "alice", "action": "move", "limit": "100"}), token=token).json()
+    check(moved.get("matched", 0) >= 1, "move action filter returned no event")
+    check(all(event.get("action") == "move" for event in moved.get("events", [])), "move action filter leaked another action")
+
+    eventually(
+        "raw service-account SMB audit source",
+        lambda: engine_run(
+            "exec", FILES_CONTAINER, "grep", "-R", "report_svc", "/var/log/samba",
+            check_result=False,
+        ).returncode,
+        lambda returncode: returncode == 0,
+        timeout=30,
+    )
+    service_activity = http(query_path("/api/activity", {"user": "report_svc", "limit": "100"}), token=token).json()
+    check(service_activity.get("matched") == 0, "_svc account was persisted in the activity archive")
+
     one_event = http(query_path("/api/activity", {"limit": "1"}), token=token).json()
     check(len(one_event.get("events", [])) == 1, "activity limit was ignored")
     check(one_event.get("nextCursor") is not None, "activity pagination cursor missing")

dev/preview-client.sh

@@ -35,10 +35,12 @@ fi
 
 printf 'Generated by the preview SMB client.\n' > /tmp/live-note.txt
 smb alice Data 'cd Finance; mkdir Reports; cd Reports; put /tmp/live-note.txt live-note.txt; ls' >/dev/null
+smb alice Data 'cd Finance; cd Reports; put /tmp/live-note.txt audit-source.txt; get audit-source.txt /tmp/audit-readback.txt; rename audit-source.txt audit-moved.txt; del audit-moved.txt' >/dev/null
 smb carol Data 'cd Engineering; mkdir Designs; cd Designs; put /tmp/live-note.txt architecture.txt; ls' >/dev/null
 smb alice Private 'cd alice; put /tmp/live-note.txt notes.txt; ls' >/dev/null
+smb report_svc Data 'cd Finance; cd Reports; put /tmp/live-note.txt ignored-service-event.txt; get ignored-service-event.txt /tmp/ignored-service-readback.txt; del ignored-service-event.txt' >/dev/null
 touch /run/preview-client-ready
-log 'Initial SMB reads and writes complete; generating live activity'
+log 'Initial SMB file operations complete; generating live activity'
 
 counter=0
 while true; do