Skip to content

[2.x] feat: flarum/audit support - #152

Merged
imorland merged 4 commits into
2.xfrom
im/audit
Oct 10, 2026
Merged

imorland merged 4 commits into
2.xfrom
im/audit

Conversation

@imorland

Copy link
Copy Markdown
Member

Changes proposed in this pull request:

With flarum/audit enabled, polls logs:

  • poll.created, poll.updated, poll.deleted, poll.published, poll.unpublished, with the poll's id and question;
  • poll.voted, only when a vote changes something. For public polls it records the options added and removed. For private polls it doesn't, because their voters are hidden;
  • poll_group.created, poll_group.updated, poll_group.deleted, with the group's id and name.

Entries for a poll in a discussion also carry discussion_id and post_id, so they appear when the log is filtered by that discussion. The audit browser labels are in en.yml under flarum-audit.lib.browser, as the bundled extensions do it. flarum/audit is a dev dependency and an optional dependency, and the extender is chained onto the existing Extend\Conditional.

The tests exposed two existing bugs, fixed in their own commits:

  • PollVotesChanged::$unvotedOptionIds was always a list of nulls: it plucked option.id from the options themselves.
  • DeletingPollGroup and DeletedPollGroup were never dispatched when a group was deleted through the API. Only the unused DeletePollGroupHandler dispatched them. PollGroupResource now does it in its delete hooks.

AuditTest covers each action, its payload, actor and IP, a resubmitted vote not being logged, and every action being registered with a label. flarum/audit's InteractsWithAuditLog helper isn't in its released package, so the few parts used are inlined. The label check reads en.yml directly, because extension locales aren't loaded in integration tests.

Reviewers should focus on:

Whether to record vote choices for public polls only, as here.

Confirmed

  • Frontend changes: tested on a local Flarum installation. (No frontend changes.)
  • Backend changes: tests are green (run composer test). PHPStan passes.

It plucked option.id from the options themselves, so every unvoted id was
null.
…e API

DeletingPollGroup and DeletedPollGroup were only dispatched by the unused
DeletePollGroupHandler.
With flarum/audit enabled, poll create, edit, delete, publish, unpublish
and votes, and poll group create, edit and delete, are logged. A vote is
logged only when it changes something, and its options only for public
polls. Entries for a poll in a discussion carry the discussion.
@imorland
imorland requested a review from a team as a code owner October 10, 2026 21:10
@imorland
imorland merged commit d670ae3 into 2.x Oct 10, 2026
28 checks passed
@imorland
imorland deleted the im/audit branch October 10, 2026 21:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants