Audit recorded together with the action for many actions, hardened file paths

2026.10.26-audit-transactionnel-etendu-chemins-fichiers · 2026-10-26

Delivered build : f5c3ab9f1f670c44cf29d9a2f48a86ef9def3dea

Changes

• Many actions on the platform (reference data, studies, identity and access, settings, the binder and runs) are now recorded in the audit log in the same operation as the action itself. If the audit entry fails, the action is rolled back and an error is returned, instead of an action with no trace.
• The exports and reports concerned write their audit entry before the document is delivered: if the entry fails, no document is returned.
• For revoking an MCP token, closing a team's MCP access, revoking a sponsor access, invalidating a signature secret and quarantining a lot, the action is performed first. If its audit entry fails, the action stays done and an error is returned to flag the missing trace.
• Session exports and reports apply the database's visibility rule: a session without a study is visible only to its operator, administrators and supervisors of the team.
• File paths stored for session results, equipment certificates and device recordings are checked more strictly, both when saved and when read.
• Updated server and interface software dependencies.

Known limitations

• Operators and readers who relied on the exports to find a colleague's sessions without a study now see fewer of them: this is intended and aligned with read permissions.
• Uploaded file names containing the "%" or "\" character, or longer than 200 characters, are refused on the routes concerned.
• Some actions are still logged after the fact, without rolling the action back if the entry fails. Actions already recorded are not modified and are not retro-audited.