Ai gateway observability/log token admin page - #74619
Open
alex-m-brown wants to merge 14 commits into
Open
Conversation
Introduce lib/cdo/user_log_token.rb, which mints and resolves "log tokens": reversible pseudonyms of user ids, so raw user ids stay out of our logs and out of third-party systems. Keys come from the new user_log_token_keys config, a JSON object of version => 32+ random bytes (base64). The highest version encrypts; every version is retained so previously written tokens stay readable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds /admin_users/log_token, an admin-only form that resolves a log token to the user id it stands for, so an engineer holding a token from a log or a third-party system can get back to the account. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…into ai-gateway-observability/user-log-token-lib
…teway-observability/log-token-admin-page
alex-m-brown
changed the base branch from
staging
to
ai-gateway-observability/user-log-token-lib
August 13, 2026 19:24
…teway-observability/log-token-admin-page
alex-m-brown
changed the base branch from
ai-gateway-observability/user-log-token-lib
to
staging
August 14, 2026 14:09
alex-m-brown
changed the base branch from
staging
to
ai-gateway-observability/user-log-token-lib
August 14, 2026 14:10
Adds /admin_users/log_token, an admin-only form that resolves a log token to the user id it stands for, so an engineer holding a token from a log or a third-party system can get back to the account. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
alex-m-brown
force-pushed
the
ai-gateway-observability/log-token-admin-page
branch
from
August 14, 2026 14:13
77476ba to
dd81c23
Compare
…://github.com/code-dot-org/code-dot-org into ai-gateway-observability/log-token-admin-page
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change adds the administrator page
/admin/log_token. The page changes a user id to its log tokens and vice versa. It uses the moduleCdo::UserLogTokenfrom #74609.Sentry and the AI gateway will hold a log token in the place of a user id. An engineer who has a token from a log cannot find the account. An engineer who has an account cannot find its records.
Direction 1: from a user id to its tokens
Retrieving the tokens from a user id reveals the log tokens for each destination. This token can then be used to search each destination for the user's logs.
Direction 2: from a token to its user id
This direction identifies a student. It has these controls:
Cdo::UserLogToken.resolvestops with an error if you do not give an actor and a reason. As a result, a person at a production console cannot prevent the audit record. The module also writes a record when it cannot read the token.Links
Cdo::UserLogToken)Testing story
The file
dashboard/test/controllers/admin_users_controller_test.rbhas unit tests covering both directions and their permissions.Privacy and security
This page identifies a student from a token, and the user must be an admin to open the page.
The audit record does not hold the token. It holds the administrator, the user, the destination, and the reason.