feat(logs): admin changes and logins are recorded on the Logs page

The Logs page shows who added, changed or deleted a compute, from web
or API, and every login, failed login, lockout and logout, with the
client address and a Result column (Done, Failed, Unknown for older
rows). A failed change is recorded with its reason and the error still
reaches the user; a refused one is recorded too.

- logs.audit.write saves each row in its own savepoint and never
  raises, so a log write cannot break or undo the action it records.
  The audit() context manager writes one row when the change ends.
- Logs gains success and ip; user, host and instance are wider and
  date is indexed. The page orders by date then id.
- A compute edit names the changed fields; an edit that changes
  nothing writes no row, and an empty password field is no change.
- A compute's VMs leaving the panel get a system row each: owners
  kept on the Removed VMs page, moved to another compute, restored,
  left without owners, or the removed record expired.
- Job rows carry the result. A job's log entry that cannot be
  computed is logged and skipped instead of rolling back the finish
  (test_service.py changes this on purpose).
- Logins are recorded by signal receivers; CustomLoginView is removed
  and the plain LoginView is used. A wrong OTP code is a failed login,
  counted by django-axes toward the lockout.

Panel records and host-side objects follow in the next layers.

logs/apps.py

@@ -1,6 +1,38 @@
 from django.apps import AppConfig
 
 
+def _login_row(request, user, message, success):
+    from logs.audit import request_ip, write
+
+    write(user, "-", "", message, success, request_ip(request) if request is not None else None)
+
+
+def logged_in(sender, request, user, **kwargs):
+    _login_row(request, user.get_username(), "Login", True)
+
+
+def login_failed(sender, credentials, request=None, **kwargs):
+    _login_row(request, credentials.get("username", ""), "Login failed", False)
+
+
+def locked_out(sender, request, username, ip_address, **kwargs):
+    _login_row(request, username or "", "Locked out", False)
+
+
+def logged_out(sender, request, user, **kwargs):
+    if user is not None:
+        _login_row(request, user.get_username(), "Logout", True)
+
+
 class LogsConfig(AppConfig):
     name = "logs"
     default_auto_field = "django.db.models.AutoField"
+
+    def ready(self):
+        from axes.signals import user_locked_out
+        from django.contrib.auth.signals import user_logged_in, user_logged_out, user_login_failed
+
+        user_logged_in.connect(logged_in, dispatch_uid="logs.login")
+        user_login_failed.connect(login_failed, dispatch_uid="logs.login_failed")
+        user_locked_out.connect(locked_out, dispatch_uid="logs.locked_out")
+        user_logged_out.connect(logged_out, dispatch_uid="logs.logout")

logs/audit.py

@@ -0,0 +1,104 @@
+import ipaddress
+import logging
+from contextlib import contextmanager
+from dataclasses import dataclass
+
+import libvirt
+from django.db import transaction
+
+from accounts.lockout import client_ip
+from logs.models import Logs
+
+logger = logging.getLogger("logs.audit")
+
+
+def write(user, host, instance, message, success=None, ip=None):
+    """
+    Save one Logs row. A failure is written to the log file instead and never
+    raised, so an audit write cannot break the action it records.
+    """
+    user, host, instance = user[:150], host[:255], instance[:120]
+    try:
+        with transaction.atomic():
+            Logs.objects.create(user=user, host=host, instance=instance, message=message, success=success, ip=ip)
+    except Exception as e:
+        try:
+            line = f"audit row not saved ({e!r}): {user} {host} {instance} success={success} ip={ip} {message}"
+            logger.warning(line.replace("\n", "\\n"))
+        except Exception:
+            pass
+
+
+def request_ip(request):
+    """The client address of the request, or None if it is empty or not a plain IP address."""
+    value = client_ip(request)
+    try:
+        ipaddress.ip_address(value)
+    except ValueError:
+        return None
+    # a scoped IPv6 address (fe80::1%eth0) is valid for ipaddress but not for GenericIPAddressField
+    return None if "%" in value else value
+
+
+@dataclass
+class Entry:
+    action: str
+    skip: bool = False
+
+
+def host_of(compute):
+    """The host column for a Compute, or for a host name already at hand."""
+    if compute is None:
+        return "-"
+    return compute if isinstance(compute, str) else compute.name
+
+
+def reason(exc, user):
+    """Why an action failed, as text for the audit row; unknown errors give only their class name."""
+    from operations import claims
+    from operations.utils import busy_message, safe_text
+    from vrtManager.util import OperationError
+
+    if isinstance(exc, claims.Busy):
+        return busy_message(exc, user)
+    if isinstance(exc, OperationError):
+        return str(exc)
+    if isinstance(exc, libvirt.libvirtError):
+        return safe_text(exc.get_error_message() or str(exc))[:500]
+    return type(exc).__name__
+
+
+@contextmanager
+def audit(request, compute, subject, action, instance=""):
+    """
+    Write one row when the block ends: done, or failed with the reason when it
+    raises (the exception goes on). The block may set entry.action, or
+    entry.skip when nothing was done.
+    """
+    entry = Entry(action)
+    user, host, ip = request.user.get_username(), host_of(compute), request_ip(request)
+    try:
+        yield entry
+    except Exception as exc:
+        write(user, host, instance, f"{subject}: {entry.action}: {reason(exc, request.user)}", False, ip)
+        raise
+    if not entry.skip:
+        write(user, host, instance, f"{subject}: {entry.action}", True, ip)
+
+
+def failed(request, compute, subject, action, why, instance=""):
+    """Write the failure row of an action that was refused before it started."""
+    write(request.user.get_username(), host_of(compute), instance, f"{subject}: {action}: {why}", False, request_ip(request))
+
+
+def snapshot(obj):
+    """The field values of a model object, for changed_fields; a many-to-many field gives its related pks."""
+    values = {f.attname: getattr(obj, f.attname) for f in obj._meta.concrete_fields}
+    for f in obj._meta.many_to_many:
+        values[f.name] = frozenset(o.pk for o in getattr(obj, f.name).all()) if obj.pk else frozenset()
+    return values
+
+
+def changed_fields(before, after):
+    """The sorted names of the fields whose values differ between two snapshots."""
+    return sorted(key.removesuffix("_id") for key in before if before[key] != after[key])

logs/migrations/0004_audit_fields.py

@@ -0,0 +1,48 @@
+# Generated by Django 5.2.18 on 2026-10-22 13:01
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('logs', '0003_logs_host'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='logs',
+            name='ip',
+            field=models.GenericIPAddressField(null=True, verbose_name='IP address'),
+        ),
+        migrations.AddField(
+            model_name='logs',
+            name='success',
+            field=models.BooleanField(null=True, verbose_name='success'),
+        ),
+        migrations.AlterField(
+            model_name='logs',
+            name='date',
+            field=models.DateTimeField(auto_now_add=True, db_index=True, verbose_name='date'),
+        ),
+        migrations.AlterField(
+            model_name='logs',
+            name='host',
+            field=models.CharField(default='-', max_length=255, verbose_name='host'),
+        ),
+        migrations.AlterField(
+            model_name='logs',
+            name='instance',
+            field=models.CharField(max_length=120, verbose_name='instance'),
+        ),
+        migrations.AlterField(
+            model_name='logs',
+            name='message',
+            field=models.TextField(verbose_name='message'),
+        ),
+        migrations.AlterField(
+            model_name='logs',
+            name='user',
+            field=models.CharField(max_length=150, verbose_name='user'),
+        ),
+    ]

logs/models.py

@@ -1,12 +1,14 @@
-from django.db.models import CharField, DateTimeField, Model
+from django.db.models import BooleanField, CharField, DateTimeField, GenericIPAddressField, Model, TextField
 from django.utils.translation import gettext_lazy as _
 
 class Logs(Model):
-    user = CharField(_("user"), max_length=50)
-    host = CharField(_("host"), max_length=50, default="-")
-    instance = CharField(_("instance"), max_length=50)
-    message = CharField(_("message"), max_length=255)
-    date = DateTimeField(_("date"), auto_now=True)
+    user = CharField(_("user"), max_length=150)
+    host = CharField(_("host"), max_length=255, default="-")
+    instance = CharField(_("instance"), max_length=120)
+    message = TextField(_("message"))
+    date = DateTimeField(_("date"), auto_now_add=True, db_index=True)
+    success = BooleanField(_("success"), null=True)
+    ip = GenericIPAddressField(_("IP address"), null=True)
 
     def __str__(self):
         return self.instance

logs/tests/test_audit.py

@@ -0,0 +1,146 @@
+from unittest import mock
+
+import libvirt
+
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group
+from django.db import IntegrityError, transaction
+from django.test import RequestFactory, TestCase
+
+from computes.models import Compute
+from logs.audit import audit, changed_fields, failed, request_ip, snapshot, write
+from logs.models import Logs
+from logs.views import addlogmsg
+from operations import claims
+from vrtManager.util import OperationError
+
+
+class WriteTests(TestCase):
+    def test_a_row_has_its_fields(self):
+        write("bob", "host1", "", "Compute c: delete", True, "192.0.2.7")
+        row = Logs.objects.get()
+        self.assertEqual((row.user, row.host, row.instance), ("bob", "host1", ""))
+        self.assertEqual(row.message, "Compute c: delete")
+        self.assertIs(row.success, True)
+        self.assertEqual(row.ip, "192.0.2.7")
+
+    def test_long_values_are_cut(self):
+        write("u" * 200, "h" * 300, "i" * 200, "m" * 5000)
+        row = Logs.objects.get()
+        self.assertEqual(len(row.user), 150)
+        self.assertEqual(len(row.host), 255)
+        self.assertEqual(len(row.instance), 120)
+        self.assertEqual(len(row.message), 5000)
+
+    def test_a_failed_write_inside_a_transaction_leaves_it_usable(self):
+        with self.assertLogs("logs.audit", "WARNING") as logs:
+            with transaction.atomic():
+                with mock.patch.object(Logs.objects, "create", side_effect=IntegrityError):
+                    write("bob", "-", "", "msg")
+                get_user_model().objects.create_user("after")
+        self.assertEqual(len(logs.output), 1)
+        self.assertTrue(get_user_model().objects.filter(username="after").exists())
+
+    def test_the_file_line_keeps_one_line(self):
+        with self.assertLogs("logs.audit", "WARNING") as logs:
+            with mock.patch.object(Logs.objects, "create", side_effect=IntegrityError):
+                write("bob", "-", "", "a\nb")
+        self.assertNotIn("\n", logs.records[0].getMessage())
+        self.assertIn("a\\nb", logs.records[0].getMessage())
+
+    def test_a_failing_file_logger_raises_nothing(self):
+        with mock.patch.object(Logs.objects, "create", side_effect=IntegrityError), mock.patch(
+            "logs.audit.logger.warning", side_effect=OSError
+        ):
+            self.assertIsNone(write("bob", "-", "", "msg"))
+
+    def test_ips(self):
+        rf = RequestFactory()
+        self.assertEqual(request_ip(rf.get("/", REMOTE_ADDR="192.0.2.7")), "192.0.2.7")
+        self.assertIsNone(request_ip(rf.get("/", REMOTE_ADDR="127.0.0.1", HTTP_X_REAL_IP="not-an-ip")))
+        self.assertEqual(request_ip(rf.get("/", REMOTE_ADDR="127.0.0.1", HTTP_X_REAL_IP="")), "127.0.0.1")
+        self.assertIsNone(request_ip(rf.get("/", REMOTE_ADDR="127.0.0.1", HTTP_X_REAL_IP="fe80::1%eth0")))
+        self.assertIsNone(request_ip(rf.get("/", REMOTE_ADDR="")))
+
+    def test_addlogmsg_still_writes(self):
+        addlogmsg("u", "h", "vm", "Destroy")
+        row = Logs.objects.get()
+        self.assertEqual((row.user, row.host, row.instance, row.message), ("u", "h", "vm", "Destroy"))
+        self.assertIsNone(row.success)
+        self.assertIsNone(row.ip)
+
+
+class AuditTests(TestCase):
+    def setUp(self):
+        self.user = get_user_model().objects.create_user("bob")
+        self.request = RequestFactory().get("/", REMOTE_ADDR="192.0.2.7")
+        self.request.user = self.user
+        self.compute = Compute(name="c", hostname="192.0.2.5", type=1)
+
+    def row(self):
+        return Logs.objects.get()
+
+    def test_a_block_that_ends_writes_done(self):
+        with audit(self.request, self.compute, "Compute c (192.0.2.5)", "delete"):
+            pass
+        row = self.row()
+        self.assertEqual(row.message, "Compute c (192.0.2.5): delete")
+        self.assertIs(row.success, True)
+        self.assertEqual((row.host, row.user, row.ip), ("c", "bob", "192.0.2.7"))
+
+    def test_a_block_that_raises_writes_failed_and_reraises(self):
+        error = OperationError("in use")
+        with self.assertRaises(OperationError) as caught:
+            with audit(self.request, self.compute, "Compute c", "delete"):
+                raise error
+        self.assertIs(caught.exception, error)
+        row = self.row()
+        self.assertEqual(row.message, "Compute c: delete: in use")
+        self.assertIs(row.success, False)
+
+    def reason_row(self, exc):
+        Logs.objects.all().delete()
+        with self.assertRaises(type(exc)):
+            with audit(self.request, None, "Compute c", "delete"):
+                raise exc
+        return self.row().message
+
+    def test_reasons(self):
+        self.assertEqual(
+            self.reason_row(claims.Busy(None)),
+            "Compute c: delete: A short operation is in progress on this resource; try again in a moment.",
+        )
+        self.assertNotIn("secret", self.reason_row(libvirt.libvirtError("password=secret")))
+        self.assertEqual(self.reason_row(ValueError("<secret/>")), "Compute c: delete: ValueError")
+
+    def test_the_block_sets_the_action_or_skips(self):
+        with audit(self.request, self.compute, "Compute c", "edit") as entry:
+            entry.action = "change hostname"
+        self.assertEqual(self.row().message, "Compute c: change hostname")
+        Logs.objects.all().delete()
+        with audit(self.request, self.compute, "Compute c", "edit") as entry:
+            entry.skip = True
+        self.assertFalse(Logs.objects.exists())
+        with self.assertRaises(ValueError):
+            with audit(self.request, self.compute, "Compute c", "edit") as entry:
+                entry.skip = True
+                raise ValueError
+        self.assertEqual(self.row().message, "Compute c: edit: ValueError")
+        self.assertIs(self.row().success, False)
+
+    def test_failed_writes_a_refusal(self):
+        failed(self.request, None, "Network lab", "create", "Name in use")
+        row = self.row()
+        self.assertEqual(row.message, "Network lab: create: Name in use")
+        self.assertEqual(row.host, "-")
+        self.assertIs(row.success, False)
+
+    def test_changed_fields(self):
+        compute = Compute.objects.create(name="c", hostname="192.0.2.5", type=1, password="pw")
+        before = snapshot(compute)
+        self.assertEqual(changed_fields(before, snapshot(compute)), [])
+        compute.hostname = "192.0.2.6"
+        self.assertEqual(changed_fields(before, snapshot(compute)), ["hostname"])
+        before = snapshot(self.user)
+        self.user.groups.add(Group.objects.create(name="g"))
+        self.assertEqual(changed_fields(before, snapshot(self.user)), ["groups"])

logs/tests/test_login_rows.py

@@ -0,0 +1,51 @@
+"""Logins, failed logins, lockouts and logouts write rows on the Logs page."""
+
+from appsettings.models import AppSettings
+from django.contrib.auth import get_user_model
+from django.test import TestCase, override_settings
+from django.urls import reverse
+
+from logs.models import Logs
+
+
+def rows():
+    return list(Logs.objects.order_by("id").values_list("user", "host", "message", "success", "ip"))
+
+
+@override_settings(OTP_ENABLED=False)
+class LoginRowsTests(TestCase):
+    def setUp(self):
+        get_user_model().objects.create_user("bob", password="right-pass-1")
+        AppSettings.objects.filter(key="LOGIN_FAILURE_LIMIT").update(value="3")
+
+    def login(self, password, username="bob"):
+        return self.client.post(reverse("accounts:login"), {"username": username, "password": password})
+
+    def test_a_login_and_a_logout_write_rows(self):
+        self.assertEqual(self.login("right-pass-1").status_code, 302)
+        self.client.post(reverse("accounts:logout"))
+        self.assertEqual(rows(), [
+            ("bob", "-", "Login", True, "127.0.0.1"),
+            ("bob", "-", "Logout", True, "127.0.0.1"),
+        ])
+
+    def test_a_failed_login_writes_the_typed_username(self):
+        self.assertEqual(self.login("wrong").status_code, 200)
+        self.assertEqual(rows(), [("bob", "-", "Login failed", False, "127.0.0.1")])
+
+    def test_an_empty_username_is_no_attempt(self):
+        # the form stops it before authentication: no row and no error
+        self.assertEqual(self.login("wrong", username="").status_code, 200)
+        self.assertEqual(rows(), [])
+
+    def test_the_attempt_at_the_limit_and_one_while_locked(self):
+        self.login("wrong")
+        self.login("wrong")
+        self.assertEqual(self.login("wrong").status_code, 429)
+        # django-axes sends the lockout from its own failure receiver, before ours
+        messages = [r[2] for r in rows()]
+        self.assertEqual(messages, ["Login failed", "Login failed", "Locked out", "Login failed"])
+
+        self.assertEqual(self.login("right-pass-1").status_code, 429)
+        self.assertEqual([r[2] for r in rows()][4:], ["Locked out", "Login failed"])
+        self.assertTrue(all(r[0] == "bob" and r[3] is False for r in rows()))

logs/views.py

@@ -4,6 +4,7 @@ from django.http import JsonResponse
 
 from admin.decorators import superuser_only
 from instances.models import Instance
+from logs.audit import write
 from logs.models import Logs
 
 
@@ -15,8 +16,7 @@ def addlogmsg(user, host, instance, message):
     :param message:
     :return:
     """
-    add_log_msg = Logs(user=user, host=host, instance=instance, message=str(message))
-    add_log_msg.save()
+    write(user, host, instance, str(message))
     logger = logging.getLogger("")
     logger.info(f"{user} {host} {instance} {message}")