per user log management

templates/logs.html

@@ -20,7 +20,7 @@
                 </button>
                 <button class="btn btn-outline-danger" onclick="confirmDeleteAllLogs()">
                     <i data-feather="trash-2" class="me-1"></i>
-                    Delete All
+                    {% if current_user and current_user.username == 'admin' %}Delete All Logs{% else %}Delete My Logs{% endif %}
                 </button>
             </div>
         </div>
@@ -179,22 +179,22 @@
             <div class="modal-header">
                 <h5 class="modal-title text-danger">
                     <i data-feather="alert-triangle" class="me-2"></i>
-                    Delete All Logs
+                    {% if current_user and current_user.username == 'admin' %}Delete All Logs{% else %}Delete My Logs{% endif %}
                 </h5>
                 <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
             </div>
             <div class="modal-body">
-                <p>Are you sure you want to delete <strong>all logs</strong>? This action cannot be undone.</p>
+                <p>Are you sure you want to delete {% if current_user and current_user.username == 'admin' %}<strong>all logs</strong>{% else %}<strong>all your logs</strong>{% endif %}? This action cannot be undone.</p>
                 <div class="alert alert-danger">
                     <i data-feather="alert-circle" class="me-2"></i>
-                    This will permanently delete all system logs from the database.
+                    This will permanently delete {% if current_user and current_user.username == 'admin' %}all system logs{% else %}all your logs{% endif %} from the database.
                 </div>
             </div>
             <div class="modal-footer">
                 <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                 <button type="button" class="btn btn-danger" onclick="deleteAllLogs()">
                     <i data-feather="trash-2" class="me-1"></i>
-                    Delete All Logs
+                    {% if current_user and current_user.username == 'admin' %}Delete All Logs{% else %}Delete My Logs{% endif %}
                 </button>
             </div>
         </div>

todo.md

@@ -2,9 +2,8 @@ Analyze use cases:
 
 
 What is the value to be extracted from the UX?
-- Just management and tracking of the attestation store, not a webapp
-- Show policy results
-- Show product table with policy result tags
+- Just management and tracking of the attestation store, not a webapp: **Done**
+- Show policy results, Show product table with policy result tags
 - SBOM app: search, vulns, etc.
 - Discovery app
 - verify signature + support PKI
@@ -16,4 +15,5 @@ Tasks:
 - Fix attestation table: let choose labels/context fields to use. Show the whole Json of the attestation in a JSON viewer
 - Implement/Fix deduplication
 - download attestation: preserve file name if possible (for UX generated)
-- Webhooks/attestation datamodel: add link for downloading the attestation from the app (better --> in data model)
+- Webhooks/attestation datamodel: add link for downloading the attestation from the app (better --> in data model) - **No need, we have the ID and there is the evidence API**
+- Remove filter automatically logs: don't show app logs in the UI (post and get logs)

web/routes.py

@@ -243,6 +243,11 @@ def logs():
 
     # Build query
     query = SystemLog.query
+    
+    # Filter by user_id unless user is admin
+    user_id = session['user_id']
+    if not is_admin_user_web(user_id):
+        query = query.filter(SystemLog.user_id == user_id)
 
     if severity:
         try:
@@ -325,9 +330,18 @@ def log_detail(log_id):
     """Return a single log entry as JSON by ID"""
     if 'user_id' not in session:
         return jsonify({'error': 'Unauthorized'}), 401
+    
+    user_id = session['user_id']
+    is_admin = is_admin_user_web(user_id)
+    
+    # Get the log
     log = SystemLog.query.get(log_id)
     if not log:
         return jsonify({'error': 'Log not found'}), 404
+    
+    # Check if user has permission to view this log
+    if not is_admin and log.user_id != user_id:
+        return jsonify({'error': 'You do not have permission to view this log'}), 403
     def log_to_dict(log):
         return {
             "id": log.id,
@@ -354,27 +368,44 @@ def log_stats():
     if 'user_id' not in session:
         return redirect(url_for('web.login'))
     
+    user_id = session['user_id']
+    is_admin = is_admin_user_web(user_id)
+    
     try:
+        # Base queries - filter by user_id unless admin
+        base_query = SystemLog.query
+        if not is_admin:
+            base_query = base_query.filter_by(user_id=user_id)
+        
         # Get log counts by severity
         severity_stats = db.session.query(
             SystemLog.severity,
             db.func.count(SystemLog.id).label('count')
-        ).group_by(SystemLog.severity).all()
+        )
+        if not is_admin:
+            severity_stats = severity_stats.filter(SystemLog.user_id == user_id)
+        severity_stats = severity_stats.group_by(SystemLog.severity).all()
         
         # Get log counts by event type
         event_stats = db.session.query(
             SystemLog.event_type,
             db.func.count(SystemLog.id).label('count')
-        ).group_by(SystemLog.event_type).limit(10).all()
+        )
+        if not is_admin:
+            event_stats = event_stats.filter(SystemLog.user_id == user_id)
+        event_stats = event_stats.group_by(SystemLog.event_type).limit(10).all()
         
         # Get log counts by app name
         app_stats = db.session.query(
             SystemLog.app_name,
             db.func.count(SystemLog.id).label('count')
-        ).group_by(SystemLog.app_name).limit(10).all()
+        )
+        if not is_admin:
+            app_stats = app_stats.filter(SystemLog.user_id == user_id)
+        app_stats = app_stats.group_by(SystemLog.app_name).limit(10).all()
         
         # Total logs
-        total_logs = SystemLog.query.count()
+        total_logs = base_query.count()
         
         return jsonify({
             'total_logs': total_logs,
@@ -395,20 +426,29 @@ def log_stats():
 @web_bp.route('/ux/logs/delete', methods=['POST'])
 @login_required
 def delete_logs():
-    """Delete all logs endpoint"""
+    """Delete logs endpoint"""
     if 'user_id' not in session:
         return jsonify({'error': 'Unauthorized'}), 401
     
+    user_id = session['user_id']
+    is_admin = is_admin_user_web(user_id)
+    
     try:
-        # Delete all logs
-        count = SystemLog.query.delete()
+        # Delete logs - if admin delete all, otherwise only user's logs
+        if is_admin:
+            count = SystemLog.query.delete()
+            message = f"All logs deleted by admin (count: {count})"
+        else:
+            count = SystemLog.query.filter_by(user_id=user_id).delete()
+            message = f"User logs deleted by user (count: {count})"
+        
         db.session.commit()
         
         log_event(
             severity=6,
-            message=f"All logs deleted by user (count: {count})",
+            message=message,
             event_type="logs_deleted",
-            user_id=session.get('user_id'),
+            user_id=user_id,
             source_ip=request.remote_addr
         )
         
@@ -424,7 +464,7 @@ def delete_logs():
             severity=3,
             message=f"Failed to delete logs: {str(e)}",
             event_type="delete_logs_error",
-            user_id=session.get('user_id')
+            user_id=user_id
         )
         return jsonify({'error': str(e)}), 500
 
@@ -438,6 +478,9 @@ def status():
     # Get system information
     config = current_app.config.get('STORAGE_CONFIG')
     
+    user_id = session['user_id']
+    is_admin = is_admin_user_web(user_id)
+    
     stats = {
         'storage_type': config.STORAGE_TYPE if config else 'Unknown',
         'total_users': User.query.count(),
@@ -446,8 +489,12 @@ def status():
         'total_logs': SystemLog.query.count(),
     }
     
-    # Get recent activity
-    recent_logs = SystemLog.query.order_by(
+    # Get recent activity - filter by user unless admin
+    log_query = SystemLog.query
+    if not is_admin:
+        log_query = log_query.filter_by(user_id=user_id)
+    
+    recent_logs = log_query.order_by(
         SystemLog.timestamp.desc()
     ).limit(10).all()