Add audit logs for network operations and key usage
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start by examining the existing stellar cache actionlog feature and how its records are stored and displayed. Define the network-operation and key-usage fields, storage location, replacement or migration path, and plain-text and JSON behavior before implementation. Done means successful and failed activity can be persisted and retrieved in the requested formats.
Written by the indexing model from the issue text.
Description
What problem does your feature solve?
When using the CLI over time, there's no persistent record of:
- Network operations - What on-chain operations were performed, on which network, and when
- Key usage - What a key has been used to sign, including transactions and auth invocations
This makes it difficult to:
- Review what transactions were submitted from a machine
- Track how keys are being used across different operations
- Audit signing activity for security or compliance purposes
- Troubleshoot issues ("did I already deploy this?" or "what did I sign with this key?")
Note: There is an existing action log feature at stellar cache actionlog which is essentially an audit log of rpc interactions, but it's not very ergonomic and doesn't surface information in a way that can be easily parsed. This proposal would likely replace the action log.
What would you like to see?
Add audit logs that track CLI activity. Two types of logs could be considered:
1. Network Operations Log
- Timestamp
- Network (testnet, mainnet, etc.)
- Command executed (deploy, invoke, etc.)
- Send vs Simulation
- Transaction hash (if successful)
- Contract ID (if applicable)
- Success/failure status
2. Key Usage Log
- Timestamp
- Key identifier (public key or alias)
- Operation type (transaction signing, auth invocation signing)
- Transaction hash or context
- Network
- What was being authorized (contract, function, etc.)
The audit logs could be stored in a standard location (e.g., ~/.config/stellar/audit/) and support displaying in different output formats (plain text, JSON) for easy parsing.
What alternatives are there?
- Status quo: Users manually track operations or rely on shell history
- External tooling: Use shell wrappers or scripts to log commands
- Block explorer: Look up account history on-chain (doesn't capture failed attempts, local context, or which local key was used)
Related: #2375 (confirmation prompts for mainnet operations)
- Dominant language
- Rust
- Stars
- 123
- Forks
- 141
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 17
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stellar/stellar-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
stellar/stellar-cli#2384 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
stellar/stellar-cli#2347 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
stellar/stellar-cli#2723 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
stellar/stellar-cli#2722 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
stellar/stellar-cli#2703 ·
All issues in stellar/stellar-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100