From 3cd61d2a95638fbde8a446694b1d02b4ad86c7e8 Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Sun, 8 Nov 2026 07:11:30 -0500 Subject: [PATCH] docs(audit-sinks): say syslog needs auth server v0.23.1 v0.23.0 refuses syslog sinks until their records carry the registered structured data ID. The CLI keeps the syslog flags and passes the server's refusal on, so no CLI release is needed when v0.23.1 lifts it. Refs fells-code/seamless-auth-api#586 --- .changeset/callout-commands.md | 2 +- src/commands/helpTopics.ts | 2 ++ src/core/adminCallouts.test.ts | 9 +++++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.changeset/callout-commands.md b/.changeset/callout-commands.md index 883916c..83ae2e9 100644 --- a/.changeset/callout-commands.md +++ b/.changeset/callout-commands.md @@ -2,4 +2,4 @@ "seamless-cli": minor --- -Add `seamless webhooks`, `seamless hooks`, `seamless claims` and `seamless audit-sinks` to manage signed webhooks and their deliveries, `post_login` and `pre_token` login hooks, static custom claims, and audit log streaming to OTLP and syslog. Signing secrets are printed once, when they are issued. `hooks set` and `audit-sinks update` change only the settings a flag names, and `claims set` asks before removing a claim. Every command takes `--json`. They need auth server v0.23 or later, and an older instance gets a message saying so. +Add `seamless webhooks`, `seamless hooks`, `seamless claims` and `seamless audit-sinks` to manage signed webhooks and their deliveries, `post_login` and `pre_token` login hooks, static custom claims, and audit log streaming to OTLP and syslog (syslog needs auth server v0.23.1, which v0.23.0 refuses). Signing secrets are printed once, when they are issued. `hooks set` and `audit-sinks update` change only the settings a flag names, and `claims set` asks before removing a claim. Every command takes `--json`. They need auth server v0.23 or later, and an older instance gets a message saying so. diff --git a/src/commands/helpTopics.ts b/src/commands/helpTopics.ts index 8cb28b0..04a4af4 100644 --- a/src/commands/helpTopics.ts +++ b/src/commands/helpTopics.ts @@ -974,6 +974,8 @@ audit-sinks create --kind syslog --host [--port ] [--transport • Both also take [--start-after-seq ] [--disabled] [--json] • otlp posts OTLP/HTTP JSON to /v1/logs. syslog is RFC 5424 over TLS; tcp only outside production + • syslog needs auth server v0.23.1 or later. v0.23.0 refuses it until + its records carry the registered structured data ID • Credentials are never stored: name env vars on the auth server that end in _AUDIT_SINK_SECRET • Starts after the newest event, or replays from --start-after-seq diff --git a/src/core/adminCallouts.test.ts b/src/core/adminCallouts.test.ts index 4b38864..a5930d8 100644 --- a/src/core/adminCallouts.test.ts +++ b/src/core/adminCallouts.test.ts @@ -514,6 +514,15 @@ describe("audit sinks", () => { expect(await message(testAuditSink(client, SINK_ID))).toBe(expected); }); + it("passes on the refusal of a syslog sink by auth server v0.23.0", async () => { + const refusal = + "Syslog audit sinks are not available in this release; they arrive in Seamless Auth 0.23.1. Use an OTLP sink until then."; + const { client } = fakeClient(() => response(400, { error: refusal })); + expect( + await message(createAuditSink(client, { name: "a", settings: syslog, enabled: true })), + ).toBe(`Could not create audit sink (400: ${refusal.slice(0, -1)}).`); + }); + it("reports any other failure on every sink route", async () => { const { client } = fakeClient(() => response(500, null)); expect(await message(listAuditSinks(client))).toBe("Could not list audit sinks (500).");