#1124 CLI follow-ups: DB-mode audit, settings patch tests, env cache notes Pull request opened by javuto CLI follow-ups: DB-mode audit, settings patch tests, env cache notes Problem • In

--db

mode,

env node-actions

extend/expire/notexpire for enroll and remove wrote no audit entry, while the API writes one. The shell's DB store also skipped the audit line for rotate. •

SettingPatchHandler

had no handler tests. • DB-mode CLI edits to an environment cannot invalidate the Redis environment cache, and nothing told operators. Change • Audit: the six extend/expire/notexpire commands (enroll and remove) now write an audit entry on success, with the same text as the API (

<action> enrollment|removal for environment <name>

, source

CLI

).

dbStore.EnvAction

in the shell audits every action, rotate included. • Tests: new

TestSettingPatchHandler

(15 cases): 404 missing setting, 400 for type mismatch on each type, 400 malformed body, 403 non-admin, range boundaries for

api/inactive_hours

and

api/audit_log_retention_days

, and success per type. The handler is unchanged. • Docs: the

--db

flag help, `env update`/`env delete` help, the env config commands and

ARCHITECTURE.md

now say that DB-mode edits cannot invalidate the shared cache key

osctrl:tls:environment:<uuid>

. The old environment can be served for up to 5 minutes, or 60 while the database is degraded. API mode invalidates immediately. Invalidation is not implemented. Security / operational impact • Closes an audit gap for enrollment/removal link changes made through the CLI in DB mode. • No API, schema or runtime behaviour change. Validation •

go test ./cmd/cli/... ./cmd/api/... ./pkg/... -count=1

,

go vet ./...

,

gofmt

,

golangci-lint

,

make openapi-check

. • Audit parity:

TestEnvFlagsAndRotateAuditParity

extended to the six actions and seen failing before the change. • The settings tests describe existing behaviour and passed on first run. • Not covered: the shell

dbStore.EnvAction

audit line has no test of its own. jmpsec/osctrl