From 991e17fcee150f100875a0cbcdbd40c6f599f735 Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sun, 14 Jun 2026 22:49:31 +0200
Subject: [PATCH] fix(tls): audit TLS-mode changes in applyTlsMode (covers
 direct Livewire calls, no double-audit)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/Livewire/System/Index.php       | 13 +++++++++++--
 tests/Feature/TlsModeToggleTest.php | 13 +++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/System/Index.php b/app/Livewire/System/Index.php
index 4066f1f..98f59fa 100644
--- a/app/Livewire/System/Index.php
+++ b/app/Livewire/System/Index.php
@@ -2,8 +2,10 @@
 
 namespace App\Livewire\System;
 
+use App\Models\AuditEvent;
 use App\Models\Setting;
 use App\Services\DeploymentService;
+use Illuminate\Support\Facades\Auth;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\On;
 use Livewire\Component;
@@ -173,8 +175,6 @@ class Index extends Component
                 'confirmLabel' => __('system.change_tls_confirm'),
                 'danger' => true,
                 'icon' => 'shield',
-                'auditAction' => 'system.settings_updated',
-                'auditTarget' => 'tls_mode='.$mode,
                 'event' => 'tlsModeChanged',
                 'params' => ['mode' => $mode],
                 'notify' => '',
@@ -191,6 +191,15 @@ class Index extends Component
 
         $deployment->setTlsMode($mode);
         $this->tlsMode = $mode;
+
+        AuditEvent::create([
+            'user_id' => Auth::id(),
+            'actor' => Auth::user()?->name ?? 'system',
+            'action' => 'system.settings_updated',
+            'target' => 'tls_mode='.$mode,
+            'ip' => request()->ip(),
+        ]);
+
         $this->restartPending = true;
         $this->dispatch('notify', message: __('system.tls_saved_notify'));
     }
diff --git a/tests/Feature/TlsModeToggleTest.php b/tests/Feature/TlsModeToggleTest.php
index e8e2aff..aa88867 100644
--- a/tests/Feature/TlsModeToggleTest.php
+++ b/tests/Feature/TlsModeToggleTest.php
@@ -35,4 +35,17 @@ class TlsModeToggleTest extends TestCase
 
         $this->assertFalse(app(DeploymentService::class)->externalTls());
     }
+
+    public function test_applying_a_mode_writes_an_audit_event(): void
+    {
+        $this->actingAs(User::factory()->create(['must_change_password' => false]));
+
+        Livewire::test(Index::class)
+            ->call('applyTlsMode', 'external', app(DeploymentService::class));
+
+        $this->assertDatabaseHas('audit_events', [
+            'action' => 'system.settings_updated',
+            'target' => 'tls_mode=external',
+        ]);
+    }
 }