Notifications & Audit Trail

Muljax ID captures security and administrative activity across sessions, SSH certificate issuance, and user lifecycle events.

Real-Time Notification System

The platform includes an event emission engine backed by the notifications table in Cloudflare D1.

Target Audiences

Audience Channel	Target Scope	Description
user	User-Specific	Targeted alerts delivered to a specific user account (e.g., password changed, passkey enrolled, certificate issued).
admins	Administrators	High-priority security alerts broadcast to all administrators (e.g., bootstrap secret claimed, user suspended).
all	Tenant-Wide	Broadcast announcements delivered to all active tenant accounts.

Categories & Severities

• Categories: security, auth, admin, general, system.
• Severities: info success warning danger

Real-Time Streaming (/api/notifications/stream)

The dashboard connects to a persistent Server-Sent Events (SSE) stream (GET /api/notifications/stream) to receive live alerts and toast notifications without requiring WebSocket servers or polling.

---

Forensic Audit Trails

In addition to notifications, sensitive actions record forensic metadata:

1. SSH Certificate Ledger (ssh_certificates)

Every issued certificate records:

• Serial Number: Monotonically generated uint64 identifier string.
• Key ID & Principals: User identity and authorized server usernames.
• Client Network Info: Originating IP address (client_ip) and User-Agent (user_agent).
• Validity Window: Exact epoch second timestamps (valid_after, valid_before).
• Revocation Ledger: When revoked, persists revoked_at, revoked_by (admin user ID), and the explicit revoked_reason.

2. Session Tracking (sessions)

Active sessions capture:

• IP & Geolocation: Client IP, country code, city, and region derived from Cloudflare Edge request headers (cf-ipcountry, cf-region, cf-ipcity).
• Client Environment: Parsed operating system and browser name.
• Last Used Timestamp: Updated on every authenticated request to detect dormant sessions.