From 284e75ddb3ce0a517e65c79612d3df1845200e3e Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Wed, 30 Sep 2026 16:13:51 +0200
Subject: [PATCH] Log occ commands for the audit trail

Commands run through the terminal were only logged at debug level, and
admin_audit skipped them because the console request carried no command
in argv. Pass the command as argv so admin_audit records the full
command the way it does for occ on the command line, and log the
command name with the user as a warning, like the SQL mode does for
queries. The regular log gets only the name, because arguments can hold
secrets (config:system:set --value=...).
---
 lib/Controller/OccController.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/Controller/OccController.php b/lib/Controller/OccController.php
index 426a97f..b3d7515 100644
--- a/lib/Controller/OccController.php
+++ b/lib/Controller/OccController.php
@@ -114,7 +114,15 @@ class OccController extends Controller
   public function cmd($command)
   {
     if ($err = $this->requireAdmin()) return $err;
-    $this->logger->debug($command);
+    // The regular log gets only the command name: arguments can hold
+    // secrets (config:system:set --value=...). The full command goes to
+    // admin_audit through the ConsoleEvent, like occ on the CLI.
+    $this->logger->warning('[extended_occweb] occ command by {user}: {command}', [
+      'app' => 'extended_occweb',
+      'user' => $this->userId,
+      'command' => strtok(trim((string) $command), " \t\n") ?: '(empty)',
+    ]);
+    $this->fakeRequest->server['argv'] = ['occ', $command];
     $input = new StringInput($command);
     $response = $this->run($input);
     $this->logger->debug($response);