mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-07-17 23:32:51 -05:00
3a666da860
GET /admin/users returns every user's email address; compliance regimes commonly require admin PII access to be logged, so the list read now emits admin.users.listed. The admin gate additionally emits admin.access.denied (outcome=failure, with method and path) whenever an authenticated user without the instance-admin flag probes an /admin/* route — dispatched directly with the request context since there is no transaction. Both entries have no single affected resource, so the entry target is now omitted when empty instead of serialising a zero value.