The SveltyCMS user management system is a secure and comprehensive interface for both personal profile management and site-wide administration. It provides a clear separation between a user’s own settings and the powerful tools available to administrators for managing all users and registration tokens.

The system includes enterprise-grade audit logging that tracks all security-critical events across the entire CMS platform, ensuring compliance and forensic capabilities.

This document outlines the architecture and key components of the current system.

Core Components

The user management experience is built from several distinct, high-performance Svelte 5 components, each with a specific responsibility.

1. User Profile Page (+page.svelte)

This is the main view for an authenticated user. It serves three primary functions:

• Profile Display: Shows the user’s avatar, username, email, role, and unique ID in a two-column layout.
• Personal Settings: Allows the user to edit their own profile information (via modal-edit-form.svelte) and change their avatar (via modal-edit-avatar.svelte).
• Security Management: Contains modal components for managing Two-Factor Authentication (2FA) settings.

2. Admin Area (admin-area.svelte)

This powerful component is conditionally rendered at the bottom of the page for users with the appropriate permissions. It is the central hub for site-wide user and token administration.

• Functionality: Provides a unified table interface to view, search, filter, and perform batch actions (delete, block, unblock) on all users or registration tokens in the system.
• Performance Optimized: The system has been optimized to remove server-side pre-loading of all users and tokens, improving initial page load performance.

3. Two-Factor Authentication (two-factor-setup-modal.svelte / two-factor-verify-modal.svelte)

Security is enhanced through an integrated TOTP-based 2FA system. These modal components are displayed on the user page, allowing users to:

• Enable 2FA: Guides the user through a standard setup process involving QR code scanning and verification.
• Manage Backup Codes: Generate and view recovery codes for use if their authenticator device is lost.
• Disable 2FA: Securely turn off two-factor authentication by providing a valid TOTP code.

4. Audit Log System (AuditService)

An enterprise-grade audit logging service tracks all security-critical events across the entire CMS platform:

• Comprehensive Event Tracking: Monitors 20 different event types including authentication, user management, data operations, workflow transitions, and security events

• Severity Classification: Events are classified as low, medium, high, or critical severity for proper alerting

• System-Wide Coverage: Tracks actions across all CMS components, not just user management:

  • User Actions: Login attempts, profile changes, role modifications
  • Content Management: Collection operations, data exports/imports, content deletion
  • Security Events: Unauthorized access attempts, privilege escalation, suspicious activity
  • Workflow & System: Webhook triggers, password reset flows

• Database Agnostic: Uses the SveltyCMS database interface for compatibility across different database systems

• Performance Optimized: Minimal overhead with asynchronous logging and automatic cleanup policies

Security Architecture & Data Flow

The system is protected by a multi-layered security model orchestrated by server hooks and dedicated API endpoints, with comprehensive audit logging ensuring full traceability.

Server Hooks

All requests to the user page or its associated APIs pass through a security pipeline that enforces:

1. Rate Limiting: Prevents brute-force and denial-of-service attacks (via handle-security.ts).
2. Authentication: Verifies the user’s session is valid (via handle-authentication.ts).
3. Authorization: Checks if the user’s role has the necessary permissions (via handle-authorization.ts).
4. Audit Logging: All security-critical events are automatically logged (via handle-audit-logging.ts).

API Endpoints

User management actions are executed via a suite of secure, tenant-aware REST API endpoints. Key endpoints include:

• /api/user/batch: Performs bulk actions like deleting, blocking, or unblocking users.
• /api/auth/update-user-attributes: Updates a user’s profile information.
• /api/auth/save-avatar: Handles avatar image uploads (multipart + JSON).
• /api/auth/2fa/...: Manages all two-factor authentication flows (setup, enable, verify, disable, backup codes).

All API endpoints automatically log relevant audit events when operations are performed.

Audit Log Visibility & Access

The audit logging system is designed for system-wide monitoring, not just user actions:

For Administrators

• Security Dashboard: Access to comprehensive audit statistics, suspicious activity detection, and trend analysis
• Full Audit Trail: View all security events across the entire CMS platform including:
  • User authentication and management events
  • Collection and content operations
  • Security incidents and suspicious activities
• Advanced Filtering: Query logs by event type, severity, user, time range, and target resources
• Export Capabilities: Download audit reports for compliance and external analysis

For Regular Users

• Personal Activity Log: View their own authentication events, profile changes, and account security activities
• Security Notifications: Alerts for suspicious activities on their account (failed logins, unusual access patterns)
• Limited Scope: Users can only see audit events directly related to their own account

System Integration

• Real-time Monitoring: High-severity events trigger immediate alerts to administrators
• Compliance Reporting: Automated generation of audit reports for regulatory requirements
• Forensic Analysis: Detailed event correlation for security incident investigation
• Performance Monitoring: Audit system performance metrics and automatic cleanup policies

Current Data Flow Diagram

The diagram below illustrates the optimized data flow with audit logging integration:

Audit Logging Implementation

The audit logging system provides comprehensive tracking of all security-critical events across the SveltyCMS platform.

Event Categories

The system tracks 20 event types organized into key categories:

Authentication Events

• USER_LOGIN, USER_LOGOUT, USER_LOGIN_FAILED
• PASSWORD_CHANGE, PASSWORD_RESET
• PASSWORD_RESET_REQUESTED, PASSWORD_RESET_SUCCESS

User Management Events

• USER_CREATED, USER_UPDATED, USER_DELETED
• USER_ROLE_CHANGED

Data Operations

• DATA_EXPORT, DATA_IMPORT, DATA_DELETION

Workflow & System Events

• WORKFLOW_TRANSITION, WEBHOOK_TRIGGERED

Security Events

• UNAUTHORIZED_ACCESS, PRIVILEGE_ESCALATION
• SUSPICIOUS_ACTIVITY

Usage Examples

import { auditLogService, AuditEventType } from "@src/services/security/audit-service";

// Log a successful user login
await auditLogService.log(
  "User successfully logged in",
  { id: user._id, email: user.email, role: user.role, ip: requestIp },
  { type: "user", id: user._id },
  AuditEventType.USER_LOGIN,
  "low",
  { loginMethod: "email" },
  tenantId,
  "success",
);

// Log a failed privilege escalation attempt
await auditLogService.log(
  "Attempted to access admin-only resource",
  { id: user._id, email: user.email, role: user.role, ip: requestIp },
  { type: "admin", id: null },
  AuditEventType.PRIVILEGE_ESCALATION,
  "critical",
  { requestedResource: "/admin/users" },
  tenantId,
  "failure",
);

// Log a collection data export
await auditLogService.log(
  `Exported ${collectionName} collection data`,
  { id: user._id, email: user.email, ip: requestIp },
  { type: "collection", id: collectionId },
  AuditEventType.DATA_EXPORT,
  "medium",
  { format: "json", recordCount },
  tenantId,
);

Integration Points

The audit logging system is automatically integrated at key points throughout the CMS:

• Authentication Hooks: All login/logout events (via handle-authentication.ts)
• API Endpoints: User management, token operations, data operations (via handle-api-requests.ts)
• Collection Operations: Content creation, updates, deletions
• Security Middleware: Unauthorized access attempts, rate limiting violations (via handle-security.ts)
• Administrative Actions: Role changes, user management, system configuration

✅ Implemented Features

3 of 5 planned improvements now live via src/services/security/monitoring-service.ts — 5 anomaly detection rules (brute force, access patterns, escalation, session fixation, token abuse), SOC2/GDPR/ISO27001 compliance reports, and SIEM webhooks (JSON/CEF/LEEF).

• ✅ Advanced Analytics — anomaly detection with configurable thresholds
• ✅ Compliance Reports — automated report generation
• ✅ Integration APIs — SIEM webhook support
• Real-time Audit Dashboard widget (planned)
• Push notifications (planned)

1. Real-time Audit Dashboard: Live monitoring of security events with alerting
2. Advanced Analytics: Trend analysis, anomaly detection, and predictive security
3. Compliance Reports: Automated generation of audit reports for regulatory requirements
4. Integration APIs: Webhook support for external security information and event management (SIEM) systems
5. Mobile Notifications: Push notifications for critical security events

Performance Considerations

The audit logging system is designed for minimal performance impact:

• Asynchronous Processing: All audit events are logged asynchronously
• Batch Operations: Multiple events can be logged in batches for efficiency
• Automatic Cleanup: Configurable retention policies prevent unlimited log growth
• Database Optimization: Proper indexing ensures fast querying and aggregation
• Error Resilience: Audit logging failures never impact main application functionality

Conclusion

The SveltyCMS user management system provides a robust, secure, and scalable foundation for both personal profile management and enterprise-grade administration. With integrated audit logging, the system ensures comprehensive visibility into all security-critical events while maintaining optimal performance and user experience.

Related

• Architecture Overview
• Security Overview
• State Management