Audit Manager

The Audit Manager node records incoming flow messages as audit events. Each received message becomes an event selected from an action catalogue (organised by category and event type) and is stored in RethinkDB, with automatic creation of the required database, table and indexes. Optionally, the stored event can also be published to NATS.

Besides storage, the plugin manages the Dashboard SSO session: it verifies the session cookie on every message and stamps the user in msg._client.user, which is the only source of identity for the event. It also adds an "Audit Manager" sidebar in the Node-RED editor with the current user, the storage status and the recent events.

Features

• Catalogue-based audit event selection by category and event type.
• Event storage in RethinkDB with automatic creation of the database, table and indexes.
• Optional publication of the stored events to NATS.
• Payload builder for static values and values read from msg, the flow context (flow) or the global context (global).
• User identity taken exclusively from the Dashboard session (msg._client.user).
• Editor sidebar with the current user, the storage status and the recent audit events.

Configuration

Property	Description	Default
name	Optional node label shown in the editor.	""
defaultAction	Audit action stored for the incoming messages (a value from the event catalogue). Required.	"access_login_success"
defaultCategory	Audit category loaded from the event catalogue. It is derived from the selected action.	"Access"
auditViewerEnabled	Enables or disables storage in RethinkDB.	true
auditViewerHost	RethinkDB host. When blank it uses RDB_HOST or 127.0.0.1.	""
auditViewerPort	RethinkDB port. When blank it uses RDB_PORT or 28015.	""
auditViewerDb	Database. When blank it uses RDB_DB or audit.	""
auditViewerTable	Audit event table. When blank it uses audit_events.	""
natsEnabled	Enables or disables publication of events to NATS.	false
natsUrl	NATS URL. When blank it uses NATS_URL or nats://127.0.0.1:4222.	""
natsSubject	NATS subject. When blank it uses NATS_AUDIT_SUBJECT or audit.	""
payloadParams	List of fields added to the event payload by the payload builder.	[]

Blank RethinkDB fields use the environment defaults:

RDB_HOST=127.0.0.1
RDB_PORT=28015
RDB_DB=audit

Blank NATS fields use the environment defaults:

NATS_URL=nats://127.0.0.1:4222
NATS_AUDIT_SUBJECT=audit
NATS_ENABLED=true

Publication to NATS is skipped when no URL is configured or when NATS_ENABLED=false.

Each row of the payload builder accepts the value types str, num, bool, msg, flow and global.

Input

The node has 1 input and accepts any message. The event identity is read from msg._client.user (stamped by the plugin on every Dashboard message); the persisted payload is built solely from the fields declared in the node's payload builder.

The payload builder can read dynamic values according to the type configured on each row. For the dynamic types, the row value is the path the value is read from:

Type	Value source	Example path
msg	The incoming message.	payload.batchId
flow	The flow context.	currentBatch.id
global	The global context.	siteConfig.lineId

Output

The node has 1 output. It forwards the original message once the audit event has been stored, adding the stored event in msg.audit. All audit events share the same schema:

msg.audit = {
  actionId: "session_batch_start",
  actionType: "session",
  roleId: "prof-operator",
  source: "node-red-flow",
  timestamp: "2026-07-15T10:00:00.000Z",
  userId: "operator@rosepetal.ai",
  payload: {
    batchId: "BATCH-001"
  }
};

userId is the email of the session user and roleId their profileId; both are null when the message does not come from a Dashboard client.

Usage example

To record the start of a production batch, connect a Dashboard widget (for example, a button) to the Audit Manager node. In the node, select the category Session and the event type Batch start (session_batch_start), and add one row in the payload builder:

• Type: msg
• Value: payload.batchId
• Field: batchId

When the operator presses the button, the node takes the user from msg._client.user, stores the audit event in RethinkDB (and publishes it to NATS if enabled) and forwards the message with the event in msg.audit. The resulting event becomes available in the editor's "Audit Manager" sidebar and in the audit viewer.