Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/api/v1/admin.py

@@ -15,13 +15,14 @@ from app.core.security import get_client_ip
 from app.db.session import get_db
 from app.models.user import User
 from app.repositories.unban_request_repository import UnbanRequestRepository
+from app.schemas.auth import RequirePasswordChangeRequest
 from app.schemas.unban import (
     BanIpRequest,
     IpBanResponse,
     UnbanRequestPayload,
     UnbanRequestResponse,
 )
-from app.services import unban_service
+from app.services import auth_service, unban_service
 
 router = APIRouter(tags=["admin"])
 
@@ -89,3 +90,20 @@ async def reject_unban_request(
     _admin: User = Depends(require_admin),
 ) -> None:
     await unban_service.reject_unban_request(db, request_id)
+
+
+@router.post("/admin/users/require-password-change", status_code=status.HTTP_204_NO_CONTENT)
+async def require_password_change(
+    request: Request,
+    payload: RequirePasswordChangeRequest,
+    settings: Settings = Depends(get_settings),
+    db: AsyncSession = Depends(get_db),
+    _admin: User = Depends(require_admin),
+) -> None:
+    """Flags an account (by email) so its next request is blocked
+    everywhere except /auth/me, /auth/change-password, and /auth/logout
+    until they set a new password - see app.auth.dependencies.get_current_user
+    and app.services.auth_service.require_password_change. Meant for handing
+    a demo account to someone with a known sample password."""
+    client_ip = get_client_ip(request, settings)
+    await auth_service.require_password_change(db, client_ip, payload.email)

apps/api/app/api/v1/auth.py

@@ -14,7 +14,9 @@ from app.core.security import get_client_ip, is_localhost
 from app.db.session import get_db
 from app.models.user import LOCAL_DEV_USER_ID, User
 from app.schemas.auth import (
+    ChangePasswordRequest,
     ConfirmPasswordResetRequest,
+    DeleteAccountRequest,
     LoginRequest,
     LogoutRequest,
     RefreshRequest,
@@ -166,3 +168,24 @@ async def me(user: User = Depends(get_current_user)) -> MeResponse:
     effective_auth_mode = "local" if user.id == LOCAL_DEV_USER_ID else "jwt"
     base = UserResponse.model_validate(user).model_dump()
     return MeResponse(**base, auth_mode=effective_auth_mode)
+
+
+@router.delete("/me", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_account(
+    payload: DeleteAccountRequest,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+) -> None:
+    await auth_service.delete_account(db, user, payload.password)
+
+
+@router.post("/change-password", response_model=TokenResponse)
+async def change_password(
+    request: Request,
+    payload: ChangePasswordRequest,
+    settings: Settings = Depends(get_settings),
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+) -> TokenResponse:
+    client_ip = get_client_ip(request, settings)
+    return await auth_service.change_password(db, settings, client_ip, user, payload)

apps/api/app/api/v1/db_viewer.py

@@ -68,8 +68,10 @@ async def create_db_viewer_session(
 
 @router.get("/bootstrap")
 async def bootstrap_db_viewer_session(
+    request: Request,
     token: str = Query(...),
     settings: Settings = Depends(get_settings),
+    db: AsyncSession = Depends(get_db),
 ) -> RedirectResponse:
     """Reached only via Nginx's db.<domain> /_auth location - never called
     directly by the frontend. No `require_admin` dependency: the bootstrap
@@ -82,8 +84,24 @@ async def bootstrap_db_viewer_session(
             status_code=status.HTTP_403_FORBIDDEN, detail="Invalid or expired token"
         ) from exc
 
+    # Logged here, not at /session mint time, because this is the point the
+    # admin's browser actually completes the hand-off into Adminer - minting
+    # a token only proves they clicked the button, not that they got in.
+    await UserSecurityEventRepository(db).create(
+        user_id=decoded.user_id,
+        event_type=SecurityEventType.DB_VIEWER_ACCESSED,
+        ip_address=get_client_ip(request, settings),
+    )
+    await db.commit()
+
     session_token = create_db_viewer_session_token(decoded.user_id, settings)
-    response = RedirectResponse(url="/", status_code=status.HTTP_302_FOUND)
+    # Adminer's own driver dropdown defaults to MySQL, not Postgres - a bare
+    # "/" redirect leaves it selecting MySQL against a host that only speaks
+    # Postgres, producing a "Connection refused" error that has nothing to
+    # do with this app's own auth. `?pgsql=postgres` pre-selects the right
+    # driver and server (the internal Compose service name, same in dev and
+    # prod) - only the Postgres password itself is left for the admin to type.
+    response = RedirectResponse(url="/?pgsql=postgres", status_code=status.HTTP_302_FOUND)
     response.set_cookie(
         SESSION_COOKIE_NAME,
         session_token,

apps/api/app/auth/dependencies.py

@@ -29,6 +29,15 @@ from app.models.user import User
 from app.repositories.user_repository import UserRepository
 from app.services.auth_service import get_or_create_local_user
 
+# Everything an account with must_change_password=True can still reach -
+# just enough to discover the flag (/me), fix it (/change-password), and
+# bail out (/logout, which doesn't even route through get_current_user but
+# is listed for clarity). Every other endpoint 403s until they change it -
+# see app.services.auth_service.require_password_change.
+_PASSWORD_CHANGE_EXEMPT_PATHS = frozenset(
+    {"/api/v1/auth/me", "/api/v1/auth/change-password", "/api/v1/auth/logout"}
+)
+
 
 async def get_current_user(
     request: Request,
@@ -58,6 +67,11 @@ async def get_current_user(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid or expired access token",
         )
+    if user.must_change_password and request.url.path not in _PASSWORD_CHANGE_EXEMPT_PATHS:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Password change required",
+        )
     return user
 
 

apps/api/app/models/enums.py

@@ -154,6 +154,9 @@ class SecurityEventType(StrEnum):
     SERVER_SECRET_UPDATED = "server_secret_updated"
     API_KEY_UPDATED = "api_key_updated"
     DB_VIEWER_SESSION_CREATED = "db_viewer_session_created"
+    DB_VIEWER_ACCESSED = "db_viewer_accessed"
+    PASSWORD_CHANGED = "password_changed"
+    PASSWORD_CHANGE_REQUIRED = "password_change_required"
 
 
 class ApiKeyProvider(StrEnum):

apps/api/app/models/user.py

@@ -42,6 +42,12 @@ class User(Base, UUIDPrimaryKeyMixin, TimestampMixin):
     failed_login_count: Mapped[int] = mapped_column(Integer, default=0)
     locked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
+    # Admin-forced reset (e.g. before handing a demo account to someone) -
+    # see app.auth.dependencies.get_current_user, which blocks every
+    # endpoint except /auth/me, /auth/change-password, and /auth/logout
+    # while this is true.
+    must_change_password: Mapped[bool] = mapped_column(Boolean, default=False)
+
     refresh_tokens: Mapped[list[RefreshToken]] = relationship(
         back_populates="user", cascade="all, delete-orphan"
     )

apps/api/app/repositories/user_repository.py

@@ -23,6 +23,13 @@ class UserRepository:
         result = await self.db.execute(select(User.email).where(User.is_admin.is_(True)))
         return list(result.scalars().all())
 
+    async def delete(self, user: User) -> None:
+        """Cascades (ON DELETE CASCADE, see migrations) to every row the
+        user owns - companies and everything under them, refresh tokens,
+        security events, etc. Irreversible."""
+        await self.db.delete(user)
+        await self.db.flush()
+
     async def create(
         self,
         *,

apps/api/app/schemas/auth.py

@@ -73,6 +73,24 @@ class ConfirmPasswordResetRequest(BaseModel):
         return _validate_password_strength(value)
 
 
+class DeleteAccountRequest(BaseModel):
+    password: str = Field(min_length=1, max_length=128)
+
+
+class ChangePasswordRequest(BaseModel):
+    current_password: str = Field(min_length=1, max_length=128)
+    new_password: str = Field(min_length=10, max_length=128)
+
+    @field_validator("new_password")
+    @classmethod
+    def _password_strength(cls, value: str) -> str:
+        return _validate_password_strength(value)
+
+
+class RequirePasswordChangeRequest(BaseModel):
+    email: EmailStr
+
+
 class SecurityEventResponse(BaseModel):
     event_type: str
     ip_address: str

apps/api/app/schemas/user.py

@@ -14,6 +14,7 @@ class UserResponse(BaseModel):
     timezone: str
     is_active: bool
     is_admin: bool
+    must_change_password: bool
 
 
 class MeResponse(UserResponse):

apps/api/app/services/auth_service.py

@@ -13,7 +13,13 @@ from datetime import UTC, datetime, timedelta
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.config import Settings
-from app.core.errors import AuthenticationError, ConflictError, ThrottledError, ValidationAppError
+from app.core.errors import (
+    AuthenticationError,
+    ConflictError,
+    NotFoundError,
+    ThrottledError,
+    ValidationAppError,
+)
 from app.core.security import (
     InvalidTokenError,
     TokenType,
@@ -37,6 +43,7 @@ from app.repositories.user_known_ip_repository import UserKnownIpRepository
 from app.repositories.user_repository import UserRepository
 from app.repositories.user_security_event_repository import UserSecurityEventRepository
 from app.schemas.auth import (
+    ChangePasswordRequest,
     ConfirmPasswordResetRequest,
     LoginRequest,
     RegisterRequest,
@@ -426,3 +433,75 @@ async def list_security_events(db: AsyncSession, user_id: uuid.UUID) -> list[Use
     """The calling user's own security activity - the user-facing
     counterpart to the admin-only app-wide log feed (core/logging.py)."""
     return await UserSecurityEventRepository(db).list_for_user(user_id)
+
+
+async def delete_account(db: AsyncSession, user: User, password: str) -> None:
+    """Permanently deletes the account and, via ON DELETE CASCADE foreign
+    keys (see migrations), everything it owns - companies and everything
+    under them, refresh tokens, security events, API keys, etc. There is no
+    soft-delete or recovery path. Rejected for accounts with no
+    password_hash (the fixed AUTH_MODE=local user) - there's nothing to
+    verify the caller's identity against."""
+    if user.password_hash is None:
+        raise ValidationAppError("Account deletion isn't available for this account.")
+    if not verify_password(password, user.password_hash):
+        raise AuthenticationError("Incorrect password")
+    await UserRepository(db).delete(user)
+    await db.commit()
+
+
+async def change_password(
+    db: AsyncSession,
+    settings: Settings,
+    client_ip: str,
+    user: User,
+    payload: ChangePasswordRequest,
+) -> TokenResponse:
+    """Authenticated in-app password change - distinct from
+    confirm_password_reset (which is the emailed-code flow for someone who
+    can't log in at all). Also the only way to clear must_change_password,
+    the admin-forced-reset flag (see require_password_change below)."""
+    if user.password_hash is None:
+        raise ValidationAppError("This account doesn't use password sign-in.")
+    if not verify_password(payload.current_password, user.password_hash):
+        raise AuthenticationError("Incorrect current password")
+
+    history_repo = PasswordHistoryRepository(db)
+    previous_hashes = await history_repo.list_hashes_for_user(user.id)
+    previous_hashes.append(user.password_hash)
+    if any(verify_password(payload.new_password, h) for h in previous_hashes):
+        raise ValidationAppError("You've used this password before. Choose a different one.")
+
+    await history_repo.add(user_id=user.id, password_hash=user.password_hash)
+    user.password_hash = hash_password(payload.new_password)
+    user.must_change_password = False
+
+    # Rotate every session, including the one making this request - the
+    # fresh token pair returned below replaces it immediately, so the
+    # caller keeps working without a forced re-login.
+    await RefreshTokenRepository(db).revoke_all_for_user(user.id)
+    await UserSecurityEventRepository(db).create(
+        user_id=user.id, event_type=SecurityEventType.PASSWORD_CHANGED, ip_address=client_ip
+    )
+    return await _issue_token_pair(db, settings, user)
+
+
+async def require_password_change(db: AsyncSession, client_ip: str, email: str) -> User:
+    """Admin action: flags an account so its next request is blocked
+    everywhere except /auth/me, /auth/change-password, and /auth/logout
+    (enforced in app.auth.dependencies.get_current_user) until they set a
+    new password. Meant for handing a demo account to someone with a known
+    sample password."""
+    user = await UserRepository(db).get_by_email(email)
+    if user is None:
+        raise NotFoundError("No account with that email")
+    if user.password_hash is None:
+        raise ValidationAppError("This account doesn't use password sign-in.")
+    user.must_change_password = True
+    await UserSecurityEventRepository(db).create(
+        user_id=user.id,
+        event_type=SecurityEventType.PASSWORD_CHANGE_REQUIRED,
+        ip_address=client_ip,
+    )
+    await db.commit()
+    return user

apps/api/migrations/versions/9e6c80c11da7_add_must_change_password_to_users.py

@@ -0,0 +1,32 @@
+"""add must_change_password to users
+
+Revision ID: 9e6c80c11da7
+Revises: c34c769afc07
+Create Date: 2026-08-06 03:10:00.000000
+
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "9e6c80c11da7"
+down_revision: str | None = "c34c769afc07"
+branch_labels: Sequence[str] | str | None = None
+depends_on: Sequence[str] | str | None = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column(
+            "must_change_password", sa.Boolean(), nullable=False, server_default=sa.false()
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("users", "must_change_password")

apps/api/tests/unit/test_account_management.py

@@ -0,0 +1,260 @@
+"""Account deletion (DELETE /auth/me) and admin-forced password change
+(POST /admin/users/require-password-change -> POST /auth/change-password,
+enforced by app.auth.dependencies.get_current_user)."""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi.testclient import TestClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.enums import SecurityEventType
+from app.repositories.user_repository import UserRepository
+from app.repositories.user_security_event_repository import UserSecurityEventRepository
+
+
+def _unique_email() -> str:
+    return f"user-{uuid.uuid4().hex[:12]}@example.com"
+
+
+def _register_and_login(client: TestClient, password: str = "correct-horse-1") -> dict:
+    email = _unique_email()
+    client.post(
+        "/api/v1/auth/register",
+        json={"email": email, "password": password, "display_name": "T"},
+    )
+    tokens = client.post("/api/v1/auth/login", json={"email": email, "password": password}).json()
+    return {"email": email, "headers": {"Authorization": f"Bearer {tokens['access_token']}"}}
+
+
+async def _register_admin_and_login(client: TestClient, db_session: AsyncSession) -> dict[str, str]:
+    email = f"admin-{uuid.uuid4().hex[:12]}@example.com"
+    client.post(
+        "/api/v1/auth/register",
+        json={"email": email, "password": "correct-horse-1", "display_name": "Admin"},
+    )
+    user = await UserRepository(db_session).get_by_email(email)
+    user.is_admin = True
+    await db_session.commit()
+    tokens = client.post(
+        "/api/v1/auth/login", json={"email": email, "password": "correct-horse-1"}
+    ).json()
+    return {"Authorization": f"Bearer {tokens['access_token']}"}
+
+
+# --- DELETE /auth/me -------------------------------------------------------
+
+
+def test_delete_account_requires_auth(client: TestClient):
+    resp = client.request(
+        "DELETE", "/api/v1/auth/me", json={"password": "whatever"}
+    )
+    assert resp.status_code == 401
+
+
+def test_delete_account_rejects_wrong_password(client: TestClient):
+    account = _register_and_login(client)
+    resp = client.request(
+        "DELETE",
+        "/api/v1/auth/me",
+        json={"password": "not-the-right-password"},
+        headers=account["headers"],
+    )
+    assert resp.status_code == 401
+
+
+def test_delete_account_succeeds_with_correct_password_and_logs_out_the_account(
+    client: TestClient,
+):
+    account = _register_and_login(client)
+    resp = client.request(
+        "DELETE",
+        "/api/v1/auth/me",
+        json={"password": "correct-horse-1"},
+        headers=account["headers"],
+    )
+    assert resp.status_code == 204
+
+    # The account is gone - the same token no longer resolves to anyone.
+    me_resp = client.get("/api/v1/auth/me", headers=account["headers"])
+    assert me_resp.status_code == 401
+
+    # And a fresh login attempt with the same credentials fails too.
+    login_resp = client.post(
+        "/api/v1/auth/login",
+        json={"email": account["email"], "password": "correct-horse-1"},
+    )
+    assert login_resp.status_code == 401
+
+
+async def test_delete_account_cascades_to_owned_data(client: TestClient, db_session: AsyncSession):
+    """A company created by the account must be gone too (ON DELETE CASCADE),
+    not just the user row."""
+    account = _register_and_login(client)
+    create_resp = client.post(
+        "/api/v1/companies",
+        json={"name": f"Co-{uuid.uuid4().hex[:8]}", "official_website": None},
+        headers=account["headers"],
+    )
+    assert create_resp.status_code == 201
+    company_id = create_resp.json()["id"]
+
+    client.request(
+        "DELETE", "/api/v1/auth/me", json={"password": "correct-horse-1"}, headers=account["headers"]
+    )
+
+    from sqlalchemy import text
+
+    row = await db_session.execute(
+        text("SELECT 1 FROM companies WHERE id = :id"), {"id": company_id}
+    )
+    assert row.first() is None
+
+
+# --- POST /admin/users/require-password-change -----------------------------
+
+
+def test_require_password_change_requires_admin(client: TestClient):
+    account = _register_and_login(client)
+    resp = client.post(
+        "/api/v1/admin/users/require-password-change",
+        json={"email": account["email"]},
+        headers=account["headers"],
+    )
+    assert resp.status_code == 403
+
+
+async def test_require_password_change_rejects_unknown_email(
+    client: TestClient, db_session: AsyncSession
+):
+    headers = await _register_admin_and_login(client, db_session)
+    resp = client.post(
+        "/api/v1/admin/users/require-password-change",
+        json={"email": "[email protected]"},
+        headers=headers,
+    )
+    assert resp.status_code == 404
+
+
+async def test_admin_flags_an_account_and_it_gets_logged_to_the_targets_activity(
+    client: TestClient, db_session: AsyncSession
+):
+    """Checked directly against the DB, not via GET /auth/security-events -
+    that endpoint isn't in the must-change-password exempt list, so the
+    just-flagged account can't reach it until they change their password
+    (see test_flagged_account_is_blocked_from_other_endpoints)."""
+    admin_headers = await _register_admin_and_login(client, db_session)
+    account = _register_and_login(client)
+
+    resp = client.post(
+        "/api/v1/admin/users/require-password-change",
+        json={"email": account["email"]},
+        headers=admin_headers,
+    )
+    assert resp.status_code == 204
+
+    user = await UserRepository(db_session).get_by_email(account["email"])
+    assert user.must_change_password is True
+    events = await UserSecurityEventRepository(db_session).list_for_user(user.id)
+    assert any(e.event_type == SecurityEventType.PASSWORD_CHANGE_REQUIRED for e in events)
+
+
+# --- Enforcement gate: everything except me/change-password/logout 403s ----
+
+
+async def test_flagged_account_is_blocked_from_other_endpoints(
+    client: TestClient, db_session: AsyncSession
+):
+    admin_headers = await _register_admin_and_login(client, db_session)
+    account = _register_and_login(client)
+    client.post(
+        "/api/v1/admin/users/require-password-change",
+        json={"email": account["email"]},
+        headers=admin_headers,
+    )
+
+    blocked = client.get("/api/v1/companies", headers=account["headers"])
+    assert blocked.status_code == 403
+
+    still_ok = client.get("/api/v1/auth/me", headers=account["headers"])
+    assert still_ok.status_code == 200
+    assert still_ok.json()["must_change_password"] is True
+
+
+async def test_change_password_clears_the_flag_and_unblocks_the_account(
+    client: TestClient, db_session: AsyncSession
+):
+    admin_headers = await _register_admin_and_login(client, db_session)
+    account = _register_and_login(client)
+    client.post(
+        "/api/v1/admin/users/require-password-change",
+        json={"email": account["email"]},
+        headers=admin_headers,
+    )
+
+    change_resp = client.post(
+        "/api/v1/auth/change-password",
+        json={"current_password": "correct-horse-1", "new_password": "brand-new-horse-2"},
+        headers=account["headers"],
+    )
+    assert change_resp.status_code == 200
+    new_tokens = change_resp.json()
+    new_headers = {"Authorization": f"Bearer {new_tokens['access_token']}"}
+
+    me_resp = client.get("/api/v1/auth/me", headers=new_headers)
+    assert me_resp.status_code == 200
+    assert me_resp.json()["must_change_password"] is False
+
+    unblocked = client.get("/api/v1/companies", headers=new_headers)
+    assert unblocked.status_code == 200
+
+    # The new password actually works on a fresh login.
+    login_resp = client.post(
+        "/api/v1/auth/login",
+        json={"email": account["email"], "password": "brand-new-horse-2"},
+    )
+    assert login_resp.status_code == 200
+
+
+def test_change_password_rejects_wrong_current_password(client: TestClient):
+    account = _register_and_login(client)
+    resp = client.post(
+        "/api/v1/auth/change-password",
+        json={"current_password": "totally-wrong", "new_password": "brand-new-horse-2"},
+        headers=account["headers"],
+    )
+    assert resp.status_code == 401
+
+
+def test_change_password_rejects_reusing_the_current_password(client: TestClient):
+    account = _register_and_login(client)
+    resp = client.post(
+        "/api/v1/auth/change-password",
+        json={"current_password": "correct-horse-1", "new_password": "correct-horse-1"},
+        headers=account["headers"],
+    )
+    assert resp.status_code == 400
+
+
+def test_change_password_revokes_the_old_refresh_token(client: TestClient):
+    email = _unique_email()
+    client.post(
+        "/api/v1/auth/register",
+        json={"email": email, "password": "correct-horse-1", "display_name": "T"},
+    )
+    tokens = client.post(
+        "/api/v1/auth/login", json={"email": email, "password": "correct-horse-1"}
+    ).json()
+    headers = {"Authorization": f"Bearer {tokens['access_token']}"}
+
+    client.post(
+        "/api/v1/auth/change-password",
+        json={"current_password": "correct-horse-1", "new_password": "brand-new-horse-2"},
+        headers=headers,
+    )
+
+    stale_refresh_resp = client.post(
+        "/api/v1/auth/refresh", json={"refresh_token": tokens["refresh_token"]}
+    )
+    assert stale_refresh_resp.status_code == 401

apps/api/tests/unit/test_db_viewer.py

@@ -100,12 +100,24 @@ async def test_bootstrap_with_a_valid_token_sets_a_session_cookie_and_redirects(
         "/api/v1/db-viewer/bootstrap", params={"token": token}, follow_redirects=False
     )
     assert resp.status_code == 302
-    assert resp.headers["location"] == "/"
+    assert resp.headers["location"] == "/?pgsql=postgres"
     assert "db_viewer_session" in resp.headers["set-cookie"]
     assert "HttpOnly" in resp.headers["set-cookie"]
     assert "Secure" in resp.headers["set-cookie"]
 
 
+async def test_bootstrap_success_is_logged_to_the_admins_account_activity(
+    client: TestClient, db_session: AsyncSession
+):
+    headers = await _register_admin_and_login(client, db_session)
+    token = client.post("/api/v1/db-viewer/session", headers=headers).json()["token"]
+
+    client.get("/api/v1/db-viewer/bootstrap", params={"token": token}, follow_redirects=False)
+
+    events = client.get("/api/v1/auth/security-events", headers=headers).json()
+    assert any(e["event_type"] == "db_viewer_accessed" for e in events)
+
+
 def test_bootstrap_rejects_a_garbage_token(client: TestClient):
     resp = client.get(
         "/api/v1/db-viewer/bootstrap", params={"token": "not-a-real-token"}, follow_redirects=False