KC-1072: action-report lock dates, compliance pw aging, security-audit record details

[aaunario-keeper]

Summary

Three reporting enhancements for compliance and security auditing:

1. Action Report: Lock Date for Blocked Users (aram.py)

• New lock_time column showing when users were locked
• Auto-included when --target locked or explicit --columns lock_time
• Queries lock_user audit events to find most recent lock timestamp

2. Record Access Report: Last Password Change (compliance.py)

• New last_pw_change column in --aging reports
• Queries record_password_change audit events
• Falls back to record created date if no password change event exists
• Added progress spinners for long-running aging/access event fetches (silent in batch mode)

3. Security Audit: Per-Record Password Strength (security_audit.py)

• New --record-details flag outputs per-record password strength
• Uses get_incremental_security_data endpoint (has recordUid, unlike summary endpoint)
• Columns: email, name, record_uid, strength, strength_category, node

Other Changes

• Guard enterprise license expiration conversion for far-future timestamps (Windows time_t limits)
• Add pytest to dev requirements
• Stabilize service stop unit test by mocking OS-specific os.kill behavior

Test Plan

pytest unit-tests/ -q

Note: Full integration tests require tests/enterprise.json and tests/vault.json

---

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pytest@​9.0.2

View full report