🚧 WIP

backend/app/routers/broker.py

@@ -30,6 +30,7 @@ from app.models import (
 )
 from app.schemas import (
     BrokerSettingsIn,
+    BrokerSettingsOut,
     ConfigPreviewOut,
     DeployRequest,
     ListenerIn,
@@ -126,13 +127,21 @@ def update_listener(
     for key, value in body.model_dump().items():
         setattr(listener, key, value)
     db.flush()
+    # Audit the security-relevant listener fields (spec section 38): the
+    # full PUT payload is a replacement, so record what it now says.
     audit.record(
         db,
         "LISTENER_UPDATED",
         request=request,
         object_type="listener",
         object_id=str(listener.id),
-        new_value={"name": body.name, "port": body.port},
+        new_value={
+            "name": body.name,
+            "port": body.port,
+            "bind_address": body.bind_address,
+            "protocol": body.protocol,
+            "allow_anonymous": body.allow_anonymous,
+        },
     )
     return listener
 
@@ -161,7 +170,7 @@ def delete_listener(
 # --- Global settings -----------------------------------------------------------
 
 
-@router.get("/settings", response_model=list[BrokerSettingsIn])
+@router.get("/settings", response_model=list[BrokerSettingsOut])
 def list_settings(db: Annotated[Session, Depends(get_db)], _user: AnyReader):
     return db.scalars(select(BrokerSettings)).all()