--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mod_audit_tokens/README.md	Fri Dec 01 21:32:33 2023 +0100
@@ -0,0 +1,8 @@
+---
+summary: Store token events in the audit log
+rockspec:
+  dependencies:
+  - mod_audit
+...
+
+This module stores events relating to auth tokens, e.g. grant creations and revokations, in the audit log provided by `mod_audit`.

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mod_audit_tokens/mod_audit_tokens.lua	Fri Dec 01 21:32:33 2023 +0100
@@ -0,0 +1,19 @@
+local jid = require"util.jid";
+
+module:depends("audit");
+-- luacheck: read globals module.audit
+
+module:hook("token-grant-created", function(event)
+	module:audit(jid.join(event.username, event.host), "token-grant-created", {
+	});
+end)
+
+module:hook("token-grant-revoked", function(event)
+	module:audit(jid.join(event.username, event.host), "token-grant-revoked", {
+	});
+end)
+
+module:hook("token-revoked", function(event)
+	module:audit(jid.join(event.username, event.host), "token-revoked", {
+	});
+end)