[v18] Add new CIR fields to audit events

api/proto/teleport/legacy/types/events/events.proto

@@ -9841,6 +9841,20 @@ message ClientIPRestrictionsUpdate {
 
   // ClientIPRestrictions is the new Client IP Restrictions allowlist.
   repeated string ClientIPRestrictions = 6 [(gogoproto.jsontag) = "client_ip_restrictions"];
+
+  // Mode is the new Client IP Restrictions enforcement mode ("draft" or
+  // "enforced"), recorded exactly as accepted by the server. Empty when the
+  // request did not set a mode (treated as enforced), for deletions, and for
+  // updates made through APIs that predate the mode field.
+  string Mode = 7 [(gogoproto.jsontag) = "mode,omitempty"];
+
+  // EnforcementExpires is the time at which the Client IP Restrictions
+  // enforcement lapses. Zero if no expiry is set.
+  google.protobuf.Timestamp EnforcementExpires = 8 [
+    (gogoproto.stdtime) = true,
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "enforcement_expires,omitempty"
+  ];
 }
 
 // VnetConfigCreate is emitted when a VnetConfig is created.

docs/pages/reference/audit-events.mdx

@@ -1550,8 +1550,10 @@ Example:
   "cluster_name": "localhost",
   "code": "CIR001I",
   "ei": 0,
+  "enforcement_expires": "2026-10-21T20:45:14.775Z",
   "event": "cir.update",
   "expires": "0001-01-01T00:00:00Z",
+  "mode": "enforced",
   "name": "client_ip_restriction",
   "success": true,
   "time": "2025-10-21T20:45:14.775Z",

lib/events/events_test.go

@@ -305,6 +305,7 @@ var eventsMap = map[string]apievents.AuditEvent{
 	BeamsConfigCreateEvent:                        &apievents.BeamsConfigCreate{},
 	BeamsConfigUpdateEvent:                        &apievents.BeamsConfigUpdate{},
 	BeamsConfigDeleteEvent:                        &apievents.BeamsConfigDelete{},
+	ClientIPRestrictionsUpdateEvent:               &apievents.ClientIPRestrictionsUpdate{},
 }
 
 // TestJSON tests JSON marshal events

web/packages/teleport/src/Audit/fixtures/index.ts

@@ -4474,8 +4474,10 @@ export const events = [
     cluster_name: 'localhost',
     code: 'CIR001I',
     ei: 0,
+    enforcement_expires: '2026-10-21T20:45:14.775Z',
     event: 'cir.update',
     expires: '0001-01-01T00:00:00Z',
+    mode: 'enforced',
     name: 'client_ip_restriction',
     success: true,
     time: '2025-10-21T20:45:14.775Z',

web/packages/teleport/src/services/audit/makeEvent.ts

@@ -2492,10 +2492,23 @@ export const formatters: Formatters = {
   [eventCodes.CLIENT_IP_RESTRICTIONS_UPDATE]: {
     type: 'cir.update',
     desc: 'Client IP Restrictions update',
-    format: ({ user, client_ip_restrictions, success }) =>
-      success
-        ? `User [${user}] updated the Client IP Restrictions allowlist to [${client_ip_restrictions}].`
-        : `User [${user}] has failed to update  Client IP Restrictions.`,
+    format: ({
+      user,
+      client_ip_restrictions,
+      success,
+      mode,
+      enforcement_expires,
+    }) => {
+      const modeStr = mode ? ` in [${mode}] mode` : '';
+      // The zero timestamp means no enforcement expiry was set.
+      const enforcementStr =
+        enforcement_expires && new Date(enforcement_expires).getFullYear() > 1
+          ? `, with enforcement expiring on [${enforcement_expires}]`
+          : '';
+      return success
+        ? `User [${user}] updated the Client IP Restrictions allowlist to [${client_ip_restrictions}]${modeStr}${enforcementStr}.`
+        : `User [${user}] has failed to update Client IP Restrictions.`;
+    },
   },
   [eventCodes.VNET_CONFIG_CREATE]: {
     type: 'vnet.config.create',

web/packages/teleport/src/services/audit/types.ts

@@ -2254,6 +2254,8 @@ export type RawEvents = {
     {
       client_ip_restrictions: string[];
       success: boolean;
+      mode?: string;
+      enforcement_expires?: string;
     }
   >;
   [eventCodes.VNET_CONFIG_CREATE]: RawEvent<