Audit-log group create / update / delete - #19377
Open
rodchristiansen wants to merge 2 commits into
Open
Conversation
Mirrors UserObserver so edits to a permission group land in action_logs
the same way user edits do. Without this, changing a group's
permissions JSON is invisible to the audit history even though the
change affects every member.
Tracked fields: name, notes, permissions. Diff is stored in log_meta
as {field: {old, new}}. Group does not soft-delete, so no restoring
handler.
Asserts that creating, renaming, re-permissioning and deleting a group each write the expected row to action_logs, that the update row carries an old/new diff in log_meta, and that a save which changes nothing does not write a row at all.
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| UnusedCode | 1 medium |
🟢 Metrics 12 complexity
Metric Results Complexity 12
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Member
|
Our intent was to put this into an admin log table along with other admin settings, to keep it out of the regular action logs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Editing a group's permissions currently leaves no trace in the action log. That is a notable gap, because a group permission edit silently changes what every member of that group can do — a wider blast radius than the equivalent edit on a single user, which is already logged by
UserObserver.This adds
GroupObserver, deliberately mirroring the existingUserObserver:created/deletingwrite acreate/deleterowupdatingwrites anupdaterow carrying an old/new diff inlog_metaname,notesandpermissionsGroupdoes not soft-delete, so there is norestoringhandler.Type of change
How Has This Been Tested?
Added
tests/Feature/Groups/GroupAuditLogTest.phpcovering create, rename, permission change (asserting the old/new diff actually lands inlog_meta), delete, and the no-op case. Fulltests/Feature/Groupssuite passes — 24 tests, 79 assertions.Notes for reviewers
No migration: this reuses the existing
action_logstable and thecreate/update/deleteActionTypecases. Existing group history views pick the rows up without change.