Graylog2 / Graylog2/graylog2-server
Update audit annotations and checks to support intentions more clearly
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
During development, it is often necessary to suppress audit event checking due to the added complexity of writing audit event formatters, etc.
The `@NoAuditEvent` annotation is often used, but it is very easy to miss adding them later.
The resource method annotation should make the intention of skipping audit events clearer than the string we currently use.
## Current Behavior
We currently have https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/audit/jersey/NoAuditEvent.java to indicate that no audit event is necessary for a non-GET HTTP method resource.
## Possible Solution
Migrate the annotation to require picking an enum value for the reasons of omitting the automatic audit event generation.
Likely causes are:
* The resource does not cause an audit-worthy change at all, e.g. invalidates a cache, just technical reason for not using a GET etc
* The resource manually creates audit events in its implementation
* We are intentionally skipping defining audit events during development (this is rare and code using this should never make it to stable builds, it should probably fail builds).
Contributor guide
Assessment
This issue has not been assessed yet.