Skip to content

Don't create `GroupSaml` membership updates audit events when there is no change

Problem to solve

Right now audit events are created to whenever certain APIs are called. This is great for maintaining visibility whenever actions take place. However, it means that audit events are always created, even when no change has occurred. This can cause the audit log to be filled with events that aren't meaningful. See the screenshot on the epic for an example where no actual changed occurred, yet an event was created.

The audit event located in the Gitlab::Auth::GroupSaml::MembershipUpdater might exhibit this behavior

Proposal

When an audit event is about to be created, check that there actually was a change. If there was, create the event if normal. However, if no change actually occurred, do not create an audit event.

Implementation Plan

  1. Write down a class Audit::MergeRequestDestroyAuditor
  2. Do the auditing of merge requests destroy in that class and move both delete_merge_request and merged_merge_request_deleted audit event types in this class
  3. Call this class from ee/app/services/ee/issuable/destroy_service.rb
  4. Write down Rspecs
Edited by Harsimar Sandhu