Skip to content

Project archived/unarchived with API will not create an audit event

Summary

Archiving a project with the API will not create an archived audit event. Only archives through the UI will create the audit event.

There is no audit event either from when an project is unarchived via the API.

Steps to reproduce

  1. Create a project
  2. Use the project archive API endpoint (POST /projects/:id/archive)
  3. Review Audit Events. No event will be created

Reproduced on 17.3.6 and 17.5.1

What is the current bug behavior?

No audit event

What is the expected correct behavior?

Audit event created

Other

It looks like this was missed when originally adding audit events for archiving: #8631 (closed) !15362 (merged)

Reported by Internal ZD Ticket Customer

Implementation guide:

  • For the archive and unarchive actions on the API layer here, add a call to the method that registers the respective audit event.
  • Since audit events are EE only, the method should be overridden in the ee/ file, where the audit event will be register.
      audit_context = {
        name: event_type,
        author: current_user,
        target: project,
        scope: project,
        message: message,
        ip_address: request.remote_ip
      }

      ::Gitlab::Audit::Auditor.audit(audit_context)

Note: Is there a refactoring opportunity to move the audit event registration to ::Projects::UpdateService for when archived is updated to true/false. That way, there can be just one place where audit event is registered, instead of copying over the same logic from the controller layer to the API layer.

Edited by 🤖 GitLab Bot 🤖