Fix user namespace scoped audit events
Problem Statement
We are currently scoping some audit events to the User namespace, which is incorrect. These events should ideally be tagged to InstanceScope since they are only visible at the instance level. One example of this event on staging is:
#<AuditEvent:0x00007fe0125b5dc0
id: 46370012,
author_id: 1614863,
entity_id: 1974093,
entity_type: "Namespaces::UserNamespace",
details:
{:remove=>"project",
:author_name=>"QA User (Quality Team's Test Account)",
:author_class=>"User",
:target_id=>8820959,
:target_type=>"Project",
:target_details=>"gitlab-qa/api-basics-da5dc4878a942b0f",
:custom_message=>"Project destroyed",
:ip_address=>"34.148.172.192",
:entity_path=>"gitlab-qa"},
ip_address: #<IPAddr: IPv4:34.148.172.192/255.255.255.255>,
author_name: "QA User (Quality Team's Test Account)",
entity_path: "gitlab-qa",
target_details: "gitlab-qa/api-basics-da5dc4878a942b0f",
created_at: Thu, 20 Apr 2023 04:27:02.087847000 UTC +00:00,
target_type: "Project",
target_id: 8820959>
these events are being generated here: https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/ee/projects/destroy_service.rb
Implementation Plan
- Implement a logger in Auditor to catch log all audit event scopes
- Find and move code using not a valid scope, valid scopes: Group, Project, User, Instance
- Write a Batched background migration to correct the wrong scopes and also move these events into respective new table
Edited by Harsimar Sandhu