Enhance existing OAuth application authorisation audit event
Audit need
Enhance existing audit event for OAuth application authorisation by adding scopes and application url in the audit event.
Proposal
Current audit event(streaming) when an OAuth application is added looks as follows
{
  "id": 123456789,
  "author_id": 123456789,
  "entity_id": 123456789,
  "entity_type": "Group",
  "details": {
    "custom_message": "OAuth application added",
    "author_name": "Person",
    "target_id": 123456789,
    "target_type": "User",
    "target_details": "testest",
    "ip_address": "11.22.33.44",
    "entity_path": "gitlab"
  },
  "ip_address": "11.22.33.44",
  "author_name": "Person",
  "entity_path": "gitlab",
  "target_details": "testest",
  "created_at": "2025-03-04T06:22:03.793Z",
  "target_type": "User",
  "target_id": 123456789,
  "event_type": "audit_operation"
}
It doesn't provide information about the scopes and OAuth application redirect uri/Application URL. This information could be useful to monitor the sensitive scopes and match against known malicious IOCs.
Streaming-only event or normal event?
The event seems to be present in the audit_json subcomponent of rails log. We need to expose it to the stream event as well
Edited  by 🤖 GitLab Bot 🤖