Skip to content

Test no audit event is logged when not licensed

Tan Le requested to merge 205636-test-audit-event-exclusive-cases into master

What does this MR do?

Add test cases to verify no audit event is logged when license does not include correct set of features.

I have extended the audit event logging shared_examples and as a result, cover other areas besides Users model.

Users::DestroyService
  #execute
    returns result
    when project is a mirror
      assigns mirror_user to a project owner
    audit events
      when licensed
        soft delete
          when user destroy operation succeeds
            logs audit events for ghost user migration and destroy operation
          when user destroy operation fails
            logs audit events for ghost user migration operation
        hard delete
          when user destroy operation succeeds
            logs audit events for destroy operation
          when user destroy operation fails
            does not log any audit event
      when not licensed
        does not log any audit event

Users::CreateService
  #execute
    audit events
      when licensed
        does not log audit event if operation fails
        when operation succeeds
          logs an audit event
          logs the audit event info
      when not licensed
        does not log audit event
      when audit is not required
        does not log any audit event

Users::BlockService
  #execute
    audit events
      when licensed
        when user block operation succeeds
          logs an audit event
          logs the audit event info
        when user block operation fails
          does not log any audit event
      when not licensed
        does not log any audit event

Finished in 9.37 seconds (files took 1.39 seconds to load)
16 examples, 0 failures

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Closes #205636 (closed)

Edited by Tan Le

Merge request reports