Origin/feature/audit log read #22213
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is the final PR Bugbot will review for you during this billing cycle
Your free Bugbot reviews will reset on January 28
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| full = StringUtils::boolean(param); | ||
| } | ||
| generateDatabaseResult(um, user, full); | ||
| events::ReadUser(user, Result(), ExecContext::current()); |
There was a problem hiding this comment.
Audit log always records success even when operation fails
When handling the /_api/user/<user>/database endpoint (suffixes.size() == 2), events::ReadUser is called with Result() (always success) after generateDatabaseResult returns. However, generateDatabaseResult internally calls um->accessUser() which can fail with TRI_ERROR_USER_NOT_FOUND, and in that case generates an error response. The audit log still records a successful read despite the operation failing. This is inconsistent with the "config" branch which properly captures and passes the actual Result to the audit event.
Scope & Purpose
Add audit logging for all read operations on the
_userssystem collection. Implementing FRB-419.1. Core Audit Event Implementation
Files Modified:
arangod/Utils/Events.hReadUser()function declarationarangod/Utils/Events.cpp(Community Edition)ReadUser()enterprise/Enterprise/Audit/EventsEE.cpp(Enterprise Edition)ReadUser()audit eventDOCUMENTtopic atINFOlevelread user '<username>' | ok/failedarangod/RestHandler/RestUsersHandler.cpp#include "Utils/Events.h"events::ReadUser()calls to all GET endpoints:GET /_api/user→ logs asread user '*'GET /_api/user/<user>→ logs asread user '<user>'GET /_api/user/<user>/database→ logs user readGET /_api/user/<user>/database/<dbname>→ logs user readGET /_api/user/<user>/database/<dbname>/<collection>→ logs user readGET /_api/user/<user>/config→ logs user read2. Test Implementation
Files Modified:
enterprise/tests/js/common/audit/audit.jstoSkipregex to allow "read user" events while filtering other_usersoperationstestReadUser- Read specific usertestReadUserFailed- Read non-existent usertestReadAllUsers- List all userstestReadUserDatabasePermissions- Read user DB permissionstestReadUserSpecificDatabasePermission- Read specific DB permissiontestReadUserCollectionPermission- Read collection permissiontestReadUserConfig- Read user configenterprise/tests/js/client/audit/audit.jstestReadUsertestReadAllUsersenterprise/tests/js/server/audit/audit.js3. Documentation Updates
Files Modified:
docs-hugo/site/content/arangodb/4.0/operations/security/audit-logging.mdAdded New Section: "User Management"
Checklist
Related Information
(Please reference tickets / specification / other PRs etc)
Note
Implements audit logging for reads from the users API.
events::ReadUser(username, result, context)inUtils/Events.h/.cppevents::ReadUserinRestUsersHandler::getRequestfor: listing all users, fetching a user, and reading database/collection permissions andconfigdataCHANGELOGwith FRB-419 entryWritten by Cursor Bugbot for commit 9a1f28f. This will update automatically on new commits. Configure here.