Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Audit log does not cover non-HTTP events, starting with email sends

Abierto
  • ¿Algo no está bien?
#942 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Tranquilo
Stack tecnológico
typescript
Área
backend

Línea de trabajo

Read AuditLog.ts and the cited ParticipantsController.ts and SurveysController.ts entry points to understand the existing HTTP and manual audit writes; compare them with Invite.status and Invite.sentAt. The issue leaves core design decisions open, including event storage and partial-batch outcomes, so there is no defined implementation or test to start with. Done requires those decisions to be settled before a scope and acceptance criteria can be set.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

backend question

The audit log is HTTP request logging. auditLog writes one row per PATCH/DELETE/POST/PUT carrying the resource path, the method, and whether the response was 2xx. It has no concept of anything that is not an HTTP request, so nothing it records says anything about email.

Raised by @ignatiusm while reviewing #936:

There are possibly other non-http request things we'll want to have auditlogs for. Designing all of that and thinking through the implications might blow up the scope of current PR.

So this is that design question pulled out of #936, with email as the first case rather than the whole scope.

What is wrong today

  • Inviting 500 participants writes one audit row saying an admin POSTed to the invites endpoint. No recipients, no per-message outcome.
  • success on that row is the HTTP status, not the operation result. AuditLog.ts:45 is 200 <= res.statusCode <= 299. resendPendingInvites returns 204 and createInvites returns 200 regardless of how many sends failed, so a batch where every email failed is audited as a success.
  • The single-invite resend is the only honest path, ParticipantsController.ts:862 throws a 502.
  • The only manual audit write in the codebase is SurveysController.ts:495, for answer recalculation, so there is no established pattern for non-HTTP events to copy.

What is recorded elsewhere

Invites are covered by Invite.status and Invite.sentAt, which give recipient and outcome per row. OTP, password reset and contact-us have nothing. OTPToken and PasswordResetToken record that a token was issued for a userId, not that an email went out.

Open decisions

  • Should success mean the HTTP status or the operation outcome? If the latter, how is a partially-failed batch represented?
  • Do non-HTTP events write to AuditLog with a synthetic resource, or get their own model?
  • What else belongs here beyond email? Background jobs and scheduled work have the same gap.
  • Does the retention story change? If Sent Items on the M365 mailbox gets a cleanup policy, the app becomes the only record of what was sent.

Related: #936

Lenguaje dominante
TypeScript
Estrellas
4
Forks
0
Merge medio
14 h 50 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Garvan-Data-Science-Platform/ctrl

Todos los issues de Garvan-Data-Science-Platform/ctrl

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.