Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Audit log does not cover non-HTTP events, starting with email sends

Aperta
  • Qualcosa non va?
#942 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Tranquilla
Stack tecnologico
typescript
Ambito
backend

Direzione di ricerca

Read AuditLog.ts and the cited ParticipantsController.ts and SurveysController.ts entry points to understand the existing HTTP and manual audit writes; compare them with Invite.status and Invite.sentAt. The issue leaves core design decisions open, including event storage and partial-batch outcomes, so there is no defined implementation or test to start with. Done requires those decisions to be settled before a scope and acceptance criteria can be set.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

backend question

The audit log is HTTP request logging. auditLog writes one row per PATCH/DELETE/POST/PUT carrying the resource path, the method, and whether the response was 2xx. It has no concept of anything that is not an HTTP request, so nothing it records says anything about email.

Raised by @ignatiusm while reviewing #936:

There are possibly other non-http request things we'll want to have auditlogs for. Designing all of that and thinking through the implications might blow up the scope of current PR.

So this is that design question pulled out of #936, with email as the first case rather than the whole scope.

What is wrong today

  • Inviting 500 participants writes one audit row saying an admin POSTed to the invites endpoint. No recipients, no per-message outcome.
  • success on that row is the HTTP status, not the operation result. AuditLog.ts:45 is 200 <= res.statusCode <= 299. resendPendingInvites returns 204 and createInvites returns 200 regardless of how many sends failed, so a batch where every email failed is audited as a success.
  • The single-invite resend is the only honest path, ParticipantsController.ts:862 throws a 502.
  • The only manual audit write in the codebase is SurveysController.ts:495, for answer recalculation, so there is no established pattern for non-HTTP events to copy.

What is recorded elsewhere

Invites are covered by Invite.status and Invite.sentAt, which give recipient and outcome per row. OTP, password reset and contact-us have nothing. OTPToken and PasswordResetToken record that a token was issued for a userId, not that an email went out.

Open decisions

  • Should success mean the HTTP status or the operation outcome? If the latter, how is a partially-failed batch represented?
  • Do non-HTTP events write to AuditLog with a synthetic resource, or get their own model?
  • What else belongs here beyond email? Background jobs and scheduled work have the same gap.
  • Does the retention story change? If Sent Items on the M365 mailbox gets a cleanup policy, the app becomes the only record of what was sent.

Related: #936

Lingua principale
TypeScript
Stelle
4
Fork
0
Merge medio
14h 50m
PR unite (30g)
5

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Garvan-Data-Science-Platform/ctrl

Tutte le issue di Garvan-Data-Science-Platform/ctrl

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.