Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Audit log does not cover non-HTTP events, starting with email sends

未关闭
  • 哪里不对？
#942 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
冷清
技术栈
typescript
领域
backend

调研方向

Read AuditLog.ts and the cited ParticipantsController.ts and SurveysController.ts entry points to understand the existing HTTP and manual audit writes; compare them with Invite.status and Invite.sentAt. The issue leaves core design decisions open, including event storage and partial-batch outcomes, so there is no defined implementation or test to start with. Done requires those decisions to be settled before a scope and acceptance criteria can be set.

由索引模型根据 Issue 内容生成。

描述

backend question

The audit log is HTTP request logging. auditLog writes one row per PATCH/DELETE/POST/PUT carrying the resource path, the method, and whether the response was 2xx. It has no concept of anything that is not an HTTP request, so nothing it records says anything about email.

Raised by @ignatiusm while reviewing #936:

There are possibly other non-http request things we'll want to have auditlogs for. Designing all of that and thinking through the implications might blow up the scope of current PR.

So this is that design question pulled out of #936, with email as the first case rather than the whole scope.

What is wrong today

  • Inviting 500 participants writes one audit row saying an admin POSTed to the invites endpoint. No recipients, no per-message outcome.
  • success on that row is the HTTP status, not the operation result. AuditLog.ts:45 is 200 <= res.statusCode <= 299. resendPendingInvites returns 204 and createInvites returns 200 regardless of how many sends failed, so a batch where every email failed is audited as a success.
  • The single-invite resend is the only honest path, ParticipantsController.ts:862 throws a 502.
  • The only manual audit write in the codebase is SurveysController.ts:495, for answer recalculation, so there is no established pattern for non-HTTP events to copy.

What is recorded elsewhere

Invites are covered by Invite.status and Invite.sentAt, which give recipient and outcome per row. OTP, password reset and contact-us have nothing. OTPToken and PasswordResetToken record that a token was issued for a userId, not that an email went out.

Open decisions

  • Should success mean the HTTP status or the operation outcome? If the latter, how is a partially-failed batch represented?
  • Do non-HTTP events write to AuditLog with a synthetic resource, or get their own model?
  • What else belongs here beyond email? Background jobs and scheduled work have the same gap.
  • Does the retention story change? If Sent Items on the M365 mailbox gets a cleanup policy, the app becomes the only record of what was sent.

Related: #936

主要语言
TypeScript
星标
4
派生
0
平均合并
14 小时 50 分钟
30 天内合并 PR
5

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Garvan-Data-Science-Platform/ctrl 的其他 Issue

查看 Garvan-Data-Science-Platform/ctrl 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。