Repository navigation
Feat/admin audit logging - #1195
Open
GhassenKefi wants to merge 5 commits into
Open
GhassenKefi wants to merge 5 commits into
GhassenKefi wants to merge 5 commits into
Conversation
GhassenKefi
requested review from
Ashim-Stha,
Kharonus,
NobodysNightmare,
ba1ash,
dominic-braeunlein,
individual-it,
julien-nc,
psatyal,
saw-jan,
shiroginne and
wielinde
as code owners
October 19, 2026 18:02
The existing audit log entries (app password created, replaced and deleted, project folder setup deactivated, integration reset, OpenProject URL and OAuth client set, Nextcloud OAuth client created) are now dispatched as CriticalActionPerformedEvent with named parameters and, on servers that support it, an operation. The messages keep their meaning; the misplaced quote in the app password messages is fixed. The operations are collected in the new OCA\OpenProject\AuditLog\Operation enum, with a short description of each for the documentation. Before, OpenProjectAPIService::logToAuditFile() created admin_audit's internal AuditLogger itself. Because that bypasses the admin_audit app, it had to guess whether the app was installed and configured, and only wrote when the audit log was the default data/audit.log file, log.condition listed admin_audit and the log level was at least 1. With a custom logfile_audit, a syslog or systemd audit log, or without log.condition, nothing was logged. AuditLogger is also not a public API: since Nextcloud 35 its constructor takes IAppConfig, so the direct construction fails there. Now admin_audit decides itself: its listener only runs when the app is enabled and writes to the audit log as configured, like every other audit entry. The ILogFactory dependency and the psalm suppression for AuditLogger are gone. isAdminAuditConfigSetCorrectly() is now only used for the hint in the admin settings and only checks that admin_audit is enabled, as the file path and log.condition no longer matter. The app password entry is now written by generateAppPasswordTokenForUser() itself, which is told whether it replaces an existing app password. The app password, the OpenProject client secret and the Nextcloud client secret are never logged. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ghassen kefi <ghassen.kefi.dev@gmail.com>
Saving the integration settings is now logged for every way they are saved: the admin settings form, the setup API (POST, PATCH and DELETE /setup) and the reset. The entry lists the names of the saved settings, the OpenProject URL, the authorization method and whether all users were disconnected from OpenProject because the OAuth client or the authorization method changed. The reset entry also tells whether users were disconnected. Setting values other than the URL and the authorization method are not logged, so the OpenProject client secret never ends up in the audit log. This replaces the two entries written only by the admin settings form, "OpenProject host url has been set" and "OpenProject OAuth credential ... has been set", which missed the setup API and changes of the OIDC settings. The saved setting names are logged instead of comparing each value with the stored one, which would need an extra app config read per setting. Creating the Nextcloud OAuth client used by OpenProject is now logged wherever it happens (the admin settings button and the setup API), with the ID of the client and whether it replaced the previous one, instead of only from the admin settings button. The client secret is not logged. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ghassen kefi <ghassen.kefi.dev@gmail.com>
…rvice Setting up the project folder is now written to the audit log with the groupfolder ID, the OpenProject system user and its two groups. Creating the user and the groups is already logged by admin_audit, but making the user group admin of them and creating the groupfolder whose advanced permissions the user manages were not. createGroupfolder() now returns the ID of the groupfolder for this. Each terms of service signed on behalf of the OpenProject system user is logged with the terms ID. This covers terms signed by an admin, by the project folder setup and automatically by the app when the terms change. Terms that were already signed are not logged again. Logging happens in signTermsOfServiceForUserOpenProject() instead of the admin endpoint to cover all of these. To test it, the signatory mapper can be passed in, as for isAllTermsOfServiceSignedForUserOpenProject(), and the signatory is created in its own method, as the terms_of_service app is not available in the unit tests. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ghassen kefi <ghassen.kefi.dev@gmail.com>
A user connecting their OpenProject account, through the OAuth flow or with a personal access token, is now written to the audit log with the user ID and the OpenProject user ID. Removing the token in the personal settings is logged as a disconnection. The access and refresh tokens are never logged. Failed connections are not logged. Users of the OIDC authorization method are not logged: they never connect explicitly, their token is fetched from the identity provider whenever needed. Disconnecting all users because the OpenProject OAuth client or the authorization method changed is part of the integration settings entries. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ghassen kefi <ghassen.kefi.dev@gmail.com>
Linking a file to an OpenProject work package is now written to the audit log, one entry per file, with the file ID, the work package ID, the user and the ID of the file link OpenProject created. Linking sends the file ID, name and type to OpenProject, where the members of the project can see them. Deleting a file link is logged with the file link ID and the user. Only IDs are logged, not the file names. Nothing is logged when OpenProject rejects the request or answers with a malformed response. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ghassen kefi <ghassen.kefi.dev@gmail.com>
GhassenKefi
force-pushed
the
feat/admin-audit-logging
branch
from
October 20, 2026 15:46
f139b75 to
92b2404
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Related Issue or Workpackage
Screenshots (if appropriate):
Types of changes
Checklist:
CHANGELOG.mdfile