psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(projects): emit Create audit row on task creation #282

Merged
nrupard merged 2 commits from fix/pms-318-create-task-audit-row into main 2026-06-16 21:30:18 +02:00
Conversation 0 Commits 2 Files changed 28 +1039 -48
David commented 2026-06-16 19:14:46 +02:00
Owner
Copy link

create_task INSERTed the task row and committed without ever calling audit_write, so the task's change-history feed never showed the create event even though the viewer endpoint and the sibling update_task/update_project paths in the same file already write audit rows. The fix is additive: thread the AuditCtx extractor into the create_task handler (mirroring update_task) and, inside the existing transaction, snapshot the inserted row via to_jsonb and call audit_write with action=Create, resource_type="tasks", before=NULL, after=row snapshot, before commit. Wrapping the audit row in the same tx as the INSERT means a rollback drops both.

Adds two integration tests: one asserting the create writes an entity-scoped create audit row (no before snapshot, after captures the row, actor = creating user), and one that forces the in-tx audit write to FK-violate after the INSERT and asserts neither the task nor an audit row survives the rollback.

#PMS-318

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

create_task INSERTed the task row and committed without ever calling audit_write, so the task's change-history feed never showed the create event even though the viewer endpoint and the sibling update_task/update_project paths in the same file already write audit rows. The fix is additive: thread the AuditCtx extractor into the create_task handler (mirroring update_task) and, inside the existing transaction, snapshot the inserted row via to_jsonb and call audit_write with action=Create, resource_type="tasks", before=NULL, after=row snapshot, before commit. Wrapping the audit row in the same tx as the INSERT means a rollback drops both. Adds two integration tests: one asserting the create writes an entity-scoped create audit row (no before snapshot, after captures the row, actor = creating user), and one that forces the in-tx audit write to FK-violate after the INSERT and asserts neither the task nor an audit row survives the rollback. #PMS-318 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(projects): emit Create audit row on task creation
All checks were successful
E2E / Playwright against staging (pull_request) Successful in 39s
Details
Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m5s
Details
Integration / integration tests (pull_request) Successful in 2m52s
Details
649c82030f 
create_task INSERTed the task row and committed without ever calling audit_write, so the task's change-history feed never showed the create event even though the viewer endpoint and the sibling update_task/update_project paths in the same file already write audit rows. The fix is additive: thread the AuditCtx extractor into the create_task handler (mirroring update_task) and, inside the existing transaction, snapshot the inserted row via to_jsonb and call audit_write with action=Create, resource_type="tasks", before=NULL, after=row snapshot, before commit. Wrapping the audit row in the same tx as the INSERT means a rollback drops both.

Adds two integration tests: one asserting the create writes an entity-scoped create audit row (no before snapshot, after captures the row, actor = creating user), and one that forces the in-tx audit write to FK-violate after the INSERT and asserts neither the task nor an audit row survives the rollback.

#PMS-318

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(audit): emit Create audit rows for every remaining create path
All checks were successful
E2E / Playwright against staging (pull_request) Successful in 1m20s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 3m38s
Details
Integration / integration tests (pull_request) Successful in 4m43s
Details
2a173e48bb 
Following the create_task fix, sweep the rest of the codebase so every create path writes a Create row to audit_log, surfaced uniformly by the existing change-history viewer. Each create service method now takes the AuditCtx (threaded from its route handler) and, inside the existing transaction, snapshots the inserted row via to_jsonb and calls audit_write(action=Create, before=NULL, after=row) before commit, so a rollback drops the inserted row and its audit row together.

Covered: projects (create_project, create_project_phase, create_task_status, create_project_type, add_task_dependency); tickets (add_note, create_status, create_priority, create_type, create_queue, create_category); calendar (create_appointment, create_time_off, create_on_call_schedule); sla (create_policy, create_business_hours, create_holiday_calendar); notifications (create_channel, create_template, create_rule); assets (create_asset alongside its existing asset_audit_log write, create_asset_type, create_asset_relationship, upsert_configuration_item); rmm (create_connection, create_device_mapping, create_alert_rule); knowledge_base (create_category, create_article); time_tracking (create_work_type, create_time_entry, create_rounding_rule); billing (create_payment_term); auth (create_api_key); invitations (create).

Secret-bearing snapshots are stripped before the audit write: api_keys drops key_hash, configuration_items drops value_encrypted. Service-level tests that call the changed create methods directly now pass an AuditCtx. mileage_tracking::create_mileage_entry is the only remaining gap; it lives on the unmerged PMS-315 branch and is audited there.

#PMS-318
nrupard deleted branch fix/pms-318-create-task-audit-row 2026-06-16 21:30:19 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!282
No description provided.