Don't create `GroupSaml` membership updates audit events when there is no change
Problem to solve
Right now audit events are created to whenever certain APIs are called. This is great for maintaining visibility whenever actions take place. However, it means that audit events are always created, even when no change has occurred. This can cause the audit log to be filled with events that aren't meaningful. See the screenshot on the epic for an example where no actual changed occurred, yet an event was created.
The audit event located in the
Gitlab::Auth::GroupSaml::MembershipUpdater
might exhibit this
behavior
Proposal
When an audit event is about to be created, check that there actually was a change. If there was, create the event if normal. However, if no change actually occurred, do not create an audit event.
-
add a spec for Gitlab::Auth::GroupSaml::MembershipUpdater
to check against the described behavior -
if the spec fails, make it pass
Implementation Plan
- Write down a class
Audit::MergeRequestDestroyAuditor
- Do the auditing of merge requests destroy in that class and move both
delete_merge_request
andmerged_merge_request_deleted
audit event types in this class - Call this class from
ee/app/services/ee/issuable/destroy_service.rb
- Write down Rspecs
Edited by Harsimar Sandhu