Skip to content

chore: add audit logs for access grant mutations#1972

Closed
tgmendes wants to merge 5 commits intomainfrom
feat/access-service-audit-logs
Closed

chore: add audit logs for access grant mutations#1972
tgmendes wants to merge 5 commits intomainfrom
feat/access-service-audit-logs

Conversation

@tgmendes
Copy link
Copy Markdown
Contributor

@tgmendes tgmendes commented Mar 24, 2026

Summary

  • add audit logging helpers and subject type for access grant mutations
  • audit access grant upserts, removals, and principal grant removals with per-grant rows and before/after snapshots where relevant
  • add access service tests covering audit rows for success, failure, no-op, and read-only paths

Open with Devin

@tgmendes tgmendes requested a review from a team as a code owner March 24, 2026 17:57
@vercel
Copy link
Copy Markdown

vercel bot commented Mar 24, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
gram-docs-redirect Ready Ready Preview, Comment Mar 25, 2026 10:26am

Request Review

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 24, 2026

🦋 Changeset detected

Latest commit: 6c5044f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

Open in Devin Review

func (s *Service) ListGrants(ctx context.Context, payload *gen.ListGrantsPayload) (*gen.ListGrantsResult, error) {
authCtx, ok := contextvalues.GetAuthContext(ctx)
if !ok || authCtx == nil {
if !ok || authCtx == nil || authCtx.ActiveOrganizationID == "" {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Org id being empty should never be true at this point of the call stack

return oops.E(oops.CodeUnexpected, err, "failed to remove principal grants").Log(ctx, s.logger)
}

for _, row := range existingRows {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to be spammy. Instead produce a slice of removed grants and pass that as metadata to a single audit event. The UI will then unpack that event.

@tgmendes
Copy link
Copy Markdown
Contributor Author

We are getting rid of these endpoints so closing this PR for now.

@tgmendes tgmendes closed this Mar 31, 2026
@github-actions github-actions bot locked and limited conversation to collaborators Mar 31, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants