zentralopensource / zentral / 30750576016

90%

Build Type

push

github

Committed by np5

Commit Message

Let the audit views tag their events with a machine serial number

AuditEvent.build_from_request_and_instance() takes a machine_serial_number, so an
event about one device lands on that device's timeline, but the audit view mixins
called it with fixed arguments. Only the hand-rolled sites could pass it, which is
why the views that audit a machine scoped object could not.

The five audit views now call get_audit_machine_serial_number(), which defaults to
None, so every existing view keeps its payload and its metadata unchanged. The
default lives in a new AuditViewMixin shared by the three Django views; the DRF
pair keep their own copy because their on_commit_callback_extra() takes the
instance and the two hierarchies have nothing else in common.

ChangeEnrolledDeviceBlueprintView is the first view to override it, so the hook
ships with a caller rather than as an unused extension point. It also needed the
blueprint in EnrolledDevice.serialize_for_event(): the view changes nothing else,
so without it prev_value and new_value would have matched and the event would have
recorded that something changed without saying what, the same trap blocked_at had
to be added to avoid.

The realm group tag mappings are audited too. They decide the tags a device
inherits from its user's groups, and their three views were plain model views
waiting on a serializer for a model that had none.

Their tests look for the audit event rather than taking the first posted event:
update_realm_tags() posts its own machine tag events from the same request, so
neither the callback count nor the position of the audit event is fixed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Coverage Stats

22 of 23 new or added lines in 4 files covered. (95.65%)

1 existing line in 1 file now uncovered.

49956 of 55773 relevant lines covered (89.57%)

0.9 hits per line