zentralopensource / zentral / 32759078048

91%

push

github

monolith: publish audit events from the API views

The Monolith API changed a catalog, a condition, an enrollment or a manifest
enrollment package with no record of it. The web console publishes a
zentral_audit event for the same objects, so the API was the only way to change
them without a trace.

Eight views move to the ListCreateAPIViewWithAudit and the
RetrieveUpdateDestroyAPIViewWithAudit bases. The bases give the permission
classes and the filter backend, so the views do not declare them again. The
three perform_destroy methods that refuse to delete an object in use call
super(), and the audit event of the base is published after their check.

The delete of a manifest enrollment package needs an argument: its
perform_destroy calls delete(delete_enrollment=False), because the API takes an
enrollment that it did not create and must only release it. The console creates
the enrollment with the package, and deletes the two of them together.

RetrieveUpdateDestroyAPIViewWithAudit calls delete() with the keyword arguments
of the new get_perform_destroy_kwargs() now, which gives an empty dict by
default. DestroyModelMixin.perform_destroy calls delete() with no argument, so
nothing changes for the other views. The manifest enrollment packages give the
argument they need, and keep the audit event.

These endpoints also answer a PATCH with a 405 now, because the bases accept
only the full updates.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

14 of 14 new or added lines in 2 files covered. (100.0%)

51291 of 56857 relevant lines covered (90.21%)

0.9 hits per line