Unleash / unleash / 34333860587

87%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

feat(audit): adds user-agent to audit events for user-initiated events only - EG-4693

Closes [EG-4693](https://linear.app/unleash/issue/EG-4693)

## Issue

Customer's CSOC needs `user-agent` on the audit logs we replicate to S3
(Samely it's done for login/logout events). Access logs already carry
it, audit-events didn't.


### What we did

In this PR we add `user-agent` to audit events, but only for
user-initiated ones. This is behind a `"auditEventUserAgent"` flag (off
by default).

By tech decision, we track only reqs that create audit-events not all of
them.

Rest of scheduled change requests, automated actions, bg jobs, anything
under the system-audit-user do NOT get the 'user-agent' info. As there's
no HTTP req behind those, there's nothing to record => these rows store
`null` intentionally, so we can tell "NO user agent" from "empty user
agent".

### How it works

`extractAuditInfo(req)` builds the audit-context for a req, and it's the
only place a user-agent can get in. So that's where we read the header,
check the flag and clean the value:

```ts
userAgent: captureUserAgent ? sanitizeUserAgent(extractUserAgent(req)) : undefined
```

### Where it shows up

- new db column `user_agent` on `events` (nullable)
- the S3 audit export, as `userAgent`
- **not** the event search API or the UI 
- `auditEventFields(auditUser)` - 15 events were hand-writing
`createdBy` / `createdByUserId` / `ip` as object literals. One helper
now, so the next audit column is a one-line change instead of a 15-file
sweep.
- import-toggles was rebuilding its audit context with
`extractAuditInfoFromUser`, which throws the request away. It passes
`auditUser` straight through now.

### Tests

- unit: sanitizing, flag on/off, and a check of every entry point that
is *not* user-initiated
- e2e via real HTTP stack: one req that produces both a user-attributed
and a system-attributed event, proving only the first gets a
'user-agent' field

How we tested it:

- Run the app with the... (continued)

Coverage Stats

3961 of 5167 branches covered (76.66%)

20 of 20 new or added lines in 6 files covered. (100.0%)

7 existing lines in 1 file now uncovered.

16188 of 18531 relevant lines covered (87.36%)

854.87 hits per line