Merge branch 'sh-audit-event-json-log-format-from-and-to' into 'master'

Format `from` and `to` fields in JSON audit log

See merge request gitlab-org/gitlab-ce!30333

3 files changed, 38 insertions, 5 deletions

diff --git a/app/services/audit_event_service.rb b/app/services/audit_event_service.rb
index 201048aaba5..73f3408a240 100644
--- a/app/services/audit_event_service.rb
+++ b/app/services/audit_event_service.rb
@@ -35,8 +35,12 @@ class AuditEventService
     @file_logger ||= Gitlab::AuditJsonLogger.build
   end
 
+  def formatted_details
+    @details.merge(@details.slice(:from, :to).transform_values(&:to_s))
+  end
+
   def log_security_event_to_file
-    file_logger.info(base_payload.merge(@details))
+    file_logger.info(base_payload.merge(formatted_details))
   end
 
   def log_security_event_to_database
diff --git a/changelogs/unreleased/sh-audit-event-json-log-format-from-and-to.yml b/changelogs/unreleased/sh-audit-event-json-log-format-from-and-to.yml
new file mode 100644
index 00000000000..5bd21d7ef2b
--- /dev/null
+++ b/changelogs/unreleased/sh-audit-event-json-log-format-from-and-to.yml
@@ -0,0 +1,5 @@
+---
+title: Format `from` and `to` fields in JSON audit log
+merge_request: 30333
+author:
+type: changed
diff --git a/spec/services/audit_event_service_spec.rb b/spec/services/audit_event_service_spec.rb
index 32fd98e6ef9..e42bff607b2 100644
--- a/spec/services/audit_event_service_spec.rb
+++ b/spec/services/audit_event_service_spec.rb
@@ -10,11 +10,8 @@ describe AuditEventService do
   let(:logger) { instance_double(Gitlab::AuditJsonLogger) }
 
   describe '#security_event' do
-    before do
-      expect(service).to receive(:file_logger).and_return(logger)
-    end
-
     it 'creates an event and logs to a file' do
+      expect(service).to receive(:file_logger).and_return(logger)
       expect(logger).to receive(:info).with(author_id: user.id,
                                             entity_id: project.id,
                                             entity_type: "Project",
@@ -22,5 +19,32 @@ describe AuditEventService do
 
       expect { service.security_event }.to change(SecurityEvent, :count).by(1)
     end
+
+    it 'formats from and to fields' do
+      service = described_class.new(
+        user, project,
+        {
+          from: true,
+          to: false,
+          action: :create,
+          target_id: 1
+        })
+      expect(service).to receive(:file_logger).and_return(logger)
+      expect(logger).to receive(:info).with(author_id: user.id,
+                                            entity_type: 'Project',
+                                            entity_id: project.id,
+                                            from: 'true',
+                                            to: 'false',
+                                            action: :create,
+                                            target_id: 1)
+
+      expect { service.security_event }.to change(SecurityEvent, :count).by(1)
+
+      details = SecurityEvent.last.details
+      expect(details[:from]).to be true
+      expect(details[:to]).to be false
+      expect(details[:action]).to eq(:create)
+      expect(details[:target_id]).to eq(1)
+    end
   end
 end