diff --git a/ee/app/services/ee/projects/destroy_service.rb b/ee/app/services/ee/projects/destroy_service.rb index 80b9e786f7c169eb54190e89e1e527ed4fccef99..678326fdc595434eabcaa4e9dfaf13a551fa8af4 100644 --- a/ee/app/services/ee/projects/destroy_service.rb +++ b/ee/app/services/ee/projects/destroy_service.rb @@ -79,11 +79,19 @@ def log_geo_event(project) end def log_audit_event(project) - ::AuditEventService.new( - current_user, - project, - action: :destroy - ).for_project.security_event + audit_context = { + name: 'project_destroyed', + author: current_user, + scope: project.parent, + target: project, + message: 'Project destroyed', + target_details: project.full_path, + additional_details: { + remove: 'project' + } + } + + ::Gitlab::Audit::Auditor.audit(audit_context) end end end diff --git a/ee/app/services/projects/mark_for_deletion_service.rb b/ee/app/services/projects/mark_for_deletion_service.rb index 2b4c164daa4a73b7106ba822bb65095b68798fa4..da6f11fec8a6e77ec83c9da4d557d69f7a44ac6a 100644 --- a/ee/app/services/projects/mark_for_deletion_service.rb +++ b/ee/app/services/projects/mark_for_deletion_service.rb @@ -25,12 +25,15 @@ def log_event end def log_audit_event - ::AuditEventService.new( - current_user, - project, - action: :custom, - custom_message: "Project marked for deletion" - ).for_project.security_event + audit_context = { + name: 'project_deletion_marked', + author: current_user, + scope: project, + target: project, + message: 'Project marked for deletion' + } + + ::Gitlab::Audit::Auditor.audit(audit_context) end def project_update_service_params diff --git a/ee/config/audit_events/types/project_deletion_marked.yml b/ee/config/audit_events/types/project_deletion_marked.yml new file mode 100644 index 0000000000000000000000000000000000000000..a8cbf6efb323053835867510af2ee5306058944d --- /dev/null +++ b/ee/config/audit_events/types/project_deletion_marked.yml @@ -0,0 +1,9 @@ +--- +name: project_deletion_marked +description: Event triggered when a project is marked for deletion. +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/374105 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117546 +feature_category: compliance_management +milestone: '15.11' +saved_to_database: true +streamed: true diff --git a/ee/config/audit_events/types/project_destroyed.yml b/ee/config/audit_events/types/project_destroyed.yml new file mode 100644 index 0000000000000000000000000000000000000000..e306ac21a17901b144bd6a348084778b05edc349 --- /dev/null +++ b/ee/config/audit_events/types/project_destroyed.yml @@ -0,0 +1,9 @@ +--- +name: project_destroyed +description: Event triggered when a project is destroyed. +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/374105 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117546 +feature_category: compliance_management +milestone: '15.11' +saved_to_database: true +streamed: true diff --git a/ee/spec/services/projects/destroy_service_spec.rb b/ee/spec/services/projects/destroy_service_spec.rb index 04a792a7957838dd4db11aef100fd480f0ae141e..2334dbfa2011d8a625570d0e6acaa0daa0429dae 100644 --- a/ee/spec/services/projects/destroy_service_spec.rb +++ b/ee/spec/services/projects/destroy_service_spec.rb @@ -112,26 +112,70 @@ end context 'audit events' do - include_examples 'audit event logging' do - let(:operation) { subject.execute } + context 'when the project belongs to a user namespace' do + include_examples 'audit event logging' do + let(:operation) { subject.execute } - let(:fail_condition!) do - expect(project).to receive(:destroy!).and_raise(StandardError.new('Other error message')) + let(:fail_condition!) do + expect(project).to receive(:destroy!).and_raise(StandardError.new('Other error message')) + end + + let(:event_type) { 'project_destroyed' } + + let(:attributes) do + { + author_id: user.id, + entity_id: project.parent.id, + entity_type: 'Namespaces::UserNamespace', + details: { + remove: 'project', + author_name: user.name, + target_id: project.id, + target_type: 'Project', + target_details: project.full_path, + author_class: user.class.name, + custom_message: 'Project destroyed' + } + } + end end + end + + context 'when the project belongs to a group' do + let(:group) { create :group } + let(:project) { create :project, namespace: group } + + subject { described_class.new(project, user, {}).execute } - let(:attributes) do - { - author_id: user.id, - entity_id: project.id, - entity_type: 'Project', - details: { - remove: 'project', - author_name: user.name, - target_id: project.id, - target_type: 'Project', - target_details: project.full_path + before do + group.add_owner(user) + end + + include_examples 'audit event logging' do + let(:operation) { subject } + + let(:fail_condition!) do + expect(project).to receive(:destroy!).and_raise(StandardError.new('Other error message')) + end + + let(:event_type) { 'project_destroyed' } + + let(:attributes) do + { + author_id: user.id, + entity_id: group.id, + entity_type: 'Group', + details: { + remove: 'project', + author_name: user.name, + target_id: project.id, + target_type: 'Project', + target_details: project.full_path, + author_class: user.class.name, + custom_message: 'Project destroyed' + } } - } + end end end end @@ -150,7 +194,7 @@ it 'sends the audit streaming event with json format' do expect(AuditEvents::AuditEventStreamingWorker).to receive(:perform_async).with( - 'audit_operation', + 'project_destroyed', nil, a_string_including("root_group_entity_id\":#{group.id}")) diff --git a/ee/spec/services/projects/mark_for_deletion_service_spec.rb b/ee/spec/services/projects/mark_for_deletion_service_spec.rb index 77ce34feb9413dc33203ac02839acc453f9599b3..7ff60827fd21c448a536f9a573dac79b324025df 100644 --- a/ee/spec/services/projects/mark_for_deletion_service_spec.rb +++ b/ee/spec/services/projects/mark_for_deletion_service_spec.rb @@ -51,6 +51,18 @@ context 'audit events' do it 'saves audit event' do + expect(::Gitlab::Audit::Auditor).to receive(:audit).with( + hash_including(name: 'project_path_updated') + ).and_call_original + + expect(::Gitlab::Audit::Auditor).to receive(:audit).with( + hash_including(name: 'project_name_updated') + ).and_call_original + + expect(::Gitlab::Audit::Auditor).to receive(:audit).with( + hash_including(name: 'project_deletion_marked') + ).and_call_original + expect { described_class.new(project, user).execute } .to change { AuditEvent.count }.by(3) end