diff --git a/doc/administration/settings/import_and_export_settings.md b/doc/administration/settings/import_and_export_settings.md index 221bfb843bdf45c65efce960f8fafa1c92f7ede1..d139a90ef0e371a2bc142eb0f7f4289f48198e87 100644 --- a/doc/administration/settings/import_and_export_settings.md +++ b/doc/administration/settings/import_and_export_settings.md @@ -69,12 +69,13 @@ The same setting ## Enable silent admin exports > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/151278) in GitLab 17.0 [with a flag](../../administration/feature_flags.md) named `export_audit_events`. Disabled by default. +> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/152143) for file export downloads in GitLab 17.1. FLAG: The availability of this feature is controlled by a feature flag. For more information, see the history. Enable silent admin exports to prevent [audit events](../audit_event_reports.md) when -instance administrators trigger a [project or group file export](../../user/project/settings/import_export.md). +instance administrators trigger a [project or group file export](../../user/project/settings/import_export.md) or download the export file. Exports from non-administrators still generate audit events. To enable silent admin project and group file exports: diff --git a/ee/app/controllers/ee/projects_controller.rb b/ee/app/controllers/ee/projects_controller.rb index 565c8419292ac3b645e4c246d6cd43643c8f55ca..eca12c7e91d063b8a554383421a0f08fb217467f 100644 --- a/ee/app/controllers/ee/projects_controller.rb +++ b/ee/app/controllers/ee/projects_controller.rb @@ -202,6 +202,8 @@ def log_audit_event(message:, event_type:) end def log_download_export_audit_event + return if current_user.can_admin_all_resources? && ::Gitlab::CurrentSettings.silent_admin_exports_enabled? + log_audit_event(message: 'Export file download started', event_type: 'project_export_file_download_started') end diff --git a/ee/spec/controllers/projects_controller_spec.rb b/ee/spec/controllers/projects_controller_spec.rb index 54a34f42e8bc18010d82e40808f7285f17b6985e..b41de746e100aaa9d0dd8eedaf60bac6f01e7939 100644 --- a/ee/spec/controllers/projects_controller_spec.rb +++ b/ee/spec/controllers/projects_controller_spec.rb @@ -719,6 +719,25 @@ let_it_be(:audit_name) { 'project_export_file_download_started' } let_it_be(:custom_message) { 'Export file download started' } end + + context 'when user is admin', :enable_admin_mode do + let_it_be(:user) { create(:admin) } + + it_behaves_like 'audit events with event type' do + let_it_be(:audit_name) { 'project_export_file_download_started' } + let_it_be(:custom_message) { 'Export file download started' } + end + + context 'when silent exports enabled' do + before do + stub_application_setting(silent_admin_exports_enabled: true) + end + + it 'does not log an audit event' do + expect { request }.not_to change { AuditEvent.count } + end + end + end end context 'when project export is disabled' do