cameleer/cameleer-server
1
0
Fork 0
Code Issues 41 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(audit): exclude env-scoped executions/search from safety-net log
All checks were successful
CI / cleanup-branch (push) Has been skipped
Details
CI / build (push) Successful in 1m24s
Details
CI / docker (push) Successful in 1m1s
Details
CI / deploy-feature (push) Has been skipped
Details
CI / deploy (push) Successful in 37s
Details

Browse Source 
The exclusion list still named the legacy flat `/api/v1/search/executions`
URL, which no longer exists — the endpoint moved to env-scoped
`/api/v1/environments/{envSlug}/executions/search`. Exact-match Set
lookup never matched, so every UI search POST produced an audit row.

Switch to AntPathMatcher over a pattern list so the dynamic envSlug is
handled correctly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
hsiegeln
2026-04-23 17:35:44 +02:00
parent 0fc9c8cb4c
commit 0cf64b2928
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cameleer-server-app/src/main/java/com/cameleer/server/app/interceptor/AuditInterceptor.java
View File

@@ -6,8 +6,10 @@ import com.cameleer.server.core.admin.AuditService;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse; import jakarta.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Component; import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.servlet.HandlerInterceptor; import org.springframework.web.servlet.HandlerInterceptor;
import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
@@ -22,7 +24,9 @@ import java.util.Set;
public class AuditInterceptor implements HandlerInterceptor { public class AuditInterceptor implements HandlerInterceptor {
private static final Set<String> AUDITABLE_METHODS = Set.of("POST", "PUT", "DELETE"); private static final Set<String> AUDITABLE_METHODS = Set.of("POST", "PUT", "DELETE");
private static final Set<String> EXCLUDED_PATHS = Set.of("/api/v1/search/executions"); private static final List<String> EXCLUDED_PATH_PATTERNS = List.of(
"/api/v1/environments/*/executions/search");
private static final AntPathMatcher PATH_MATCHER = new AntPathMatcher();
private final AuditService auditService; private final AuditService auditService;
@@ -41,8 +45,10 @@ public class AuditInterceptor implements HandlerInterceptor {
} }
String path = request.getRequestURI(); String path = request.getRequestURI();
if (EXCLUDED_PATHS.contains(path)) { for (String pattern : EXCLUDED_PATH_PATTERNS) {
return; if (PATH_MATCHER.match(pattern, path)) {
return;
}
} }
AuditResult result = response.getStatus() < 400 ? AuditResult.SUCCESS : AuditResult.FAILURE; AuditResult result = response.getStatus() < 400 ? AuditResult.SUCCESS : AuditResult.FAILURE;