Method handlePutDbAuditConfig

rest/admin_api.go:929–1011

PUT/POST audit config for database

()

// PUT/POST audit config for database
func (h *handler) handlePutDbAuditConfig() error {

	var bodyRaw []byte
	var previousAuditEnabled, updatedAuditEnabled bool
	var updatedAuditEvents []uint
	err := h.mutateDbConfig(func(config *DbConfig) error {
		previousAuditEnabled, _ = config.IsAuditLoggingEnabled()
		bodyRaw, err := h.readBody()
		if err != nil {
			return err
		}
		var body HandleDbAuditConfigBody
		if err := base.JSONUnmarshal(bodyRaw, &body); err != nil {
			return err
		}

		// isReplace if the request is a PUT, and we want to overwrite existing config
		isReplace := h.rq.Method == http.MethodPut

		// This API endpoint takes audit config in a format that does not match the actual DbConfig stored, so translate the request here.
		toChange := make(map[base.AuditID]bool, len(body.Events))
		var multiError *base.MultiError
		for id, val := range body.Events {
			// find the event
			auditID, err := base.ParseAuditID(id)
			if err != nil {
				multiError = multiError.Append(fmt.Errorf("invalid audit event ID: %q", id))
				continue
			}
			_, ok := base.AuditEvents[auditID]
			if !ok {
				multiError = multiError.Append(fmt.Errorf("unknown audit event ID: %q", auditID))
				continue
			}

			var eventEnabled bool
			switch valT := val.(type) {
			case bool:
				eventEnabled = valT
			case map[string]any:
				// verbose format
				eventEnabled = valT["enabled"].(bool)
			}

			// check if explicitly disabled events are allowed to be filtered
			// we'll ensure that non-filterable events are always considered enabled at runtime instead of at config persistence time
			// this will ensure we are able to add events in the future that are non-filterable and have them work correctly
			if e, ok := base.AuditEvents[auditID]; !ok {
				multiError = multiError.Append(fmt.Errorf("unknown audit event ID: %q", auditID))
			} else if e.IsGlobalEvent {
				multiError = multiError.Append(fmt.Errorf("event %q is not configurable at the database level", auditID))
			} else if !e.FilteringPermitted && !eventEnabled {
				multiError = multiError.Append(fmt.Errorf("event %q is not filterable and cannot be disabled", auditID))
			} else {
				toChange[auditID] = eventEnabled
			}
		}
		if err := multiError.ErrorOrNil(); err != nil {