Commit 4b6ac32f authored by Toon Claes's avatar Toon Claes Committed by Toon Claes

Only grant access to Admin Audit Log when feature available

Only when the license allows Admin Audit Log, show the Audit Log
button on the Admin page and make it possible to visit that
page (return 404 otherwise).
parent e40addab
class Admin::AuditLogsController < Admin::ApplicationController
before_action :check_license_admin_audit_log_available!
def index
@events = LogFinder.new(audit_logs_params).execute
@entity = case audit_logs_params[:event_type]
......@@ -16,4 +18,8 @@ class Admin::AuditLogsController < Admin::ApplicationController
def audit_logs_params
params.permit(:page, :event_type, :user_id, :project_id, :group_id)
end
def check_license_admin_audit_log_available!
render_404 unless License.feature_available?(:admin_audit_log)
end
end
......@@ -27,7 +27,4 @@
= link_to admin_requests_profiles_path, title: 'Requests Profiles' do
%span
Requests Profiles
= nav_link path: 'audit_logs#index' do
= link_to admin_audit_logs_path, title: 'Audit Log' do
%span
Audit Log
= render 'admin/monitoring/ee/nav'
- if License.feature_available?(:admin_audit_log)
= nav_link path: 'audit_logs#index' do
= link_to admin_audit_logs_path, title: 'Audit Log' do
%span
Audit Log
......@@ -9,75 +9,99 @@ describe 'Admin::AuditLogs', feature: true, js: true do
sign_in(create(:admin))
end
describe 'user events' do
context 'unlicensed' do
before do
AuditEventService.new(user, user, with: :ldap)
.for_authentication.security_event
stub_licensed_features(admin_audit_log: false)
end
it 'returns 404' do
visit admin_audit_logs_path
expect(page.status_code).to eq(404)
end
end
it 'filters by user' do
filter_by_type('User Events')
context 'licensed' do
before do
stub_licensed_features(admin_audit_log: true)
end
click_button 'User'
wait_for_requests
it 'has Audit Log button in head nav bar' do
visit admin_audit_logs_path
within '.dropdown-menu-user' do
click_link user.name
expect(page).to have_link('Audit Log', href: admin_audit_logs_path)
end
describe 'user events' do
before do
AuditEventService.new(user, user, with: :ldap)
.for_authentication.security_event
visit admin_audit_logs_path
end
wait_for_requests
it 'filters by user' do
filter_by_type('User Events')
expect(page).to have_content('Signed in with LDAP authentication')
end
end
click_button 'User'
wait_for_requests
describe 'group events' do
let(:group_member) { create(:group_member, user: user) }
within '.dropdown-menu-user' do
click_link user.name
end
before do
AuditEventService.new(user, group_member.group, { action: :create })
.for_member(group_member).security_event
wait_for_requests
visit admin_audit_logs_path
expect(page).to have_content('Signed in with LDAP authentication')
end
end
it 'filters by group' do
filter_by_type('Group Events')
describe 'group events' do
let(:group_member) { create(:group_member, user: user) }
click_button 'Group'
find('.group-item-select').click
wait_for_requests
find('.select2-results').click
before do
AuditEventService.new(user, group_member.group, { action: :create })
.for_member(group_member).security_event
find('#events-table td', match: :first)
visit admin_audit_logs_path
end
expect(page).to have_content('Added user access as Owner')
end
end
it 'filters by group' do
filter_by_type('Group Events')
describe 'project events' do
let(:project_member) { create(:project_member, user: user) }
click_button 'Group'
find('.group-item-select').click
wait_for_requests
find('.select2-results').click
before do
AuditEventService.new(user, project_member.project, { action: :destroy })
.for_member(project_member).security_event
find('#events-table td', match: :first)
visit admin_audit_logs_path
expect(page).to have_content('Added user access as Owner')
end
end
it 'filters by project' do
filter_by_type('Project Events')
describe 'project events' do
let(:project_member) { create(:project_member, user: user) }
before do
AuditEventService.new(user, project_member.project, { action: :destroy })
.for_member(project_member).security_event
visit admin_audit_logs_path
end
it 'filters by project' do
filter_by_type('Project Events')
click_button 'Project'
find('.project-item-select').click
wait_for_requests
find('.select2-results').click
click_button 'Project'
find('.project-item-select').click
wait_for_requests
find('.select2-results').click
find('#events-table td', match: :first)
find('#events-table td', match: :first)
expect(page).to have_content('Removed user access')
expect(page).to have_content('Removed user access')
end
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment