Security/add logging - #94
Open
pablo-schmeiser wants to merge 16 commits into
Open
Conversation
- Add non-field error handling and improve already present error handling in shift creation - Remove green hghlighting for valid, but optional form fields and removing green checkmark from optional form select fields
This is a combination of 5 commits. - chore: Create Mixins for shared, inherited behavior - chore: Refactor shared membership inheritance - chore: Register models to admin view in helper function - chore: Refactor URL patterns to use shared organization CRUD helper - chore: Refactor URL patterns to utilize organization_crud_paths for events and shifts
This is a combination of 3 commits. - fix: Group details were not reachable due to same url - fix: Correct inheritance order for OrganizationCreateUpdateMixin - fix: Refactor delete view classes to fix inheritance issue
This is a combination of 3 commits. - chore: Refactor form templates to use shared remove/restore button component - chore: Refactor often reused buttons to deduplicate code and fix modal backdrop behavior NOTE: Modal is now top-level to correct behavior. Temporary patch for iOS was removed and should be tested on iOS in the future. - chore: Refactor modal trigger components to reduce duplication and improve maintainability
This is a combination of 9 commits. - chore: Add coverage configuration and update dependencies for testing - test: Add set_language to tests - test: Add unit tests for user and membership forms to improve coverage - test: Add unit tests for user authentication and email confirmation flows - fix: Update SSO login condition to check if OAUTH is enabled - test: Add unit tests for SSO login and protected content views - test: Consolidate DOM manipulation tests and improve structure - Introduced a new `dom-harness.cjs` file to centralize DOM-related utilities for testing. - Created various test files for different components, including formset, modal handlers, navigation, sliders, save and restore functionality, and theme toggle. - Refactored class list and element creation logic to reduce duplication across tests. - Enhanced test setups to better simulate user interactions and DOM events. - Improved assertions for clarity and accuracy in testing expected behaviors. - test: Add unit tests for BaseMixin and permission handling in views - docs: Add Testing Quality Scorecard documentation
- Removed member_shift_summary template and integrated its functionality into shift_users_summary. - Updated templates to use shift_users_summary for displaying user shifts. - Added non-org participants to summary. - Introduced tests for shift_users_summary functionality and filtering behavior.
…confirmation with logging and rate limiting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces comprehensive activity and audit logging across the application. By recording key events related to organizations, memberships, and shifts, it provides a transparent audit trail for user actions, significantly improving the platform's security posture and accountability.
Security Mitigations (CWEs)
prune_org_activity_logs) to proactively manage and purge old activity logs, preventing the database from growing indefinitely.Key Changes
OrganizationActivityLogmodel to store detailed audit records.ActivityLogService(services/activity_log.py) to easily capture events across the application.Organization,Membership, andMembershipTypeviews to log when users join, leave, or modify organization structures.Shift,RecurringShift, andParticipantviews to track scheduling changes and participant management.organization_activity_log.html) so organization admins can review historical actions.prune_org_activity_logsmanagement command to safely expire and delete outdated logs.test_activity_log_command.pyalongside extensive updates to existing view tests. IntroducedPkUrlRuntimeSmokeTest(test_urls.py) to verify that all primary key-based routes render correctly without 404/500 errors.NOTE TO REVIEWERS
This should be merged after #93