Exclude read access of Disease- and FeatureConfigurationFacade and the Infrastructure facades from the audit log [3]

[MartinWahnschaffe]

Problem Description

Read access to those facades is not relevant for the audit log and leads to a lot of unnecessary entries.

Proposed Change

• Find a generic way to ignore all read calls to those facades in AuditLoggerInterceptor. The logic in AudiLoggerEjb.inferBackendAction may be of help.
• Also take care of ExternalSurveillanceToolGatewayFacadeEjb.isFeatureEnabled() and SormasToSormasFacadeEjb.isAnyFeatureConfigured
• UserRoleFacadeEjb.getAllActiveAsReference() should be removed
• DistrictFacadeEjb.getAllActiveByRegion(java.lang.String)
• CommunityFacadeEjb.getAllActiveByRegion(java.lang.String)
• PointOfEntryFacadeEjb.getAllActiveByRegion(java.lang.String)
• DiseaseConfigurationFacadeEjb.getAllDiseases

Acceptance Criteria

• Call to FeatureConfigurationFacade.isFeatureEnabled is no longer logged
• Call to FeatureConfigurationFacade.saveFeatureConfiguration is still logged. Can be tested using LineListingResource.postFeatureConfigurations (lineListing/push)

Implementation Details

Additional Information

[JonasCir]

Hey @MartinWahnschaffe I see the following ways:

1. exclude the methods of FeatureConfigurationFacade by manually adding them to the deny-list
2. special case FeatureConfigurationFacade and re-use inferBackendAction somehow
3. do not special case and introduce an annotation à la @FacadeMethodInclude which we put on saveFeatureConfiguration etc to include them. We could get rid of ignoreAuditMethods by introducing a @FacadeMethodIgnore. We use the reflections library to scan for the methods in the static initializer.

[MartinWahnschaffe]

As discussed let's use the following approach:

1. Introduce an annotation that allows to ignore whole methods and classes. I'm not sure what's the best way to differentiate this from the existing AuditInclude/Excluse annotation used for dtos. To me those names would be a better fit to what we need here so maybe the existing annotation should be renamed to AuditPropertyInclude/Exclude
2. Introduce a class annotation that allows to exclude read-only methods from auditing. Can re-use the inferBackendAction logic to build a cache of methods to be ignored.