🔦 Feature: Improve audit logs to properly show REST API calls

[RawmanGrey]

I'm not certain if following should be considered as a feature request or as a bug report... But I feel that logs have to include data on all changes triggered by third party. Below tested endpoints are listed along with checked boxes, if changes are shown in logs:

---

POST <BASE_URL>/api/v1/db/data/<orgs=noco>/<project_name>/<table_name>/views/<view_name*>/

• 'xc-auth'
• 'xc-token' - 'Shared base' user mentioned in logs, I believe that token name should be used instead.

---

POST <BASE_URL>/api/v1/db/data/bulk/<orgs=noco>/<project_name>/<table_name>/

• 'xc-auth'
• 'xc-token'

---

PATCH <BASE_URL>/api/v1/db/data/<orgs=noco>/<project_name>/<table_name>/views/<view_name*>/<row_id>

• 'xc-auth'
• 'xc-token'

---

PATCH <BASE_URL>/api/v1/db/data/bulk/<orgs=noco>/<project_name>/<table_name>/

• 'xc-auth'
• 'xc-token'

---

DELETE <BASE_URL>/api/v1/db/data/<orgs=noco>/<project_name>/<table_name>/views/<view_name*>/<row_id>

• 'xc-auth'
• 'xc-token' - same 'Shared base' issue.
  I think, showing 'undefined' is not enough: at least some of deleted data should present.
  

---

DELETE <BASE_URL>/api/v1/db/data/<orgs=noco>/<project_name>/<table_name>/all

• 'xc-auth'
• 'xc-token'

---

*Same results if '/views/<view_name>/' part omitted.

project info

Node: v12.22.12
Arch: x64
Platform: linux
Docker: true
Database: pg
ProjectOnRootDB: true
RootDB: pg
PackageVersion: 0.90.11

[RawmanGrey]

@o1lab, unfortunately adding "xc-gui: true" header we discussed yesterday has no effect, requests are mentioned in logs same as in this feature request.

As of v.0.90.10, authorizing API calls with JWT passed with 'xc-auth' header is no longer an option (legit!), so having API token's name shown in logs is a must.

[dstala]

We have enhanced / revamped Record Audit experience for OSS. If you still notice any REST API related to record audits not getting captured, please reopen this ticket.

Note that, Shared base & hence edits via shared base are deprecated. Hence those will not be accounted for.

Public shared form submissions can be identified by using "fk_user_id" field in the audit table (will be marked as anonymous in the audit log UI)