The GitHub Actions job "Build" on jackrabbit-oak.git/issue/OAK-12331-impl has 
failed.
Run started by GitHub user dulvac (triggered by dulvac).

Head commit for run:
eead6ab0875cbd46191f575f0dbf9dd0e62f0696 / Andrei Dulvac <[email protected]>
OAK-12331: add an audit event SPI with commit-attached capture and observer 
drain

Adds a pluggable audit SPI so consumers can observe repository operations
without patching Oak internals. Off by default behind the FT_OAK-12331
feature toggle. With the toggle off, or with no audit module deployed, the
capture path short-circuits through a NOOP sink.

New SPI, oak-core-spi (package org.apache.jackrabbit.oak.spi.audit):

  AuditEvent, AuditEventImpl   immutable event: domain, type, timestamp,
                               payload
  AuditEvents                  static facade over a pluggable Sink; NOOP
                               until an audit module installs one
  AuditEventListener           consumer contract, selects by domain, orders
                               by rank
  AuditEventEmitter            OSGi-facing emitter for the fire-and-forget
                               path
  AuditBufferLifecycle         session lifecycle callouts used by MutableRoot

oak-security-spi contributes the security domain name and the
user-management type vocabulary (SecurityAuditDomain, UserAuditTypes) so
listener bundles compile against a stable set of strings.

Pipeline, oak-core (org.apache.jackrabbit.oak.security.audit):

Capture sites buffer events per session in a ThreadLocal. AuditDrainObserver
runs as an Observer on the root NodeStore, and because observers fire after
durable persistence and never for a failed merge, a dispatched event always
corresponds to a persisted write. The drain is destructive, so a store that
invokes the observer twice for one merge dedupes itself. CommitMetadataDecorator
stamps the three reserved commit.* keys at drain time, overwriting anything a
caller supplied; the fire-and-forget path strips those keys instead, so their
presence attests that an event came from Oak's commit-attached pipeline.
An outer Throwable barrier in contentChanged keeps a failing listener from
surfacing as a commit failure to the merge caller.

MutableRoot drains on refresh() and on a failed merge, and deliberately does
not drain on rebase(), which keeps transient changes and replays them on the
new base. The audit events captured alongside those surviving changes have to
survive with them.

The only instrumented capture sites so far are the two UserManagerImpl
onGroupUpdate overloads, covering single and bulk group membership changes.
Path resolution failures there drop the event and log rather than failing the
surrounding update, with repeat warnings demoted to DEBUG.

AuditConfigurationImpl owns the lifecycle. It registers as AuditConfiguration
only, contributes no commit hooks, and is not a SecurityConfiguration, so it
stays out of SecurityProvider.getConfiguration(). Under OSGi it publishes the
observer as a service for ObserverTracker to pick up; embedded callers get it
from getDrainObserver() and attach it themselves.

Also adds an audit-enabled in-memory fixture to oak-run-commons and two
oak-benchmarks runs that measure capture-site and empty-commit overhead.

Documentation is submitted separately as a companion change.

Report URL: https://github.com/apache/jackrabbit-oak/actions/runs/30546606382

With regards,
GitHub Actions via GitBox

Reply via email to