fix: handle API product refs in key audit logs

[pragsty]

Issue

https://gravitee.atlassian.net/browse/APIM-13319

Description

Pausing an API Product subscription updates API keys and writes an audit entry. ApiKeyServiceImpl.createAuditLog always stored AuditProperties.API from subscription.getApi(), which is null for API Product subscriptions. That produced a NULL in audit_properties.value and failed the JDBC insert (NOT NULL).

Change

Resolve referenceId from referenceId with fallback to api.
For referenceType == API_PRODUCT, use API_PRODUCT in audit properties and createApiProductAuditLog; otherwise keep API and createApiAuditLog.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug in the audit logging mechanism for API Product subscriptions. Previously, when an API Product subscription was paused, the system attempted to log an API reference that was null, leading to database errors. The changes introduce robust logic to correctly identify API Product subscriptions, use the appropriate reference ID, and call the specific audit log creation methods for API Products, thereby preventing data integrity issues and ensuring accurate auditing.

Highlights

• Audit Log Fix for API Products: Resolved an issue where pausing an API Product subscription resulted in a NULL value for the API reference in audit logs, causing JDBC insert failures.
• Dynamic Audit Property Assignment: Implemented logic to dynamically determine if a subscription relates to an API Product or a standard API, and assigned the correct Audit.AuditProperties (API_PRODUCT or API) accordingly.
• Conditional Audit Log Creation: Updated the audit log creation mechanism to call createApiProductAuditLog for API Product subscriptions and createApiAuditLog for standard API subscriptions, ensuring the correct audit context is used.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request enhances the audit logging mechanism within the ApiKeyServiceImpl. It introduces the API_PRODUCT audit property and refactors the createAuditLog method to correctly distinguish between API and API Product subscriptions. This ensures that audit events are logged using the appropriate service method (createApiProductAuditLog, createApiAuditLog, or createApplicationAuditLog) based on the subscription's reference type and ID. There is no feedback to provide.

[sonarqubecloud]

Quality Gate passed for 'Gravitee.io APIM - Reporter'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud