[3.3.6 Backport] CBG-5395: User Access History Compaction#8328
Merged
Conversation
Redocly previews |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for inspecting and compacting user channel revocation history (access history) via new admin endpoints, including audit events and OpenAPI documentation, plus coverage in unit, REST, and upgrade tests.
Changes:
- Add admin REST endpoints to GET a user’s access history and POST compaction requests to remove selected channels from that history.
- Introduce auth-layer helpers for enumerating collection-scoped history and compacting history entries by channel key.
- Add audit event IDs/tests and OpenAPI paths/schemas for the new endpoints (including upgrade tests covering default + named collections).
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| rest/user_api_test.go | Adds REST tests for GET access history and POST compaction across single and multi-collection setups. |
| rest/upgradetest/user_access_history_test.go | Adds upgrade tests ensuring access history/compaction works after adding a named collection to a default-only DB. |
| rest/routing.go | Registers the new admin routes for access history read and compaction. |
| rest/revocation_test.go | Extends revocation test to compact access history and validate behavior post-compaction. |
| rest/audit_test.go | Adds audit-log tests for the new access history read/compact audit events. |
| rest/admin_api.go | Implements the new admin handlers and response types for access history read/compaction. |
| docs/api/paths/admin/db-_user-name-_access_history.yaml | Documents the new GET endpoint. |
| docs/api/paths/admin/db-_user-name-_access_history-compact.yaml | Documents the new POST compaction endpoint. |
| docs/api/components/schemas.yaml | Adds/extends schemas to represent collection-scoped access history and compaction responses. |
| docs/api/admin.yaml | Exposes the new paths in the admin OpenAPI entrypoint. |
| base/audit_events.go | Adds new audit event IDs and event metadata for access history read/compaction. |
| auth/user_test.go | Adds unit tests for channel-history compaction behavior across scopes/collections. |
| auth/role.go | Adds keyed pruning and a CompactChannelHistory method on principals. |
| auth/role_collection_access.go | Adds CollectionAccessHistory type and collection-scoped history extraction logic. |
| auth/principal.go | Extends Principal interface with CompactChannelHistory and collection history access via embedded APIs. |
| auth/collection_access.go | Extends collection-channel API with GetCollectionAccessHistory (plus comment typo fix needed). |
Comment on lines
+2394
to
+2404
| colAccessHistoryMap := make(map[string]map[string][]string) | ||
| for scope, cols := range reqUserChannelHistory.Channels { | ||
| colAccessHistoryMap[scope] = make(map[string][]string) | ||
| for col, colVal := range cols { | ||
| colAccessHistoryMap[scope][col] = user.CompactChannelHistory(scope, col, colVal) | ||
| } | ||
| } | ||
|
|
||
| userCompactedChannelHistory := CompactUserAccessHistoryResponse{ | ||
| CompactedChannels: colAccessHistoryMap, | ||
| } |
Comment on lines
+2371
to
+2374
| h.writeJSON(userChannelHistory) | ||
|
|
||
| return err | ||
| } |
| $ref: ../../components/responses.yaml#/Not-found | ||
| tags: | ||
| - Database Security | ||
| operationId: get_db-_user-name-_history |
| $ref: ../../components/responses.yaml#/Not-found | ||
| tags: | ||
| - Database Security | ||
| operationId: post_db-_user-name-_history-compact |
Comment on lines
+43
to
+51
| '400': | ||
| description: Bad request. Invalid channel names or malformed request body. | ||
| content: | ||
| application/json: | ||
| schema: | ||
| $ref: ../../components/schemas.yaml#/HTTP-Error | ||
| example: | ||
| error: "Bad Request" | ||
| reason: "Invalid channel format: channels must be non-empty strings" |
Comment on lines
+69
to
+70
| // Returns the ColelctionAccessHistory map | ||
| GetCollectionAccessHistory() CollectionAccessHistory |
Comment on lines
+656
to
+657
| // First ch1 succeeds (returns true), second ch1 fails (already deleted, returns false in the map check) | ||
| // So we get ch1 and ch2 in the result. The function returns duplicates if passed duplicates. |
adamcfraser
requested changes
Jun 4, 2026
adamcfraser
left a comment
adamcfraser
left a comment
Collaborator
There was a problem hiding this comment.
Generally looks fine, but want to confirm some content in api docs that may not be necessary to backport.
| type: string | ||
| example: This is an info message produced by console.log("test"). | ||
|
|
||
| ClusterInfo: |
Collaborator
There was a problem hiding this comment.
There are a number of definitions being backported here that don't look like they are necessary for the User Access History API. Are those intentional?
adamcfraser
requested changes
Jun 5, 2026
adamcfraser
left a comment
adamcfraser
left a comment
Collaborator
There was a problem hiding this comment.
You've removed the schema doc entirely here, instead of revoking the unnecessary backports to it.
# Conflicts: # rest/audit_test.go
This reverts commit 2703945.
adamcfraser
approved these changes
Jun 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CBG-5395
Describe your PR here...
Pre-review checklist
fmt.Print,log.Print, ...)base.UD(docID),base.MD(dbName))docs/apiDependencies (if applicable)
Integration Tests