feat: publish sanitized custom.97 source

middleware/audit.go

@@ -268,9 +268,8 @@ func AccessTokenAudit() gin.HandlerFunc {
 		if present {
 			_, internal, _ := service.ParseDashboardAccessToken(raw)
 			if !internal {
-				user, err := model.ValidateAccessToken(raw)
-				if err == nil && user != nil && user.Id > 0 {
-					beginAccessTokenAudit(c, user, raw)
+				if lookup := lookupAccessToken(c, raw); lookup.user != nil {
+					beginAccessTokenAudit(c, lookup.user, lookup.ref)
 					defer finishAccessTokenAudit(c)
 				}
 			}
@@ -279,18 +278,32 @@ func AccessTokenAudit() gin.HandlerFunc {
 	}
 }
 
-func beginAccessTokenAudit(c *gin.Context, user *model.User, token string) {
+func beginAccessTokenAudit(c *gin.Context, user *model.UserBase, tokenRef string) {
 	if _, exists := c.Get(accessTokenAuditContextKey); exists {
 		return
 	}
 	writer := &auditResponseWriter{ResponseWriter: c.Writer, body: bytes.NewBuffer(nil), maxSize: 64 * 1024}
 	c.Writer = writer
 	c.Set(accessTokenAuditContextKey, &accessTokenRequestAudit{
-		entry:  model.AuditLog{UserId: user.Id, Username: user.Username, ActorRole: user.Role, Category: model.AuditCategoryAccessToken, AuthMethod: "access_token", TokenRef: model.AccessTokenFingerprint(token), CreatedAt: common.GetTimestamp(), EventId: common.NewRequestId()},
+		entry:  model.AuditLog{UserId: user.Id, Username: user.Username, ActorRole: user.Role, Category: model.AuditCategoryAccessToken, AuthMethod: "access_token", TokenRef: tokenRef, CreatedAt: common.GetTimestamp(), EventId: common.NewRequestId()},
 		writer: writer,
 	})
 }
 
+// setAccessTokenAuditParam adds non-secret context, such as why a token was
+// rejected, to the current request's access audit entry.
+func setAccessTokenAuditParam(c *gin.Context, key string, value any) {
+	stored, _ := c.Get(accessTokenAuditContextKey)
+	audit, ok := stored.(*accessTokenRequestAudit)
+	if !ok {
+		return
+	}
+	if audit.entry.Other.Op == nil {
+		audit.entry.Other.Op = &model.AuditOperation{Params: model.AuditFields{}}
+	}
+	audit.entry.Other.Op.Params[key] = value
+}
+
 func finishAccessTokenAudit(c *gin.Context) {
 	value, exists := c.Get(accessTokenAuditContextKey)
 	if !exists {