Examples with SecurityAuditEventTypes org.graylog.security.SecurityAuditEventTypes used on opensource projects

Example 1 with SecurityAuditEventTypes

use of org.graylog.security.SecurityAuditEventTypes in project graylog2-server by Graylog2.

the class AuditCoverageTest method testAuditCoverage.

@Test
public void testAuditCoverage() throws Exception {
    final ConfigurationBuilder configurationBuilder = new ConfigurationBuilder().setUrls(ClasspathHelper.forPackage("org.graylog2")).setScanners(new MethodAnnotationsScanner());
    // TODO: Dynamically discover event types?
    final Set<String> auditEventTypes = ImmutableSet.<String>builder().addAll(new AuditEventTypes().auditEventTypes()).addAll(new PipelineProcessorAuditEventTypes().auditEventTypes()).addAll(new SidecarAuditEventTypes().auditEventTypes()).addAll(new ViewsAuditEventTypes().auditEventTypes()).addAll(new JobSchedulerAuditEventTypes().auditEventTypes()).addAll(new EventsAuditEventTypes().auditEventTypes()).addAll(new SecurityAuditEventTypes().auditEventTypes()).build();
    final Reflections reflections = new Reflections(configurationBuilder);
    final ImmutableSet.Builder<Method> methods = ImmutableSet.builder();
    final ImmutableSet.Builder<Method> missing = ImmutableSet.builder();
    final ImmutableSet.Builder<Method> unregisteredAction = ImmutableSet.builder();
    methods.addAll(reflections.getMethodsAnnotatedWith(POST.class));
    methods.addAll(reflections.getMethodsAnnotatedWith(PUT.class));
    methods.addAll(reflections.getMethodsAnnotatedWith(DELETE.class));
    for (Method method : methods.build()) {
        if (!method.isAnnotationPresent(AuditEvent.class) && !method.isAnnotationPresent(NoAuditEvent.class)) {
            missing.add(method);
        } else {
            if (method.isAnnotationPresent(AuditEvent.class)) {
                final AuditEvent annotation = method.getAnnotation(AuditEvent.class);
                if (!auditEventTypes.contains(annotation.type())) {
                    unregisteredAction.add(method);
                }
            }
        }
    }
    assertThat(missing.build()).describedAs("Check that there are no POST, PUT and DELETE resources which do not have the @AuditEvent annotation").isEmpty();
    assertThat(unregisteredAction.build()).describedAs("Check that there are no @AuditEvent annotations with unregistered event types").isEmpty();
}