[RORDEV-1481] New audit serializers, including fully configurable serializer

audit/src/main/scala/tech/beshu/ror/audit/AuditRequestContext.scala

@@ -21,7 +21,6 @@ import java.time.Instant
 import org.json.JSONObject
 
 trait AuditRequestContext {
-
   def timestamp: Instant
   def id: String
   def correlationId: String
@@ -45,4 +44,5 @@ trait AuditRequestContext {
   def attemptedUserName: Option[String]
   def rawAuthHeader: Option[String]
   def generalAuditEvents: JSONObject
+  def auditEnvironmentContext: AuditEnvironmentContext
 }

audit/src/main/scala/tech/beshu/ror/audit/EnvironmentAwareAuditLogSerializer.scala

@@ -18,6 +18,8 @@ package tech.beshu.ror.audit
 
 import org.json.JSONObject
 
+// The `AuditResponseContext` now contains the `AuditEnvironmentContext` and there is no need to use this trait.
+// This trait is preserved and supported for compatibility reasons, but we should not include it in our docs and use `AuditLogSerializer` instead
 trait EnvironmentAwareAuditLogSerializer {
   def onResponse(responseContext: AuditResponseContext,
                  environmentContext: AuditEnvironmentContext): Option[JSONObject]

audit/src/main/scala/tech/beshu/ror/audit/adapters/DeprecatedAuditLogSerializerAdapter.scala

@@ -18,7 +18,7 @@ package tech.beshu.ror.audit.adapters
 
 import org.json.JSONObject
 import tech.beshu.ror.audit.AuditResponseContext.{Allowed, Verbosity}
-import tech.beshu.ror.audit.instances.SerializeUser
+import tech.beshu.ror.audit.utils.SerializeUser
 import tech.beshu.ror.audit.{AuditLogSerializer, AuditRequestContext, AuditResponseContext}
 import tech.beshu.ror.commons.ResponseContext.FinalState
 import tech.beshu.ror.commons.shims.request.RequestContextShim

audit/src/main/scala/tech/beshu/ror/audit/adapters/EnvironmentAwareAuditLogSerializerAdapter.scala

@@ -19,11 +19,10 @@ package tech.beshu.ror.audit.adapters
 import org.json.JSONObject
 import tech.beshu.ror.audit._
 
-class EnvironmentAwareAuditLogSerializerAdapter(underlying: EnvironmentAwareAuditLogSerializer,
-                                                environmentContext: AuditEnvironmentContext) extends AuditLogSerializer {
+class EnvironmentAwareAuditLogSerializerAdapter(underlying: EnvironmentAwareAuditLogSerializer) extends AuditLogSerializer {
 
   override def onResponse(responseContext: AuditResponseContext): Option[JSONObject] = {
-    underlying.onResponse(responseContext, environmentContext)
+    underlying.onResponse(responseContext, responseContext.requestContext.auditEnvironmentContext)
   }
 
 }

audit/src/main/scala/tech/beshu/ror/audit/instances/BlockVerbosityAwareAuditLogSerializer.scala

@@ -0,0 +1,91 @@
+/*
+ *    This file is part of ReadonlyREST.
+ *
+ *    ReadonlyREST is free software: you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation, either version 3 of the License, or
+ *    (at your option) any later version.
+ *
+ *    ReadonlyREST is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with ReadonlyREST.  If not, see http://www.gnu.org/licenses/
+ */
+package tech.beshu.ror.audit.instances
+
+import org.json.JSONObject
+import tech.beshu.ror.audit.AuditResponseContext.Verbosity
+import tech.beshu.ror.audit.utils.AuditSerializationHelper
+import tech.beshu.ror.audit.utils.AuditSerializationHelper.AllowedEventMode.Include
+import tech.beshu.ror.audit.utils.AuditSerializationHelper.AuditFieldGroup.{CommonFields, EsEnvironmentFields}
+import tech.beshu.ror.audit.{AuditLogSerializer, AuditResponseContext}
+
+/**
+ * Serializer for audit events that is aware of **rule-defined verbosity**.
+ *
+ * - Serializes all non-`Allowed` events.
+ * - Serializes `Allowed` events only if the corresponding rule
+ *   specifies that they should be logged at `Verbosity.Info`.
+ *
+ * Recommended for standard audit logging where request body capture
+ * is not required, but cluster and node context are desired.
+ *
+ * - Fields included:
+ *   - `match` — whether the request matched a rule (boolean)
+ *   - `block` — reason for blocking, if blocked (string)
+ *   - `id` — audit event identifier (string)
+ *   - `final_state` — final processing state (string)
+ *   - `@timestamp` — event timestamp (ISO-8601 string)
+ *   - `correlation_id` — correlation identifier for tracing (string)
+ *   - `processingMillis` — request processing duration in milliseconds (number)
+ *   - `error_type` — type of error, if any (string)
+ *   - `error_message` — error message, if any (string)
+ *   - `content_len` — request body size in bytes (number)
+ *   - `content_len_kb` — request body size in kilobytes (number)
+ *   - `type` — request type (string)
+ *   - `origin` — client (remote) address (string)
+ *   - `destination` — server (local) address (string)
+ *   - `xff` — `X-Forwarded-For` HTTP header value (string)
+ *   - `task_id` — Elasticsearch task ID (number)
+ *   - `req_method` — HTTP request method (string)
+ *   - `headers` — HTTP header names (array of strings)
+ *   - `path` — HTTP request path (string)
+ *   - `user` — authenticated user (string)
+ *   - `impersonated_by` — impersonating user, if applicable (string)
+ *   - `action` — Elasticsearch action name (string)
+ *   - `indices` — indices involved in the request (array of strings)
+ *   - `acl_history` — access control evaluation history (string)
+ *   - `es_node_name` — Elasticsearch node name (string)
+ *   - `es_cluster_name` — Elasticsearch cluster name (string)
+ */
+class BlockVerbosityAwareAuditLogSerializer extends DefaultAuditLogSerializer
+
+@deprecated("Use tech.beshu.ror.audit.instances.BlockVerbosityAwareAuditLogSerializer instead", "1.67.0")
+class DefaultAuditLogSerializer extends DefaultAuditLogSerializerV2
+
+@deprecated("Use tech.beshu.ror.audit.instances.BlockVerbosityAwareAuditLogSerializer instead", "1.67.0")
+class DefaultAuditLogSerializerV2 extends AuditLogSerializer {
+
+  override def onResponse(responseContext: AuditResponseContext): Option[JSONObject] =
+    AuditSerializationHelper.serialize(
+      responseContext = responseContext,
+      fieldGroups = Set(CommonFields, EsEnvironmentFields),
+      allowedEventMode = Include(Set(Verbosity.Info))
+    )
+
+}
+
+@deprecated("Use tech.beshu.ror.audit.instances.BlockVerbosityAwareAuditLogSerializer instead", "1.67.0")
+class DefaultAuditLogSerializerV1 extends AuditLogSerializer {
+
+  override def onResponse(responseContext: AuditResponseContext): Option[JSONObject] =
+    AuditSerializationHelper.serialize(
+      responseContext = responseContext,
+      fieldGroups = Set(CommonFields),
+      allowedEventMode = Include(Set(Verbosity.Info))
+    )
+
+}

audit/src/main/scala/tech/beshu/ror/audit/instances/FullAuditLogSerializer.scala

@@ -0,0 +1,67 @@
+/*
+ *    This file is part of ReadonlyREST.
+ *
+ *    ReadonlyREST is free software: you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation, either version 3 of the License, or
+ *    (at your option) any later version.
+ *
+ *    ReadonlyREST is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with ReadonlyREST.  If not, see http://www.gnu.org/licenses/
+ */
+package tech.beshu.ror.audit.instances
+
+import org.json.JSONObject
+import tech.beshu.ror.audit.utils.AuditSerializationHelper
+import tech.beshu.ror.audit.utils.AuditSerializationHelper.AllowedEventMode.IncludeAll
+import tech.beshu.ror.audit.utils.AuditSerializationHelper.AuditFieldGroup._
+import tech.beshu.ror.audit.{AuditLogSerializer, AuditResponseContext}
+
+/**
+ * Serializer for **full audit events**.
+ * - Serializes all events, including every `Allowed` request,
+     regardless of rule verbosity.
+ * - Use this serializer, when you need complete coverage of all events.
+ * - Fields included:
+ *   - `match` — whether the request matched a rule (boolean)
+ *   - `block` — reason for blocking, if blocked (string)
+ *   - `id` — audit event identifier (string)
+ *   - `final_state` — final processing state (string)
+ *   - `@timestamp` — event timestamp (ISO-8601 string)
+ *   - `correlation_id` — correlation identifier for tracing (string)
+ *   - `processingMillis` — request processing duration in milliseconds (number)
+ *   - `error_type` — type of error, if any (string)
+ *   - `error_message` — error message, if any (string)
+ *   - `content_len` — request body size in bytes (number)
+ *   - `content_len_kb` — request body size in kilobytes (number)
+ *   - `type` — request type (string)
+ *   - `origin` — client (remote) address (string)
+ *   - `destination` — server (local) address (string)
+ *   - `xff` — `X-Forwarded-For` HTTP header value (string)
+ *   - `task_id` — Elasticsearch task ID (number)
+ *   - `req_method` — HTTP request method (string)
+ *   - `headers` — HTTP header names (array of strings)
+ *   - `path` — HTTP request path (string)
+ *   - `user` — authenticated user (string)
+ *   - `impersonated_by` — impersonating user, if applicable (string)
+ *   - `action` — Elasticsearch action name (string)
+ *   - `indices` — indices involved in the request (array of strings)
+ *   - `acl_history` — access control evaluation history (string)
+ *   - `es_node_name` — Elasticsearch node name (string)
+ *   - `es_cluster_name` — Elasticsearch cluster name (string)
+ */
+class FullAuditLogSerializer extends AuditLogSerializer {
+
+  override def onResponse(responseContext: AuditResponseContext): Option[JSONObject] =
+    AuditSerializationHelper.serialize(
+      responseContext = responseContext,
+      fieldGroups = Set(CommonFields, EsEnvironmentFields),
+      allowedEventMode = IncludeAll
+    )
+
+}

audit/src/main/scala/tech/beshu/ror/audit/instances/FullAuditLogWithQuerySerializer.scala

@@ -0,0 +1,68 @@
+/*
+ *    This file is part of ReadonlyREST.
+ *
+ *    ReadonlyREST is free software: you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation, either version 3 of the License, or
+ *    (at your option) any later version.
+ *
+ *    ReadonlyREST is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with ReadonlyREST.  If not, see http://www.gnu.org/licenses/
+ */
+package tech.beshu.ror.audit.instances
+
+import org.json.JSONObject
+import tech.beshu.ror.audit.utils.AuditSerializationHelper
+import tech.beshu.ror.audit.utils.AuditSerializationHelper.AllowedEventMode.IncludeAll
+import tech.beshu.ror.audit.utils.AuditSerializationHelper.AuditFieldGroup._
+import tech.beshu.ror.audit.{AuditLogSerializer, AuditResponseContext}
+
+/**
+ * Serializer for **full audit events including request content**.
+ * - Serializes all events, including every `Allowed` request,
+ *   regardless of rule verbosity.
+ * - Use this serializer, when request body capture is required.
+ * - Fields included:
+ *   - `match` — whether the request matched a rule (boolean)
+ *   - `block` — reason for blocking, if blocked (string)
+ *   - `id` — audit event identifier (string)
+ *   - `final_state` — final processing state (string)
+ *   - `@timestamp` — event timestamp (ISO-8601 string)
+ *   - `correlation_id` — correlation identifier for tracing (string)
+ *   - `processingMillis` — request processing duration in milliseconds (number)
+ *   - `error_type` — type of error, if any (string)
+ *   - `error_message` — error message, if any (string)
+ *   - `content_len` — request body size in bytes (number)
+ *   - `content_len_kb` — request body size in kilobytes (number)
+ *   - `type` — request type (string)
+ *   - `origin` — client (remote) address (string)
+ *   - `destination` — server (local) address (string)
+ *   - `xff` — `X-Forwarded-For` HTTP header value (string)
+ *   - `task_id` — Elasticsearch task ID (number)
+ *   - `req_method` — HTTP request method (string)
+ *   - `headers` — HTTP header names (array of strings)
+ *   - `path` — HTTP request path (string)
+ *   - `user` — authenticated user (string)
+ *   - `impersonated_by` — impersonating user, if applicable (string)
+ *   - `action` — Elasticsearch action name (string)
+ *   - `indices` — indices involved in the request (array of strings)
+ *   - `acl_history` — access control evaluation history (string)
+ *   - `es_node_name` — Elasticsearch node name (string)
+ *   - `es_cluster_name` — Elasticsearch cluster name (string)
+ *   - `content` — full request body (string)
+ */
+class FullAuditLogWithQuerySerializer extends AuditLogSerializer {
+
+  override def onResponse(responseContext: AuditResponseContext): Option[JSONObject] =
+    AuditSerializationHelper.serialize(
+      responseContext = responseContext,
+      fieldGroups = Set(CommonFields, EsEnvironmentFields, FullRequestContentFields),
+      allowedEventMode = IncludeAll
+    )
+
+}