audit-labs/audit-tools

 1"""
 2Collect group membership audit events (created / updated / destroyed).
 3
 4Group audit events require a GitLab Premium or Ultimate subscription. Returns an
 5empty list with a warning if the endpoint is unavailable (403/404).
 6"""
 7
 8import sys
 9
10import requests
11
12from .api import enc, paginate
13
14MEMBER_ACTIONS = {"member_created", "member_updated", "member_destroyed"}
15
16
17def audit_events(group, cfg):
18    try:
19        events = paginate(f"{cfg['base_url']}/groups/{enc(group)}/audit_events", cfg)
20    except requests.HTTPError as e:
21        if e.response is not None and e.response.status_code in (403, 404):
22            print(
23                "Warning: group audit events require GitLab Premium/Ultimate and "
24                "owner access -- skipping.",
25                file=sys.stderr,
26            )
27            return []
28        raise
29
30    rows = []
31    for event in events:
32        action = event.get("event_name", "")
33        if action not in MEMBER_ACTIONS:
34            continue
35        details = event.get("details", {})
36        rows.append(
37            {
38                "created_at": event.get("created_at", ""),
39                "action": action,
40                "member_id": details.get("member_id", ""),
41                "target": details.get("target_details", ""),
42                "author_id": event.get("author_id", ""),
43                "entity_type": event.get("entity_type", ""),
44            }
45        )
46    return rows