Nothing Added to Events Table when Saving a Query

mains · January 19, 2022, 7:16pm

I am looking to maintain a full audit trail of user actions through the events table. However, I noticed that nothing is published to the events table when a query is saved. This would become a problem if a user were to edit a query and save it without executing or publishing the query. In this case, it seems like there would be no way of knowing who changed the query or what it was changed to.

The following solution mentions that there should be some “save query” events in the events table but I do not see any: How to subscribe query changes?

Does this logging already exist somewhere else? If not, are there any suggestions for logging saved queries and logging what they were saved to?

jesse · January 19, 2022, 8:22pm

This is correct. The current source code does not record an event in this case.

github.com

getredash/redash/blob/e28e4227bf11b0688dc9646579647455fade419f/redash/handlers/queries.py#L329-L389

    
      
          def post(self, query_id):
              """
              Modify a query.
          
          
    :param query_id: ID of query to update
              :<json number data_source_id: The ID of the data source this query will run on
              :<json string query: Query text
              :<json string name:
              :<json string description:
              :<json string schedule: Schedule interval, in seconds, for repeated execution of this query
              :<json object options: Query options
          
          
    Responds with the updated :ref:`query <query-response-label>` object.
              """
              query = get_object_or_404(
                  models.Query.get_by_id_and_org, query_id, self.current_org
              )
              query_def = request.get_json(force=True)
          
          
    require_object_modify_permission(query, self.current_user)

This file has been truncated. show original

jesse · January 19, 2022, 8:24pm

Logging save actions would be easy enough. Just add a record_event call to the query update handler. Recording the change contents themselves seems like the wrong idea, since the events table would then be a form of (very inefficient) change tracking. For example, if a user changes one line of a 1k line query, 2k lines would be injected on the events table (rather than the just the diff).

mains · January 19, 2022, 8:52pm

Thank you, that makes sense. I will look into adding a record_event.

If I did want to include change tracking for all saved queries, do you suggest creating a new table instead?