Skip to content

[POC] DB Changes Audit Trail - #562

Open
briannval wants to merge 13 commits into
devfrom
audit
Open

briannval wants to merge 13 commits into
devfrom
audit

Conversation

@briannval

@briannval briannval commented Oct 5, 2025

Copy link
Copy Markdown
Contributor

POC video in FE PR: ubc-biztech/bt-web-v2#290

Also:
image

@briannval
briannval changed the base branch from master to dev October 5, 2025 18:16
@briannval
briannval changed the base branch from dev to master October 5, 2025 18:16
@briannval
briannval requested a review from kevinxiao27 October 12, 2025 04:32
@kevinxiao27
kevinxiao27 changed the base branch from master to dev October 14, 2025 00:06

@kevinxiao27 kevinxiao27 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

couple small changes requested, generally very well thought out!

Comment thread constants/tables.js
export const TEAMS_TABLE = "biztechTeams";
export const QR_SCANS_RECORD = "biztechQRScans";
export const PROFILES_TABLE = "biztechProfiles";
export const AUDIT_TABLE = "biztechAudit";

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

j make sure to set up these tables on cloud before we merge

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sgsg, I might have to modify the sort key though
timestamp#email#record_id, since if we batch delete with the same timestamp we have a non-unique PKs now so they might get overwritten

Comment thread lib/db.js Outdated
return this.logChange(tableName, item.id, email, "DELETE");
}); // generate the promises

await Promise.all(logDeletionPromises); // execute them all at once

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure that this should actually be blocking, but logging isn't a core feature and presumably we won't be deleting 50 registrations at a time. You could try using batchwrite onto the audit table as well to reduce network calls.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It shouldn't be blocking - but the way the BE is setup (serverless lambda instead of a long-running server) makes it a lot tricker to run "background" tasks -> either we can do something pub-sub or we need to create a manual lambda which we can "invoke and forget". Both options will add some layer of complexity to a non-user-facing feature though. What do you think?

I do agree with the batchwrite to the audit table for delete many, I'll put up a change for this

Comment thread lib/db.js
const res = await docClient.send(command);

if (email) {
await this.logChange(params.TableName, params.Key.id, email, "UPDATE", this.calculateDelta(before, after));

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this seems fairly computationally expensive (or at least will take up more compute in a serverless function call. I'll comments below on certain things.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is indeed expensive, and will be 2 DB reads instead of 1, which is also my rationale of making it optional (if you purposely want to log the change, you must include authorizer email in the handler).

Comment thread lib/db.js Outdated
}

if (a && b && typeof a === "object") {
const aKeys = Object.keys(a).sort();

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Objects don't need to be sorted here. We don't need to sort either of the keys. If all keys in a ==> maps to same value in b, and both objects have the same number of keys, they'll be equivalent.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated, thanks!

Comment thread services/interactions/serverless.yml Outdated
ENVIRONMENT: ${file(../../config.${self:provider.stage}.json):ENVIRONMENT}
NODE_ENV: ${env:NODE_ENV}
WS_API_ENDPOINT: https://bwiujsprij.execute-api.us-west-2.amazonaws.com/dev
WS_API_ENDPOINT: https://bn27jq3bal.execute-api.us-west-2.amazonaws.com/prod

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lol we can just remove this diff i believe these are benny's changes for the bizwall (shouldn't be merged into dev)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, thanks!

@briannval

briannval commented Oct 16, 2025

Copy link
Copy Markdown
Contributor Author

Testing still required before re-review
Update: Done

@briannval
briannval requested a review from kevinxiao27 October 17, 2025 04:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants