Release 2.8.2

src/web/routes/admin/rbac.js

@@ -1,5 +1,6 @@
 	// Admin RBAC route registration and permission management.
 	const { DEFAULT_ROLE } = require('#src/rbac');
+	const { buildAuditChanges } = require('#src/data/audit-log');
 
 	module.exports = function registerRbacRoutes(app, deps) {
 	const pool = deps.pool;
@@ -413,10 +414,14 @@
 				return res.redirect('/settings/roles/' + roleId + '/edit?message=' + encodeURIComponent('One or more selected permissions are invalid.'));
 			}
 
+			const existingRolePermissionKeys = shouldSyncPermissions
+				? await rbacData.fetchRolePermissionKeys(pool, roleId)
+				: [];
+			let existingRoleUserIds = [];
 			let availableUsers = [];
 			if (shouldSyncUsers) {
 				availableUsers = await rbacData.fetchUsersWithRoles(pool);
-				const existingRoleUserIds = await rbacData.fetchRoleUserIds(pool, roleId);
+				existingRoleUserIds = await rbacData.fetchRoleUserIds(pool, roleId);
 				const visibleUserIdSet = new Set(visibleUserIds);
 				normalizedUserIds = existingRoleUserIds.filter(function (userId) {
 					return !visibleUserIdSet.has(userId);
@@ -452,6 +457,17 @@
 				connection.release();
 			}
 			if (typeof recordRequestAuditEvent === 'function') {
+				const changes = buildAuditChanges({
+					name: role.name,
+					description: role.description,
+					permissionKeys: existingRolePermissionKeys,
+					userIds: existingRoleUserIds
+				}, {
+					name: name,
+					description: description || null,
+					permissionKeys: normalizedPermissionKeys,
+					userIds: normalizedUserIds
+				});
 				await recordRequestAuditEvent(pool, req, {
 					category: 'roles',
 					eventType: 'role.updated',
@@ -459,7 +475,7 @@
 					targetType: 'role',
 					targetId: roleId,
 					targetLabel: name,
-					details: { permissionsChanged: shouldSyncPermissions, usersChanged: shouldSyncUsers }
+					details: { changes: changes }
 				});
 			}
 			res.redirect('/settings/roles/' + roleId + '/edit?message=' + encodeURIComponent('Role updated.'));
@@ -494,6 +510,7 @@
 			})) {
 				return res.redirect('/settings/roles/' + roleId + '/edit?message=' + encodeURIComponent('One or more selected permissions are invalid.'));
 			}
+			const existingPermissionKeys = await rbacData.fetchRolePermissionKeys(pool, roleId);
 
 			const connection = await pool.getConnection();
 			try {
@@ -514,7 +531,7 @@
 					targetType: 'role',
 					targetId: roleId,
 					targetLabel: role.name,
-					details: { permissionKeys: normalizedPermissionKeys }
+					details: { changes: buildAuditChanges({ permissionKeys: existingPermissionKeys }, { permissionKeys: normalizedPermissionKeys }) }
 				});
 			}
 			res.redirect('/settings/roles/' + roleId + '/edit?message=' + encodeURIComponent('Permissions updated.'));
@@ -541,6 +558,7 @@
 					? [].concat(req.body.user_ids)
 					: [];
 			const normalizedUserIds = normalizeSelectedIds(selectedUserIds);
+			const existingUserIds = await rbacData.fetchRoleUserIds(pool, roleId);
 			const availableUsers = await rbacData.fetchUsersWithRoles(pool);
 			const validUserIds = new Set(availableUsers.map(function (user) {
 				return Number(user.id);
@@ -561,7 +579,7 @@
 					targetType: 'role',
 					targetId: roleId,
 					targetLabel: role.name,
-					details: { userIds: normalizedUserIds }
+					details: { changes: buildAuditChanges({ userIds: existingUserIds }, { userIds: normalizedUserIds }) }
 				});
 			}
 			res.redirect('/settings/roles/' + roleId + '/edit?message=' + encodeURIComponent('Users updated.'));