jerryshao opened a new pull request, #12891: URL: https://github.com/apache/gravitino/pull/12891
### What changes were proposed in this pull request? - `Event`'s constructor now captures the current request's query parameters (stashed per-request by `RequestContextFilter`) and merges them into `customInfo()` automatically, for every event in the system, with no per-event-class wiring. - `RequestContextFilter` is now also registered on the Iceberg and Lance REST servers (previously main server only). - `customInfo()` is sealed (`final`) with a new `ownCustomInfo()` extension point, so a subclass can no longer override `customInfo()` directly and silently discard the automatically captured parameters — this bug pattern was caught and fixed in 6 existing classes during development. - Redaction is now a single, uniform pass at audit-log format time in `AuditLogRedactor`: an exact-match list for known internal keys, plus a substring match for arbitrary caller-supplied names (query parameters, headers), with an explicit exemption list (`auth.method`, `http.status`, etc.) for fixed key literals the codebase itself chooses, so they're never masked for coincidentally containing a sensitive substring. - `HttpAuditFilter` gains a generic `HttpRequestEvent` fallback (mirroring the existing `HttpRequestFailureEvent`), so any endpoint not yet wired into the operation-dispatcher event system still produces a baseline audit record (method, URI, status, query parameters) instead of none at all — automatically suppressed when a richer structured event already fired for the same request. ### Why are the changes needed? Audit log entries recorded the request path, operation type, and object, but never the request parameters that determine how much or what kind of data a call returns. Two calls to the same endpoint differing only in a query parameter (e.g. a catalog listing with `details=true` vs `details=false`) produced identical audit entries apart from the timestamp, making it impossible to reconstruct after the fact what a given call actually returned. Fix: #12872 ### Does this PR introduce _any_ user-facing change? - `customInfo()` in every audit log entry now includes the request's query parameters automatically. - New redaction rules (substring match + exemption list) are documented in `docs/gravitino-server-config.md`. - Endpoints without a structured operation event now produce a generic fallback audit entry instead of none. No config keys added, removed, or renamed. ### How was this patch tested? - New/updated unit tests across `core`, `server-common`, `iceberg-rest-server`, `lance-rest-server` (redaction rules, the `customInfo()` merge contract, the generic fallback event, filter registration). - Live end-to-end verification against a running distribution build: confirmed `details=true`/`false` now produce distinguishable audit entries, sensitive query parameters are redacted while non-sensitive ones are not, Basic-auth credentials never leak into any log file, and catalog creation produces the expected audit-entry count under anonymous-admin, authorization-denied, and authenticated-non-admin-owner scenarios. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
