Walkthrough

This PR introduces comprehensive GDPR-compliant audit logging for Parse Server. It adds infrastructure to log user authentication, data access, data modifications, ACL changes, schema modifications, and push notifications. The implementation includes a Winston-based daily-rotating file adapter, configurable event filtering, TypeScript-based event types, and integration points across multiple routers to capture relevant operations.

Changes

Sequence Diagram(s)

sequenceDiagram
    participant User as User/Client
    participant Parse as Parse Server<br/>(Router)
    participant Audit as AuditLogController
    participant Filter as AuditLogFilter
    participant Adapter as WinstonFileAuditLogAdapter
    participant Logger as Winston Logger
    participant FS as File System

    User->>Parse: Login / Data Access / Write
    Parse->>Parse: Process Operation
    Parse->>Audit: log[EventType](params)
    Audit->>Audit: Build AuditEvent
    Audit->>Filter: shouldLog(event)
    Filter->>Filter: Check eventType, class,<br/>masterKey, roles, custom
    Filter-->>Audit: true/false
    alt shouldLog() returns true
        Audit->>Adapter: log[EventType](event)
        Adapter->>Adapter: maskSensitiveData(event)
        Adapter->>Logger: logger.info('audit_event',<br/>auditEntry)
        Logger->>FS: Write to daily rotation file<br/>(parse-server-audit-YYYY-MM-DD.log)
        FS-->>Logger: ✓ Written
        Logger-->>Adapter: ✓ Complete
        Adapter-->>Audit: Promise resolved
        Audit-->>Parse: (fire-and-forget)
    end
    Parse-->>User: Return Response
    Note over Parse: Audit logging errors<br/>do not affect main flow

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

• Complexity factors:

  • Large scope: ~30 files modified/created across multiple subsystems
  • Heterogeneous changes: New adapter infrastructure, controller logic, integration points across 6+ routers, TypeScript interfaces, filtering pipeline, masking logic
  • High logic density: Multi-stage filtering (event type, class, master-key, roles, custom filter), sensitive data masking, error propagation in fire-and-forget patterns

• Areas requiring extra attention:

  • AuditLogFilter filtering logic (src/Adapters/AuditLog/AuditLogFilter.ts): Verify correct precedence and behavior across all filter combinations (event type whitelist, include/exclude class filtering, master-key exclusion, role whitelisting/blacklisting, custom filter fail-open semantics)
  • Masking implementation (across AuditLogController and WinstonFileAuditLogAdapter): Confirm sensitive fields (sessionToken, authData, passwords) are consistently masked across all event types
  • Router integration points (UsersRouter.js, RestWrite.js, PushRouter.js, SchemasRouter.js, RestQuery.js): Verify audit logging does not introduce race conditions, exception handling is robust, and fire-and-forget promises do not mask errors in tests
  • Type safety (src/Adapters/AuditLog/*): Ensure TypeScript event interfaces align across adapter, controller, and router usage
  • Test coverage: Validate that e2e tests adequately cover concurrent operations, file rotation edge cases, and filter precedence scenarios

Suggested reviewers

• @mtrezza

• 📝 Generate docstrings

• X
• Mastodon
• Reddit
• LinkedIn