@backstage-community/plugin-rbac-backend 5.6.1 → 6.0.1

package/dist/service/policies-rest-api.cjs.js

@@ -6,22 +6,21 @@ var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var lodash = require('lodash');
 var pluginRbacCommon = require('@backstage-community/plugin-rbac-common');
-var auditLogger = require('../audit-log/audit-logger.cjs.js');
-var restErrorsInterceptor = require('../audit-log/rest-errors-interceptor.cjs.js');
+var restInterceptor = require('../auditor/rest-interceptor.cjs.js');
 var roleMetadata = require('../database/role-metadata.cjs.js');
 var helper = require('../helper.cjs.js');
 var conditionValidation = require('../validation/condition-validation.cjs.js');
 var policiesValidation = require('../validation/policies-validation.cjs.js');
 
 class PoliciesServer {
-  constructor(permissions, options, enforcer, conditionalStorage, pluginPermMetaData, roleMetadata, aLog, rbacProviders) {
+  constructor(permissions, options, enforcer, conditionalStorage, pluginPermMetaData, roleMetadata, auditor, rbacProviders) {
     this.permissions = permissions;
     this.options = options;
     this.enforcer = enforcer;
     this.conditionalStorage = conditionalStorage;
     this.pluginPermMetaData = pluginPermMetaData;
     this.roleMetadata = roleMetadata;
-    this.aLog = aLog;
+    this.auditor = auditor;
     this.rbacProviders = rbacProviders;
   }
   async authorize(request, permission) {
@@ -66,38 +65,35 @@ class PoliciesServer {
       }
       response.send({ status: "Authorized" });
     });
-    router.get("/policies", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      let policies;
-      if (this.isPolicyFilterEnabled(request)) {
-        const entityRef = this.getFirstQuery(request.query.entityRef);
-        const permission = this.getFirstQuery(request.query.permission);
-        const policy = this.getFirstQuery(request.query.policy);
-        const effect = this.getFirstQuery(request.query.effect);
-        const filter = [entityRef, permission, policy, effect];
-        policies = await this.enforcer.getFilteredPolicy(0, ...filter);
-      } else {
-        policies = await this.enforcer.getPolicy();
+    router.get(
+      "/policies",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityReadPermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        let policies;
+        if (this.isPolicyFilterEnabled(request)) {
+          const entityRef = this.getFirstQuery(request.query.entityRef);
+          const permission = this.getFirstQuery(request.query.permission);
+          const policy = this.getFirstQuery(request.query.policy);
+          const effect = this.getFirstQuery(request.query.effect);
+          const filter = [entityRef, permission, policy, effect];
+          policies = await this.enforcer.getFilteredPolicy(0, ...filter);
+        } else {
+          policies = await this.enforcer.getPolicy();
+        }
+        const body = await this.transformPolicyArray(...policies);
+        response.json(body);
       }
-      const body = await this.transformPolicyArray(...policies);
-      await this.aLog.auditLog({
-        message: `Return list permission policies`,
-        eventName: auditLogger.PermissionEvents.GET_POLICY,
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200, body }
-      });
-      response.json(body);
-    });
+    );
     router.get(
       "/policies/:kind/:namespace/:name",
+      restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         const decision = await this.authorize(
           request,
@@ -110,14 +106,6 @@ class PoliciesServer {
         const policy = await this.enforcer.getFilteredPolicy(0, entityRef);
         if (policy.length !== 0) {
           const body = await this.transformPolicyArray(...policy);
-          await this.aLog.auditLog({
-            message: `Return permission policy`,
-            eventName: auditLogger.PermissionEvents.GET_POLICY,
-            stage: auditLogger.SEND_RESPONSE_STAGE,
-            status: "succeeded",
-            request,
-            response: { status: 200, body }
-          });
           response.json(body);
         } else {
           throw new errors.NotFoundError();
@@ -126,6 +114,7 @@ class PoliciesServer {
     );
     router.delete(
       "/policies/:kind/:namespace/:name",
+      restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         const decision = await this.authorize(
           request,
@@ -144,50 +133,39 @@ class PoliciesServer {
         });
         const processedPolicies = await this.processPolicies(policyRaw, true);
         await this.enforcer.removePolicies(processedPolicies);
-        await this.aLog.auditLog({
-          message: `Deleted permission policies`,
-          eventName: auditLogger.PermissionEvents.DELETE_POLICY,
-          metadata: { policies: processedPolicies, source: "rest" },
-          stage: auditLogger.SEND_RESPONSE_STAGE,
-          status: "succeeded",
-          request,
-          response: { status: 204 }
-        });
+        response.locals.meta = { policies: processedPolicies };
         response.status(204).end();
       }
     );
-    router.post("/policies", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityCreatePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const policyRaw = request.body;
-      if (lodash.isEmpty(policyRaw)) {
-        throw new errors.InputError(`permission policy must be present`);
-      }
-      const processedPolicies = await this.processPolicies(policyRaw);
-      const entityRef = processedPolicies[0][0];
-      const roleMetadata = await this.roleMetadata.findRoleMetadata(entityRef);
-      if (entityRef.startsWith("role:default") && !roleMetadata) {
-        throw new Error(`Corresponding role ${entityRef} was not found`);
+    router.post(
+      "/policies",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const policyRaw = request.body;
+        if (lodash.isEmpty(policyRaw)) {
+          throw new errors.InputError(`permission policy must be present`);
+        }
+        const processedPolicies = await this.processPolicies(policyRaw);
+        const entityRef = processedPolicies[0][0];
+        const roleMetadata = await this.roleMetadata.findRoleMetadata(entityRef);
+        if (entityRef.startsWith("role:default") && !roleMetadata) {
+          throw new Error(`Corresponding role ${entityRef} was not found`);
+        }
+        await this.enforcer.addPolicies(processedPolicies);
+        response.locals.meta = { policies: processedPolicies };
+        response.status(201).end();
       }
-      await this.enforcer.addPolicies(processedPolicies);
-      await this.aLog.auditLog({
-        message: `Created permission policies`,
-        eventName: auditLogger.PermissionEvents.CREATE_POLICY,
-        metadata: { policies: processedPolicies, source: "rest" },
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 201 }
-      });
-      response.status(201).end();
-    });
+    );
     router.put(
       "/policies/:kind/:namespace/:name",
+      restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         const decision = await this.authorize(
           request,
@@ -239,253 +217,235 @@ class PoliciesServer {
           processedOldPolicy,
           processedNewPolicy
         );
-        await this.aLog.auditLog({
-          message: `Updated permission policies`,
-          eventName: auditLogger.PermissionEvents.UPDATE_POLICY,
-          metadata: { policies: processedNewPolicy, source: "rest" },
-          stage: auditLogger.SEND_RESPONSE_STAGE,
-          status: "succeeded",
-          request,
-          response: { status: 200 }
-        });
+        response.locals.meta = { policies: processedNewPolicy };
         response.status(200).end();
       }
     );
-    router.get("/roles", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const roles = await this.enforcer.getGroupingPolicy();
-      const body = await this.transformRoleArray(...roles);
-      await this.aLog.auditLog({
-        message: `Return list roles`,
-        eventName: auditLogger.RoleEvents.GET_ROLE,
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200, body }
-      });
-      response.json(body);
-    });
-    router.get("/roles/:kind/:namespace/:name", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const roleEntityRef = this.getEntityReference(request, true);
-      const role = await this.enforcer.getFilteredGroupingPolicy(
-        1,
-        roleEntityRef
-      );
-      if (role.length !== 0) {
-        const body = await this.transformRoleArray(...role);
-        await this.aLog.auditLog({
-          message: `Return ${body[0].name}`,
-          eventName: auditLogger.RoleEvents.GET_ROLE,
-          stage: auditLogger.SEND_RESPONSE_STAGE,
-          status: "succeeded",
+    router.get(
+      "/roles",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
           request,
-          response: { status: 200, body }
-        });
+          pluginRbacCommon.policyEntityReadPermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const roles = await this.enforcer.getGroupingPolicy();
+        const body = await this.transformRoleArray(...roles);
         response.json(body);
-      } else {
-        throw new errors.NotFoundError();
-      }
-    });
-    router.post("/roles", async (request, response) => {
-      const uniqueItems = /* @__PURE__ */ new Set();
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityCreatePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
       }
-      const roleRaw = request.body;
-      let err = policiesValidation.validateRole(roleRaw);
-      if (err) {
-        throw new errors.InputError(
-          // 400
-          `Invalid role definition. Cause: ${err.message}`
+    );
+    router.get(
+      "/roles/:kind/:namespace/:name",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityReadPermission
         );
-      }
-      this.transformMemberReferencesToLowercase(roleRaw);
-      const rMetadata = await this.roleMetadata.findRoleMetadata(roleRaw.name);
-      err = await policiesValidation.validateSource("rest", rMetadata);
-      if (err) {
-        throw new errors.NotAllowedError(`Unable to add role: ${err.message}`);
-      }
-      const roles = this.transformRoleToArray(roleRaw);
-      for (const role of roles) {
-        if (await this.enforcer.hasGroupingPolicy(...role)) {
-          throw new errors.ConflictError();
-        }
-        const roleString = JSON.stringify(role);
-        if (uniqueItems.has(roleString)) {
-          throw new errors.ConflictError(
-            `Duplicate role members found; ${role.at(0)}, ${role.at(
-              1
-            )} is a duplicate`
-          );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const roleEntityRef = this.getEntityReference(request, true);
+        const role = await this.enforcer.getFilteredGroupingPolicy(
+          1,
+          roleEntityRef
+        );
+        if (role.length !== 0) {
+          const body = await this.transformRoleArray(...role);
+          response.json(body);
         } else {
-          uniqueItems.add(roleString);
+          throw new errors.NotFoundError();
         }
       }
-      const credentials = await httpAuth.credentials(request, {
-        allow: ["user"]
-      });
-      const modifiedBy = credentials.principal.userEntityRef;
-      const metadata = {
-        roleEntityRef: roleRaw.name,
-        source: "rest",
-        description: roleRaw.metadata?.description ?? "",
-        author: modifiedBy,
-        modifiedBy
-      };
-      await this.enforcer.addGroupingPolicies(roles, metadata);
-      await this.aLog.auditLog({
-        message: `Created ${metadata.roleEntityRef}`,
-        eventName: auditLogger.RoleEvents.CREATE_ROLE,
-        metadata: {
-          ...metadata,
-          members: roles.map((gp) => gp[0])
-        },
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 201 }
-      });
-      response.status(201).end();
-    });
-    router.put("/roles/:kind/:namespace/:name", async (request, response) => {
-      const uniqueItems = /* @__PURE__ */ new Set();
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityUpdatePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const roleEntityRef = this.getEntityReference(request, true);
-      const oldRoleRaw = request.body.oldRole;
-      if (!oldRoleRaw) {
-        throw new errors.InputError(`'oldRole' object must be present`);
-      }
-      const newRoleRaw = request.body.newRole;
-      if (!newRoleRaw) {
-        throw new errors.InputError(`'newRole' object must be present`);
-      }
-      oldRoleRaw.name = roleEntityRef;
-      let err = policiesValidation.validateRole(oldRoleRaw);
-      if (err) {
-        throw new errors.InputError(
-          // 400
-          `Invalid old role object. Cause: ${err.message}`
+    );
+    router.post(
+      "/roles",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const uniqueItems = /* @__PURE__ */ new Set();
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission
         );
-      }
-      err = policiesValidation.validateRole(newRoleRaw);
-      if (err) {
-        throw new errors.InputError(
-          // 400
-          `Invalid new role object. Cause: ${err.message}`
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const roleRaw = request.body;
+        let err = policiesValidation.validateRole(roleRaw);
+        if (err) {
+          throw new errors.InputError(
+            // 400
+            `Invalid role definition. Cause: ${err.message}`
+          );
+        }
+        this.transformMemberReferencesToLowercase(roleRaw);
+        const rMetadata = await this.roleMetadata.findRoleMetadata(
+          roleRaw.name
         );
-      }
-      this.transformMemberReferencesToLowercase(oldRoleRaw);
-      this.transformMemberReferencesToLowercase(newRoleRaw);
-      const oldRole = this.transformRoleToArray(oldRoleRaw);
-      const newRole = this.transformRoleToArray(newRoleRaw);
-      const credentials = await httpAuth.credentials(request, {
-        allow: ["user"]
-      });
-      const newMetadata = {
-        ...newRoleRaw.metadata,
-        source: newRoleRaw.metadata?.source ?? "rest",
-        roleEntityRef: newRoleRaw.name,
-        modifiedBy: credentials.principal.userEntityRef
-      };
-      const oldMetadata = await this.roleMetadata.findRoleMetadata(roleEntityRef);
-      if (!oldMetadata) {
-        throw new errors.NotFoundError(`Unable to find metadata for ${roleEntityRef}`);
-      }
-      err = await policiesValidation.validateSource("rest", oldMetadata);
-      if (err) {
-        throw new errors.NotAllowedError(`Unable to edit role: ${err.message}`);
-      }
-      if (lodash.isEqual(oldRole, newRole) && helper.deepSortedEqual(oldMetadata, newMetadata, [
-        "author",
-        "modifiedBy",
-        "createdAt",
-        "lastModified"
-      ])) {
-        response.status(204).end();
-        return;
-      }
-      for (const role of newRole) {
-        const hasRole = oldRole.some((element) => {
-          return lodash.isEqual(element, role);
-        });
-        if (await this.enforcer.hasGroupingPolicy(...role)) {
-          if (!hasRole) {
+        err = await policiesValidation.validateSource("rest", rMetadata);
+        if (err) {
+          throw new errors.NotAllowedError(`Unable to add role: ${err.message}`);
+        }
+        const roles = this.transformRoleToArray(roleRaw);
+        for (const role of roles) {
+          if (await this.enforcer.hasGroupingPolicy(...role)) {
             throw new errors.ConflictError();
           }
+          const roleString = JSON.stringify(role);
+          if (uniqueItems.has(roleString)) {
+            throw new errors.ConflictError(
+              `Duplicate role members found; ${role.at(0)}, ${role.at(
+                1
+              )} is a duplicate`
+            );
+          } else {
+            uniqueItems.add(roleString);
+          }
         }
-        const roleString = JSON.stringify(role);
-        if (uniqueItems.has(roleString)) {
-          throw new errors.ConflictError(
-            `Duplicate role members found; ${role.at(0)}, ${role.at(
-              1
-            )} is a duplicate`
+        const credentials = await httpAuth.credentials(request, {
+          allow: ["user"]
+        });
+        const modifiedBy = credentials.principal.userEntityRef;
+        const metadata = {
+          roleEntityRef: roleRaw.name,
+          source: "rest",
+          description: roleRaw.metadata?.description ?? "",
+          author: modifiedBy,
+          modifiedBy
+        };
+        await this.enforcer.addGroupingPolicies(roles, metadata);
+        response.locals.meta = { ...metadata, members: roles.map((gp) => gp[0]) };
+        response.status(201).end();
+      }
+    );
+    router.put(
+      "/roles/:kind/:namespace/:name",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const uniqueItems = /* @__PURE__ */ new Set();
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityUpdatePermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const roleEntityRef = this.getEntityReference(request, true);
+        const oldRoleRaw = request.body.oldRole;
+        if (!oldRoleRaw) {
+          throw new errors.InputError(`'oldRole' object must be present`);
+        }
+        const newRoleRaw = request.body.newRole;
+        if (!newRoleRaw) {
+          throw new errors.InputError(`'newRole' object must be present`);
+        }
+        oldRoleRaw.name = roleEntityRef;
+        let err = policiesValidation.validateRole(oldRoleRaw);
+        if (err) {
+          throw new errors.InputError(
+            // 400
+            `Invalid old role object. Cause: ${err.message}`
           );
-        } else {
-          uniqueItems.add(roleString);
         }
-      }
-      uniqueItems.clear();
-      for (const role of oldRole) {
-        if (!await this.enforcer.hasGroupingPolicy(...role)) {
-          throw new errors.NotFoundError(
-            `Member reference: ${role[0]} was not found for role ${roleEntityRef}`
+        err = policiesValidation.validateRole(newRoleRaw);
+        if (err) {
+          throw new errors.InputError(
+            // 400
+            `Invalid new role object. Cause: ${err.message}`
           );
         }
-        const roleString = JSON.stringify(role);
-        if (uniqueItems.has(roleString)) {
-          throw new errors.ConflictError(
-            `Duplicate role members found; ${role.at(0)}, ${role.at(
-              1
-            )} is a duplicate`
+        this.transformMemberReferencesToLowercase(oldRoleRaw);
+        this.transformMemberReferencesToLowercase(newRoleRaw);
+        const oldRole = this.transformRoleToArray(oldRoleRaw);
+        const newRole = this.transformRoleToArray(newRoleRaw);
+        const credentials = await httpAuth.credentials(request, {
+          allow: ["user"]
+        });
+        const newMetadata = {
+          ...newRoleRaw.metadata,
+          source: newRoleRaw.metadata?.source ?? "rest",
+          roleEntityRef: newRoleRaw.name,
+          modifiedBy: credentials.principal.userEntityRef
+        };
+        const oldMetadata = await this.roleMetadata.findRoleMetadata(roleEntityRef);
+        if (!oldMetadata) {
+          throw new errors.NotFoundError(
+            `Unable to find metadata for ${roleEntityRef}`
           );
-        } else {
-          uniqueItems.add(roleString);
         }
-      }
-      await this.enforcer.updateGroupingPolicies(oldRole, newRole, newMetadata);
-      let message = `Updated ${oldMetadata.roleEntityRef}.`;
-      if (newMetadata.roleEntityRef !== oldMetadata.roleEntityRef) {
-        message = `${message}. Role entity reference renamed to ${newMetadata.roleEntityRef}`;
-      }
-      await this.aLog.auditLog({
-        message,
-        eventName: auditLogger.RoleEvents.UPDATE_ROLE,
-        metadata: {
+        err = await policiesValidation.validateSource("rest", oldMetadata);
+        if (err) {
+          throw new errors.NotAllowedError(`Unable to edit role: ${err.message}`);
+        }
+        if (lodash.isEqual(oldRole, newRole) && helper.deepSortedEqual(oldMetadata, newMetadata, [
+          "author",
+          "modifiedBy",
+          "createdAt",
+          "lastModified"
+        ])) {
+          response.status(204).end();
+          return;
+        }
+        for (const role of newRole) {
+          const hasRole = oldRole.some((element) => {
+            return lodash.isEqual(element, role);
+          });
+          if (await this.enforcer.hasGroupingPolicy(...role)) {
+            if (!hasRole) {
+              throw new errors.ConflictError();
+            }
+          }
+          const roleString = JSON.stringify(role);
+          if (uniqueItems.has(roleString)) {
+            throw new errors.ConflictError(
+              `Duplicate role members found; ${role.at(0)}, ${role.at(
+                1
+              )} is a duplicate`
+            );
+          } else {
+            uniqueItems.add(roleString);
+          }
+        }
+        uniqueItems.clear();
+        for (const role of oldRole) {
+          if (!await this.enforcer.hasGroupingPolicy(...role)) {
+            throw new errors.NotFoundError(
+              `Member reference: ${role[0]} was not found for role ${roleEntityRef}`
+            );
+          }
+          const roleString = JSON.stringify(role);
+          if (uniqueItems.has(roleString)) {
+            throw new errors.ConflictError(
+              `Duplicate role members found; ${role.at(0)}, ${role.at(
+                1
+              )} is a duplicate`
+            );
+          } else {
+            uniqueItems.add(roleString);
+          }
+        }
+        await this.enforcer.updateGroupingPolicies(
+          oldRole,
+          newRole,
+          newMetadata
+        );
+        let message = `Updated ${oldMetadata.roleEntityRef}.`;
+        if (newMetadata.roleEntityRef !== oldMetadata.roleEntityRef) {
+          message = `${message}. Role entity reference renamed to ${newMetadata.roleEntityRef}`;
+        }
+        response.locals.meta = {
           ...newMetadata,
           members: newRole.map((gp) => gp[0])
-        },
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200 }
-      });
-      response.status(200).end();
-    });
+        };
+        response.status(200).end();
+      }
+    );
     router.delete(
       "/roles/:kind/:namespace/:name",
+      restInterceptor.logAuditorEvent(this.auditor),
       async (request, response) => {
         const decision = await this.authorize(
           request,
@@ -541,238 +501,208 @@ class PoliciesServer {
           metadata,
           false
         );
-        await this.aLog.auditLog({
-          message: `Deleted ${metadata.roleEntityRef}`,
-          eventName: auditLogger.RoleEvents.DELETE_ROLE,
-          metadata: {
-            ...metadata,
-            members: roleMembers.map((gp) => gp[0])
-          },
-          stage: auditLogger.SEND_RESPONSE_STAGE,
-          status: "succeeded",
-          request,
-          response: { status: 204 }
-        });
+        response.locals.meta = {
+          ...metadata,
+          members: roleMembers.map((gp) => gp[0])
+        };
         response.status(204).end();
       }
     );
-    router.get("/plugins/policies", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
+    router.get(
+      "/plugins/policies",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityReadPermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const body = await this.pluginPermMetaData.getPluginPolicies(
+          this.options.auth
+        );
+        response.json(body);
       }
-      const body = await this.pluginPermMetaData.getPluginPolicies(
-        this.options.auth
-      );
-      await this.aLog.auditLog({
-        message: `Return list plugin policies`,
-        eventName: auditLogger.ListPluginPoliciesEvents.GET_PLUGINS_POLICIES,
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200, body }
-      });
-      response.json(body);
-    });
-    router.get("/plugins/condition-rules", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
+    );
+    router.get(
+      "/plugins/condition-rules",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityReadPermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const body = await this.pluginPermMetaData.getPluginConditionRules(
+          this.options.auth
+        );
+        response.json(body);
       }
-      const body = await this.pluginPermMetaData.getPluginConditionRules(
-        this.options.auth
-      );
-      await this.aLog.auditLog({
-        message: `Return list conditional rules and schemas`,
-        eventName: auditLogger.ListConditionEvents.GET_CONDITION_RULES,
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200, body }
-      });
-      response.json(body);
-    });
-    router.get("/roles/conditions", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
+    );
+    router.get(
+      "/roles/conditions",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityReadPermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const conditions = await this.conditionalStorage.filterConditions(
+          this.getFirstQuery(request.query.roleEntityRef),
+          this.getFirstQuery(request.query.pluginId),
+          this.getFirstQuery(request.query.resourceType),
+          this.getActionQueries(request.query.actions)
+        );
+        const body = conditions.map((condition) => {
+          return {
+            ...condition,
+            permissionMapping: condition.permissionMapping.map(
+              (pm) => pm.action
+            )
+          };
+        });
+        response.json(body);
       }
-      const conditions = await this.conditionalStorage.filterConditions(
-        this.getFirstQuery(request.query.roleEntityRef),
-        this.getFirstQuery(request.query.pluginId),
-        this.getFirstQuery(request.query.resourceType),
-        this.getActionQueries(request.query.actions)
-      );
-      const body = conditions.map((condition) => {
-        return {
+    );
+    router.post(
+      "/roles/conditions",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const roleConditionPolicy = request.body;
+        conditionValidation.validateRoleCondition(roleConditionPolicy);
+        const conditionToCreate = await helper.processConditionMapping(
+          roleConditionPolicy,
+          this.pluginPermMetaData,
+          this.options.auth
+        );
+        const id = await this.conditionalStorage.createCondition(conditionToCreate);
+        const body = { id };
+        response.locals.meta = { condition: roleConditionPolicy };
+        response.status(201).json(body);
+      }
+    );
+    router.get(
+      "/roles/conditions/:id",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityReadPermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const id = parseInt(request.params.id, 10);
+        if (isNaN(id)) {
+          throw new errors.InputError("Id is not a valid number.");
+        }
+        const condition = await this.conditionalStorage.getCondition(id);
+        if (!condition) {
+          throw new errors.NotFoundError();
+        }
+        const body = {
           ...condition,
           permissionMapping: condition.permissionMapping.map((pm) => pm.action)
         };
-      });
-      await this.aLog.auditLog({
-        message: `Return list conditional permission policies`,
-        eventName: auditLogger.ConditionEvents.GET_CONDITION,
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200, body }
-      });
-      response.json(body);
-    });
-    router.post("/roles/conditions", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityCreatePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const roleConditionPolicy = request.body;
-      conditionValidation.validateRoleCondition(roleConditionPolicy);
-      const conditionToCreate = await helper.processConditionMapping(
-        roleConditionPolicy,
-        this.pluginPermMetaData,
-        this.options.auth
-      );
-      const id = await this.conditionalStorage.createCondition(conditionToCreate);
-      const body = { id };
-      await this.aLog.auditLog({
-        message: `Created conditional permission policy`,
-        eventName: auditLogger.ConditionEvents.CREATE_CONDITION,
-        metadata: { condition: roleConditionPolicy },
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 201, body }
-      });
-      response.status(201).json(body);
-    });
-    router.get("/roles/conditions/:id", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityReadPermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const id = parseInt(request.params.id, 10);
-      if (isNaN(id)) {
-        throw new errors.InputError("Id is not a valid number.");
-      }
-      const condition = await this.conditionalStorage.getCondition(id);
-      if (!condition) {
-        throw new errors.NotFoundError();
-      }
-      const body = {
-        ...condition,
-        permissionMapping: condition.permissionMapping.map((pm) => pm.action)
-      };
-      await this.aLog.auditLog({
-        message: `Return conditional permission policy by id`,
-        eventName: auditLogger.ConditionEvents.GET_CONDITION,
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200, body }
-      });
-      response.json(body);
-    });
-    router.delete("/roles/conditions/:id", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityDeletePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const id = parseInt(request.params.id, 10);
-      if (isNaN(id)) {
-        throw new errors.InputError("Id is not a valid number.");
-      }
-      const condition = await this.conditionalStorage.getCondition(id);
-      if (!condition) {
-        throw new errors.NotFoundError(`Condition with id ${id} was not found`);
-      }
-      const conditionToDelete = {
-        ...condition,
-        permissionMapping: condition.permissionMapping.map((pm) => pm.action)
-      };
-      await this.conditionalStorage.deleteCondition(id);
-      await this.aLog.auditLog({
-        message: `Deleted conditional permission policy`,
-        eventName: auditLogger.ConditionEvents.DELETE_CONDITION,
-        metadata: { condition: conditionToDelete },
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 204 }
-      });
-      response.status(204).end();
-    });
-    router.put("/roles/conditions/:id", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityUpdatePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
-      }
-      const id = parseInt(request.params.id, 10);
-      if (isNaN(id)) {
-        throw new errors.InputError("Id is not a valid number.");
+        response.json(body);
       }
-      const roleConditionPolicy = request.body;
-      conditionValidation.validateRoleCondition(roleConditionPolicy);
-      const conditionToUpdate = await helper.processConditionMapping(
-        roleConditionPolicy,
-        this.pluginPermMetaData,
-        this.options.auth
-      );
-      await this.conditionalStorage.updateCondition(id, conditionToUpdate);
-      await this.aLog.auditLog({
-        message: `Updated conditional permission policy`,
-        eventName: auditLogger.ConditionEvents.UPDATE_CONDITION,
-        metadata: { condition: roleConditionPolicy },
-        stage: auditLogger.SEND_RESPONSE_STAGE,
-        status: "succeeded",
-        request,
-        response: { status: 200 }
-      });
-      response.status(200).end();
-    });
-    router.post("/refresh/:id", async (request, response) => {
-      const decision = await this.authorize(
-        request,
-        pluginRbacCommon.policyEntityCreatePermission
-      );
-      if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
-        throw new errors.NotAllowedError();
+    );
+    router.delete(
+      "/roles/conditions/:id",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityDeletePermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const id = parseInt(request.params.id, 10);
+        if (isNaN(id)) {
+          throw new errors.InputError("Id is not a valid number.");
+        }
+        const condition = await this.conditionalStorage.getCondition(id);
+        if (!condition) {
+          throw new errors.NotFoundError(`Condition with id ${id} was not found`);
+        }
+        const conditionToDelete = {
+          ...condition,
+          permissionMapping: condition.permissionMapping.map((pm) => pm.action)
+        };
+        await this.conditionalStorage.deleteCondition(id);
+        response.locals.meta = { condition: conditionToDelete };
+        response.status(204).end();
       }
-      if (!this.rbacProviders) {
-        throw new errors.NotFoundError(`No RBAC providers were found`);
+    );
+    router.put(
+      "/roles/conditions/:id",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityUpdatePermission
+        );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        const id = parseInt(request.params.id, 10);
+        if (isNaN(id)) {
+          throw new errors.InputError("Id is not a valid number.");
+        }
+        const roleConditionPolicy = request.body;
+        conditionValidation.validateRoleCondition(roleConditionPolicy);
+        const conditionToUpdate = await helper.processConditionMapping(
+          roleConditionPolicy,
+          this.pluginPermMetaData,
+          this.options.auth
+        );
+        await this.conditionalStorage.updateCondition(id, conditionToUpdate);
+        response.locals.meta = { condition: roleConditionPolicy };
+        response.status(200).end();
       }
-      const idProvider = this.rbacProviders.find((provider) => {
-        const id = provider.getProviderName();
-        return id === request.params.id;
-      });
-      if (!idProvider) {
-        throw new errors.NotFoundError(
-          `The RBAC provider ${request.params.id} was not found`
+    );
+    router.post(
+      "/refresh/:id",
+      restInterceptor.logAuditorEvent(this.auditor),
+      async (request, response) => {
+        const decision = await this.authorize(
+          request,
+          pluginRbacCommon.policyEntityCreatePermission
         );
+        if (decision.result === pluginPermissionCommon.AuthorizeResult.DENY) {
+          throw new errors.NotAllowedError();
+        }
+        if (!this.rbacProviders) {
+          throw new errors.NotFoundError(`No RBAC providers were found`);
+        }
+        const idProvider = this.rbacProviders.find((provider) => {
+          const id = provider.getProviderName();
+          return id === request.params.id;
+        });
+        if (!idProvider) {
+          throw new errors.NotFoundError(
+            `The RBAC provider ${request.params.id} was not found`
+          );
+        }
+        await idProvider.refresh();
+        response.status(200).end();
       }
-      await idProvider.refresh();
-      response.status(200).end();
-    });
-    router.use(restErrorsInterceptor.auditError(this.aLog));
+    );
+    router.use(restInterceptor.setAuditorError());
     return router;
   }
   getEntityReference(request, role) {