ASP.NET Core Development Notes: Further Implementation of Non-Invasive Audit Log Functionality

Foreword

Previously，we implemented an audit log feature using AOP principles，but some students still found it not completely non-intrusive，so I refactored a new version.

Let's recap: Asp-Net-Core Development Notes: Implementing Dynamic Audit Log Functionality

Now we can achieve completely non-intrusive audit logging for business code. Simply adding the [AuditLog] attribute to the interface that needs auditing allows recording of operational logs for that interface，as well as related entity change records，which is quite convenient.

PS: Later I discovered that ABP has built-in audit functionality，and suddenly I felt a bit 🤡

Refactoring

First, refactor the previous code. Previously, the audit-related code was scattered across different directories, but this functionality is actually a whole, so it would be better to consolidate the code together.

Create the src/Acme.Demo/Contrib/Audit directory (Note: Acme.Demo is the project name, arbitrarily chosen).

Directory Structure

The directory structure is as follows:

 Audit
 ├─ Services
 │  ├─ IAuditLogService.cs
 │  ├─ AuditLogService.cs
 │  └─ AuditLogMongoService.cs
 ├─ Middlewares
 │  └─ AuditLogMiddleware.cs
 ├─ Filters
 │  └─ AuditLogAttribute.cs
 ├─ Extensions
 │  └─ CfgAudit.cs
 ├─ EventHandlers
 │  └─ FreeSqlAuditEventHandler.cs
 ├─ Entities
 │  ├─ EntityChangeInfo.cs
 │  └─ AuditLog.cs
 └─ AuditConstant.cs

6 directories, 10 files

Create EntityChangeInfo Entity

Used to save entity changes.

public class EntityChangeInfo {
  public string Entity { get; set; }
  public string Action { get; set; }
  public string Sql { get; set; }
  public Dictionary<string, object?> Parameters { get; set; }
}

AuditLog Refactoring

Previously, we directly saved the entity change content within the AuditLog.

Now, we are separating it out by using the EntityChanges property of type List<EntityChangeInfo> to store the entity changes.

public class AuditLog {
  /// <summary>
  /// 事件唯一标识
  /// </summary>
  public string EventId { get; set; }

  /// <summary>
  /// 事件类型（例如：登录、登出、数据修改等）
  /// </summary>
  public string EventType { get; set; }

  /// <summary>
  /// 执行操作的用户标识
  /// </summary>
  public string UserId { get; set; }

  /// <summary>
  /// 执行操作的用户名
  /// </summary>
  public string Username { get; set; }

  /// <summary>
  /// 事件发生的时间戳
  /// </summary>
  public DateTime Timestamp { get; set; }

  /// <summary>
  /// 用户的IP地址
  /// </summary>
  public string? IPAddress { get; set; }

  /// <summary>
  /// 实体更改内容，可根据实际情况以JSON格式存储
  /// </summary>
  public List<EntityChangeInfo>? EntityChanges { get; set; } = new();

  /// <summary>
  /// 路由信息
  /// </summary>
  public Dictionary<string, object?> RouteData { get; set; }

  /// <summary>
  /// 事件描述
  /// </summary>
  public string? Description { get; set; }

  /// <summary>
  /// 额外信息 （考虑以 JSON 格式保存）
  /// </summary>
  public object? Extra { get; set; }

  /// <summary>
  /// 创建时间
  /// </summary>
  public DateTime CreatedTime { get; set; } = DateTime.UtcNow;

  /// <summary>
  /// 修改时间
  /// </summary>
  public DateTime ModifiedTime { get; set; } = DateTime.UtcNow;
}

Filter Refactoring

Modify the AuditLogAttribute class.

The changes involved are minimal—it’s mainly about simplifying the parameters. Now you only need to pass in EventType.

Everything else will be retrieved automatically.

The entity changes part will require the use of ORM functionality, which will be covered next.

public class AuditLogAttribute : ActionFilterAttribute {
  public string EventType { get; set; }

  public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) {
    var sp = context.HttpContext.RequestServices;
    var ctxItems = context.HttpContext.Items;

    try {
      var authService = sp.GetRequiredService<AuthService>();

      // 在操作执行前
      var executedContext = await next();

      // 在操作执行后

      // 获取当前用户的身份信息
      var user = await authService.GetUserFromJwt(executedContext.HttpContext.User);

      // 构造AuditLog对象
      var auditLog = new AuditLog {
        EventId = Guid.NewGuid().ToString(),
        EventType = this.EventType,
        UserId = user.UserId,
        Username = user.Username,
        Timestamp = DateTime.UtcNow,
        IPAddress = GetIpAddress(executedContext.HttpContext),
        Description = $"操作类型：{this.EventType}",
      };

      if (ctxItems.TryGetValue(AuditConstant.EntityChanges, out var item)) {
        auditLog.EntityChanges = item as List<EntityChangeInfo>;
      }

      var routeData = new Dictionary<string, object?>();
      foreach (var (key, value) in context.RouteData.Values) {
        routeData.Add(key, value);
      }

      auditLog.RouteData = routeData;

      var auditService = sp.GetRequiredService<IAuditLogService>();
      await auditService.LogAsync(auditLog);
    } catch (Exception ex) {
      var logger = sp.GetRequiredService<ILogger<AuditLogAttribute>>();
      logger.LogError(ex, "An error occurred while logging audit information.");
    }

    Console.WriteLine(
      "执行 AuditLogAttribute, " +
      $"EventId: {ctxItems["AuditLog_EventId"]}");
  }

  private string? GetIpAddress(HttpContext httpContext) {
    // 首先检查X-Forwarded-For头（当应用部署在代理后面时）
    var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
    if (!string.IsNullOrWhiteSpace(forwardedFor)) {
      return forwardedFor.Split(',').FirstOrDefault(); // 可能包含多个IP地址
    }

    // 如果没有X-Forwarded-For头，或者需要直接获取连接的远程IP地址
    return httpContext.Connection.RemoteIpAddress?.ToString();
  }
}

Obtaining Entity Changes

The entity changes section requires the use of ORM functionality. Different ORMs have varying capabilities for monitoring entity changes, so a separate implementation is needed for each ORM.

Currently, I have only implemented entity change monitoring for FreeSQL.

The code is in FreeSqlAuditEventHandler.

public class FreeSqlAuditEventHandler {
  private readonly ILogger<FreeSqlAuditEventHandler> _logger;
  private readonly IHttpContextAccessor _httpContextAccessor;
  private readonly IDictionary<object, object?> _ctxItems;

  public FreeSqlAuditEventHandler(IHttpContextAccessor httpContextAccessor,
                                  ILogger<FreeSqlAuditEventHandler> logger) {
    _httpContextAccessor = httpContextAccessor;
    _logger = logger;
    _ctxItems = httpContextAccessor.HttpContext?.Items ?? new Dictionary<object, object?>();
  }

  public void HandleCurdBefore(object? sender, CurdBeforeEventArgs args) {
    // Capture change information
    var changeInfo = new EntityChangeInfo {
      Entity = args.EntityType.Name,
      Action = Enum.GetName(typeof(CurdType), args.CurdType) ?? "unknown",
      Sql = args.Sql,
      Parameters = new Dictionary<string, object?>(
        args.DbParms.Select(p => new KeyValuePair<string, object?>(p.ParameterName, p.Value))
      )
    };

    // Handle the CurdBefore event, save entity change information to HttpContext.Items
    _logger.LogDebug(
      $"Executed FreeSql CurdBefore, " +
      $"EventId: {_httpContextAccessor.HttpContext?.Items["AuditLog_EventId"]}, " +
      $"entityType: {args.EntityType.Name}, " +
      $"crud: {Enum.GetName(typeof(CurdType), args.CurdType)}, ");

    List<EntityChangeInfo> changes = new();
    if (_ctxItems.TryGetValue(AuditConstant.EntityChanges, out var item)) {
      changes = item as List<EntityChangeInfo> ?? new List<EntityChangeInfo>();
    } else {
      _ctxItems[AuditConstant.EntityChanges] = changes;
    }

    changes.Add(changeInfo);
  }
}

This is quite straightforward. By utilizing FreeSQL's Aop.CurdBefore event and binding HandleCurdBefore to it, you can capture entity changes.

// Create an IFreeSQL instance
IFreeSql inst = ...;
// Entity CRUD (Create, Read, Update, Delete) operation events
inst.Aop.CurdBefore += auditEventHandler.HandleCurdBefore;

A minor complaint about FreeSQL's naming: the common convention is "CRUD," but they chose to be different and use "CURD"...

However, to use a domestic database, I guess I'll just have to make do with it!

Extension Methods

For convenience, I've placed both the service registration and the middleware into extension methods, aligning with the development conventions of ASP.NET Core.

public static class CfgAudit {
  public static IServiceCollection AddAudit(this IServiceCollection services, IConfiguration conf) {
    services.AddSingleton<IAuditLogService>(sp =>
                                            new AuditLogMongoService(conf.GetConnectionString("MongoDB"), "stu_data_hub"));
    services.AddSingleton<FreeSqlAuditEventHandler>();

    return services;
  }

  public static IApplicationBuilder UseAudit(this IApplicationBuilder app) {
    app.UseMiddleware<AuditLogMiddleware>();

    return app;
  }
}

Register in Program.cs:

// Register services
builder.Services.AddAudit(builder.Configuration);
// Add middleware
app.UseAudit();

PS: Passing the configuration in here is a bit clumsy. I could have completely obtained the configuration object via Dependency Injection within the AddAudit method. However, since it's already written this way, I'm too lazy to change it.

Usage Effect

Let's look at the usage effect.

First, add the [AuditLog] attribute to the interface that needs to be audited.

/// <summary>
/// Set feedback result
/// </summary>
[AuditLog(EventType = "设置反馈结果")]
[HttpPost("{taskId}/sub-tasks/{subId}/set-feedback")]
public async Task<ApiResponse> SetSubTaskFeedback(string taskId, string subId, [FromBody] SubTaskFeedbackDto dto) {}

Then, you can see the audit log in MongoDB (the data has been desensitized).

{
  "_id": {
    "$oid": "65ff019f6de4b7290e1da9e9"
  },
  "EventId": "eb81f052-ce84-4923-bf9e-57582e464992",
  "EventType": "设置反馈结果",
  "UserId": "eb81f052",
  "Username": "用户名",
  "Timestamp": {
    "$date": "2024-03-23T16:21:49.697Z"
  },
  "IPAddress": "1.2.3.4",
  "EntityChanges": [
    {
      "Entity": "实体名称",
      "Action": "Select",
      "Sql": "Select 语句已脱敏",
      "Parameters": {}
    },
    {
      "Entity": "实体名称",
      "Action": "Update",
      "Sql": "UPDATE entity set some_col=:p_0",
      "Parameters": {
        ":p_0": 6
      }
    }
  ],
  "RouteData": {
    "area": "Market",
    "action": "SetSubTaskFeedback",
    "controller": "Task",
    "taskId": "eb81f052",
    "subId": "57582e464992"
  },
  "Description": "操作类型：设置反馈结果",
  "Extra": null,
  "CreatedTime": {
    "$date": "2024-03-23T16:21:49.697Z"
  },
  "ModifiedTime": {
    "$date": "2024-03-23T16:21:49.697Z"
  }
}

You can see that the EntityChanges field contains the entity operations for this event, which are the database operations. There are two in total: one is a select query, and the other is an update modification to the database.

AuditLog Middleware

Finally, let's talk about this AuditLogMiddleware.

The code is quite straightforward: when each request comes in, it adds an AuditConstant.EventId into HttpContext.Items.

public class AuditLogMiddleware {
  private readonly RequestDelegate _next;

  public AuditLogMiddleware(RequestDelegate next) {
    _next = next;
  }

  public async Task Invoke(HttpContext context) {
    // 生成 EventId 并存储到 HttpContext.Items 中
    context.Items[AuditConstant.EventId] = Guid.NewGuid().ToString();

    await _next(context);
  }
}

Although this middleware was written, the EventId wasn't actually used afterwards.

It was originally intended to link entity updates with Filters (Filter), but it was later found to be unnecessary.

Let's keep it for now, in case it's useful later?