fix: make impersonation audit logging non-blocking (#16390)

## Summary

This PR makes the Clickhouse audit logging in the impersonation flow
**non-blocking** (fire-and-forget).

## Problem

When the Clickhouse server is unavailable or slow, the impersonation
feature becomes blocked because all audit logging calls use `await`,
causing the entire impersonation flow to hang.

## Solution

Remove the `await` keyword from all audit logging calls in the
impersonation flow. The `ClickHouseService.insert()` method already
handles errors internally (catches and logs them), so there's no risk of
unhandled promise rejections.

## Changes

- **`impersonation.service.ts`**: 4 audit calls made non-blocking
- **`auth.resolver.ts`**: 5 audit calls made non-blocking  
- **`auth.service.ts`**: 2 audit calls made non-blocking

## Testing

- Impersonation flow continues to work when Clickhouse is available
- Impersonation flow no longer blocks when Clickhouse is unavailable
This commit is contained in:
Félix Malfait
2025-12-08 09:48:44 +01:00
committed by GitHub
parent 3e57aa14d3
commit 1f9a6b067a
3 changed files with 11 additions and 11 deletions
@@ -706,7 +706,7 @@ export class AuthResolver {
userId: impersonatorUserWorkspace.user.id,
});
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: `${isServerLevelImpersonation ? 'server' : 'workspace'}.impersonation.token_exchange_attempt`,
message: `Impersonation token exchange attempt for ${targetUserEmail} by ${impersonatorUserWorkspace.user.id}`,
});
@@ -717,7 +717,7 @@ export class AuthResolver {
if (isServerLevelImpersonation) {
if (!hasServerLevelImpersonatePermission) {
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: 'server.impersonation.token_exchange_failed',
message: `Server level impersonation not allowed for ${targetUserEmail} by userId ${impersonatorUserWorkspace.user.id}`,
});
@@ -728,7 +728,7 @@ export class AuthResolver {
);
}
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: `server.impersonation.token_exchange_success`,
message: `Impersonation token exchanged for ${targetUserEmail} by userId ${impersonatorUserWorkspace.user.id}`,
});
@@ -750,7 +750,7 @@ export class AuthResolver {
});
if (!hasWorkspaceLevelImpersonatePermission) {
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: 'workspace.impersonation.token_exchange_failed',
message: `Impersonation not allowed for ${targetUserEmail} by userId ${impersonatorUserWorkspace.user.id}`,
});
@@ -760,7 +760,7 @@ export class AuthResolver {
);
}
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: 'workspace.impersonation.token_exchange_success',
message: `Impersonation token exchanged for ${targetUserEmail} by userId ${impersonatorUserWorkspace.user.id}`,
});
@@ -410,7 +410,7 @@ export class AuthService {
userId: impersonatorUserId,
});
await analytics.insertWorkspaceEvent('Monitoring', {
analytics.insertWorkspaceEvent('Monitoring', {
eventName: 'workspace.impersonation.attempted',
message: `correlationId=${correlationId}; impersonatorUserWorkspaceId=${impersonatorUserWorkspaceId}; targetUserWorkspaceId=${impersonatedUserWorkspaceId}; workspaceId=${workspaceId}`,
});
@@ -436,7 +436,7 @@ export class AuthService {
true,
);
await analytics.insertWorkspaceEvent('Monitoring', {
analytics.insertWorkspaceEvent('Monitoring', {
eventName: 'workspace.impersonation.issued',
message: `correlationId=${correlationId}; impersonatorUserWorkspaceId=${impersonatorUserWorkspaceId}; targetUserWorkspaceId=${impersonatedUserWorkspaceId}; workspaceId=${workspaceId}`,
});
@@ -144,13 +144,13 @@ export class ImpersonationService {
userId: impersonatorUserWorkspace.user.id,
});
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: `${impersonationLevel}.impersonation.attempt`,
message: `Impersonation attempt: targetUserId=${toImpersonateUserWorkspace.user.id}, workspaceId=${toImpersonateUserWorkspace.workspace.id}, impersonatorUserId=${impersonatorUserWorkspace.user.id}`,
});
try {
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: `${impersonationLevel}.impersonation.login_token_attempt`,
message: `Impersonation token generation attempt for user ${toImpersonateUserWorkspace.user.id}`,
});
@@ -164,7 +164,7 @@ export class ImpersonationService {
},
);
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: `${impersonationLevel}.impersonation.login_token_generated`,
message: `Impersonation token generated successfully for user ${toImpersonateUserWorkspace.user.id}`,
});
@@ -179,7 +179,7 @@ export class ImpersonationService {
loginToken,
};
} catch {
await auditService.insertWorkspaceEvent(MONITORING_EVENT, {
auditService.insertWorkspaceEvent(MONITORING_EVENT, {
eventName: `${impersonationLevel}.impersonation.login_token_failed`,
message: `Impersonation token generation failed for targetUserId=${toImpersonateUserWorkspace.user.id}`,
});