feat(audit-log): add an annotation to hash or redact a property to audit log (#0000)

[Gael Leblan (Dimfacion)]

Proposed changes

Testing Instructions

1. Step-by-step how to test
2. Environment or config notes

Related issues

• Closes #ISSUE-NUMBER

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

Further comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...

[github-actions]

📖 Documentation check — ✅ Passed

17 functional file(s), 0 doc file(s) changed.

No documentation gaps detected.

[Copilot]

Pull request overview

This PR introduces explicit audit-log masking controls by adding @AuditLogHash and @AuditLogRedact annotations (in addition to the existing ignore semantics) and wiring them into the audit payload serialization path, then annotating a set of sensitive model/DTO fields to prevent leaking secrets/PII into audit events.

Changes:

• Add new audit-log masking annotations (@AuditLogHash, @AuditLogRedact) and apply them across selected entities and API DTOs/inputs.
• Extend AuditObjectMapper to hash/redact annotated properties during audit payload serialization, and update redaction utilities to standardize on "[REDACTED]" with one-time warnings when fallback redaction is applied.
• Add/adjust tests to validate audit payload masking behavior.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
openaev-model/src/main/java/io/openaev/database/model/User.java	Annotates user PII fields to be ignored/hashed/redacted in audit payloads.
openaev-model/src/main/java/io/openaev/database/model/TenantXtmHubRegistration.java	Hashes registration token in audit payloads.
openaev-model/src/main/java/io/openaev/database/model/PhishingResult.java	Hashes phishing token in audit payloads.
openaev-model/src/main/java/io/openaev/database/model/Asset.java	Hashes selected sensitive asset fields (including macAddresses) in audit payloads.
openaev-model/src/main/java/io/openaev/database/model/Agent.java	Changes active/inactivity threshold constant used by agent activity logic.
openaev-model/src/main/java/io/openaev/database/audit/AuditLogRedact.java	Adds annotation to mark fields for redaction in audit serialization.
openaev-model/src/main/java/io/openaev/database/audit/AuditLogHash.java	Adds annotation to mark fields for hashing in audit serialization.
openaev-api/src/test/java/io/openaev/service/LogServiceTest.java	Updates expected redaction token string.
openaev-api/src/test/java/io/openaev/aop/audit_log/AuditObjectMapperTest.java	Adds test coverage for hash/redact behavior in audit serialization.
openaev-api/src/main/java/io/openaev/utils/object/ObjectRedactionUtils.java	Standardizes redaction output and adds warning-on-fallback behavior.
openaev-api/src/main/java/io/openaev/rest/user/form/user/UpdateUserInfoInput.java	Adds audit masking annotations on user info update input fields.
openaev-api/src/main/java/io/openaev/rest/user/form/user/UpdatePasswordInput.java	Redacts password field in audit payloads.
openaev-api/src/main/java/io/openaev/rest/user/form/user/ChangePasswordInput.java	Redacts password fields in audit payloads.
openaev-api/src/main/java/io/openaev/rest/user/form/player/PlayerOutput.java	Applies audit masking annotations to player output PII fields.
openaev-api/src/main/java/io/openaev/rest/user/form/player/PlayerInput.java	Applies audit masking annotations to player input PII fields.
openaev-api/src/main/java/io/openaev/rest/user/form/me/UpdateProfileInput.java	Applies audit ignore to profile PII fields in audit payloads.
openaev-api/src/main/java/io/openaev/rest/user/form/me/UpdateMePasswordInput.java	Redacts password fields in audit payloads.
openaev-api/src/main/java/io/openaev/api/users/dto/UserOutput.java	Applies audit masking annotations to user output DTO PII fields.
openaev-api/src/main/java/io/openaev/api/users/dto/UserInput.java	Applies audit masking annotations to user input DTO PII/password fields.
openaev-api/src/main/java/io/openaev/aop/audit_log/AuditObjectMapper.java	Adds masking-aware serializers for audit payload generation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

openaev-api/src/main/java/io/openaev/aop/audit_log/AuditObjectMapper.java:140

• issue (blocking): AuditRedactSerializer currently writes "[REDACTED]" even when the original value is null, which changes the meaning of the payload (null vs present-but-redacted). It should preserve nulls the same way AuditHashSerializer does.

    public void serialize(
        Object value, com.fasterxml.jackson.core.JsonGenerator gen, SerializerProvider provider)
        throws IOException {
      gen.writeString(REDACTED);
    }

openaev-api/src/main/java/io/openaev/utils/object/ObjectRedactionUtils.java:224

• suggestion (non-blocking): looksLikeSha256() uses String.matches(), which recompiles the regex on each call. This method can run in hot logging/audit paths; a simple length + hex check avoids regex overhead and allocations.

  private static boolean looksLikeSha256(String value) {
    return value != null && value.matches("^[a-fA-F0-9]{64}$");
  }