Skip to content

Audit log entries for identity_unlinked are written with an empty log_type #2679

Description

@evanmarshall

What's wrong

internal/models/audit_log_entry.go L105-111 builds every audit payload with "log_type": ActionLogTypeMap[action]. But ActionLogTypeMap (L56-79) has no entry for IdentityUnlinkAction ("identity_unlinked", declared at L44). In Go, a missing map key returns the zero value, so identity-unlink audit events are persisted with log_type: "" instead of user. The unlink at internal/api/identity.go still completes, but the audit record is misclassified and harder to filter/attribute.

How it should be

Add IdentityUnlinkAction: user to ActionLogTypeMap, consistent with the other user-facing identity/passkey actions (PasskeyCreatedAction, PasskeyUpdatedAction, PasskeyDeletedAction already map to user). Then unlink events are searchable/filterable by log_type like every other action.

Used versions

Observed against master @ ef6587a (source inspection).

OS information

N/A (source inspection).


Found while running Ito (AI code review, free for open source) against recently merged PRs — full analysis: https://app.ito.ai/share/6e38a9ea-323d-420a-a705-3d3f4053a41b.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions