feat(api): Log any access granted as part of a legacy fallback. (#401)

spinnaker · May 1, 2019 · 4e4c282 · 4e4c282
1 parent 1df3824
commit 4e4c282
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/fiat-api/src/main/java/com/netflix/spinnaker/fiat/shared/FiatPermissionEvaluator.java b/fiat-api/src/main/java/com/netflix/spinnaker/fiat/shared/FiatPermissionEvaluator.java
@@ -178,6 +178,16 @@ public boolean hasPermission(String username,
         hasPermission ? null : new AuthorizationFailure(a, r, resourceName.toString())
     );
 
+    if (permission != null && permission.isLegacyFallback() && hasPermission) {
+      // log any access that was granted as part of a legacy fallback.
+      if (a == Authorization.READ) {
+        // purposely logging at 'debug' as 'READ' will be sufficiently more verbose
+        log.debug("Legacy fallback granted {} access (type: {}, resource: {})", a, r, resourceName);
+      } else {
+        log.warn("Legacy fallback granted {} access (type: {}, resource: {})", a, r, resourceName);
+      }
+    }
+
     return hasPermission;
   }