Cb 5584 provide more information in the debug log for auditing (#3061)

* CB-5584. Added more logs for gql and rest in RM. Added new parameter in global preferences for showing additional logs

* CB-5584. Added more logs for gql and rest in RM. Added new parameter in global preferences for showing additional logs

* CB-5584. Rename parameter

* CB-5584. Rename parameter

* CB-5584. Refactor after review

* CB-5584. Refactor after review

* CB-5584. Renamed parameter

* CB-5584. Added check variable for contains restricted variable

* CB-5584. Fixed showing wrong sessionId.

---------

Co-authored-by: Evgenia <139753579+EvgeniaBzzz@users.noreply.github.com>

server/bundles/io.cloudbeaver.server/plugin.xml

@@ -75,4 +75,12 @@
         </eventHandler>
     </extension>
 
+    <extension point="org.jkiss.dbeaver.settings">
+        <propertyGroup id="log" label="Logger">
+            <property id="log.api.graphql.debug" label="Enable detailed logging"
+                      type="boolean" scopes="global"
+                      description="Enable detailed logging of GraphQL queries in the server log, including all provided variables"/>
+        </propertyGroup>
+    </extension>
+
 </plugin>

server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLEndpoint.java

@@ -51,10 +51,7 @@ import java.io.InputStreamReader;
 import java.io.Reader;
 import java.lang.reflect.InvocationTargetException;
 import java.net.URL;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 import java.util.concurrent.CompletableFuture;
 
 public class GraphQLEndpoint extends HttpServlet {
@@ -68,7 +65,6 @@ public class GraphQLEndpoint extends HttpServlet {
     private static final String HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";
 
     private static final String CORE_SCHEMA_FILE_NAME = "schema/schema.graphqls";
-
     private final GraphQL graphQL;
 
     private static final Gson gson = new GsonBuilder()
@@ -253,10 +249,13 @@ public class GraphQLEndpoint extends HttpServlet {
 //                    apiCall += " (" + variables + ")";
 //                }
 //            }
+            String sessionId = GraphQLLoggerUtil.getSessionId(request);
+            String userId = GraphQLLoggerUtil.getUserId(request);
+            String loggerMessage = GraphQLLoggerUtil.buildLoggerMessage(sessionId, userId, variables);
             if (apiCall != null) {
-                log.debug("API > " + apiCall);
+                log.debug("API > " + apiCall + loggerMessage);
             } else if (DEBUG) {
-                log.debug("API > " + query);
+                log.debug("API > " + query + loggerMessage);
             }
         }
         ExecutionInput executionInput = contextBuilder.build();

server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLLoggerUtil.java

@@ -0,0 +1,102 @@
+/*
+ * DBeaver - Universal Database Manager
+ * Copyright (C) 2010-2024 DBeaver Corp and others
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.cloudbeaver.server.graphql;
+
+import io.cloudbeaver.model.session.WebSession;
+import io.cloudbeaver.server.CBApplication;
+import io.cloudbeaver.server.CBPlatform;
+import jakarta.servlet.http.HttpServletRequest;
+import org.jkiss.utils.CommonUtils;
+
+import java.util.Map;
+import java.util.Set;
+
+public class GraphQLLoggerUtil {
+
+    public static final String LOG_API_GRAPHQL_DEBUG_PARAMETER = "log.api.graphql.debug";
+    private static final Set<String> PROHIBITED_VARIABLES =
+        Set.of("password", "config", "parameters", "settings", "licenseText", "credentials", "username");
+
+    public static String getUserId(HttpServletRequest request) {
+        WebSession session = getWebSession(request);
+        if (session == null) {
+            return null;
+        }
+        String userId = session.getUserContext().getUserId();
+        if (userId == null && session.getUserContext().isAuthorizedInSecurityManager()) {
+            return "anonymous";
+        }
+        return userId;
+    }
+
+    public static String getSessionId(HttpServletRequest request) {
+        WebSession session = getWebSession(request);
+        if (session == null) {
+            return null;
+        }
+        return session.getUserContext().getSmSessionId();
+    }
+
+    private static WebSession getWebSession(HttpServletRequest request) {
+        if (request.getSession() == null) {
+            return null;
+        }
+        return (WebSession) CBApplication.getInstance()
+            .getSessionManager()
+            .getSession(request.getSession().getId());
+    }
+
+    public static String buildLoggerMessage(String sessionId, String userId, Map<String, Object> variables) {
+        StringBuilder loggerMessage = new StringBuilder(" [user: ").append(userId)
+            .append(", sessionId: ").append(sessionId).append("]");
+
+        if (CBPlatform.getInstance().getPreferenceStore().getBoolean(LOG_API_GRAPHQL_DEBUG_PARAMETER)
+                && variables != null
+        ) {
+            loggerMessage.append(" [variables] ");
+            String parsedVariables = parseVarialbes(variables);
+            if (CommonUtils.isNotEmpty(parsedVariables)) {
+                loggerMessage.append(parseVarialbes(variables));
+            }
+        }
+        return loggerMessage.toString();
+    }
+
+    private static String parseVarialbes(Map<String, Object> map) {
+        StringBuilder result = new StringBuilder();
+
+        for (Map.Entry<String, Object> entry : map.entrySet()) {
+            String key = entry.getKey();
+            Object value = entry.getValue();
+
+            boolean isProhibited = PROHIBITED_VARIABLES.stream()
+                .anyMatch(prohibitedKey -> key.toLowerCase().contains(prohibitedKey.toLowerCase()));
+
+            if (isProhibited) {
+                result.append(key).append(": ").append("******** ");
+                continue;
+            }
+
+            if (value instanceof Map) {
+                result.append(parseVarialbes((Map<String, Object>) value));
+            } else {
+                result.append(key).append(": ").append(value).append(" ");
+            }
+        }
+        return result.toString().trim();
+    }
+}