commanded/commanded-audit-middleware

Command auditing middleware for Commanded CQRS/ES applications

Commanded

Use Commanded to build your own Elixir applications following the CQRS/ES pattern.

Provides support for:

• Command registration and dispatch.
• Hosting and delegation to aggregates.
• Event handling.
• Long running process managers.

Commanded provides a solid technical foundation for you to build on. It allows you to focus on modelling your domain, the most important part of your app, creating a better application at a faster pace.

You can use Commanded with one of the following event stores for persistence:

• EventStore - Elixir library using Postgres for persistence.
• EventStoreDB - a stream database built for Event Sourcing.
• In-memory event store - included for test use only.

Please refer to the CHANGELOG for features, bug fixes, and any upgrade advice included for each release.

Requires Erlang/OTP v21.0 and Elixir v1.11 or later.

---

Sponsors

• View sponsors & backers

---

• Changelog
• Wiki
• What is CQRS/ES?
• Frequently asked questions
• Getting help
• Latest published Hex package & documentation

MIT License

---

This README and the following guides follow the master branch which may not be the currently published version.

Read the documentation for the latest published version of Commanded on Hex.

Overview

• Getting started
• Choosing an event store
  • PostgreSQL-based EventStore
  • Greg Young's Event Store
• Using Commanded
  • Aggregates
    • Example aggregate
    • Commanded.Aggregate.Multi
    • Aggregate state snapshots
  • Commands
    • Command handlers
    • Command dispatch and routing
      • Define aggregate identity
      • Multi-command registration
      • Dispatch timeouts
      • Dispatch consistency guarantee
      • Dispatch returning execution result
      • Aggregate lifespan
      • Composite command routers
    • Middleware
      • Example middleware
    • Composite command routers
  • Events
    • Domain events
    • Event handlers
      • Consistency guarantee
    • Upcasting events
  • Process managers
    • Example process manager
  • Supervision
  • Serialization
    • Default JSON serializer
    • Configuring JSON serialization
    • Decoding event structs
    • Using an alternative serialization format
    • Customising serialization
  • Read model projections
• Deployment
  • Single node deployment
  • Multi node cluster deployment
  • Multi node, but not clustered deployment
• Testing with Commanded
• Used in production?
• Example application
• Learn Commanded in 20 minutes
• Choosing an event store provider
• Tooling
• Contributing
• Need help?

---

Used in production?

Yes, see the companies using Commanded.

Example application

Conduit is an open source, example Phoenix 1.3 web application implementing the CQRS/ES pattern in Elixir. It was built to demonstrate the implementation of Commanded in an Elixir application for the Building Conduit book.

Learn Commanded in 20 minutes

Watch Bernardo Amorim introduce CQRS and event sourcing at Code Beam SF 2018. Including a tutorial on how to implement an Elixir application using these concepts with Commanded.

Contributing

Pull requests to contribute new or improved features, and extend documentation are most welcome.

Please follow the existing coding conventions, or refer to the Elixir style guide.

You should include unit tests to cover any changes. Run mix test to execute the test suite.

Contributors

Commanded exists thanks to the following people who have contributed.

• Adil Yarulin
• Alexandre de Souza
• Andrey Akulov
• Andrzej Sliwa
• Ben Smith
• Benjamin Moss
• Bernardo Amorim
• Brenton Annan
• Chris Brodt
• Chris Martin
• Christophe Juniet
• Danilo Silva
• Dave Lucia
• David Carlin
• Damir Vandic
• Danni Friedland
• Dilaksun Bavarajan
• Ernesto
• Fernando Mendes
• Florian Ebeling
• Henry Hazan
• JC
• Joan Zapata
• Joao Gilberto Moura
• João Thallis
• John Wilger
• Joseph Lozano
• Kian-Meng Ang
• Kok J Sam
• Leif Gensert
• Luís Ferreira
• Marcelo Dominguez
• Matt Doughty
• Matthew Boehlig
• Michael Herold
• Miguel Palhas
• Nigel Thorne
• Olafur Arason
• Paolo Laurenti
• Patrick Detlefsen
• Phil Chen
• Raphaël Lustin
• Štefan Ľupták
• Tobiasz Małecki
• Vladimir Drobyshevskiy
• Willy Wombat
• Yordis Prieto
• Yuri de Figueiredo
• Zven

Need help?

Please open an issue if you encounter a problem, or need assistance. You can also seek help in the #commanded channel in the official Elixir Slack.

commanded-audit-middleware's Issues

Error thrown before the start_time causes delta for end_time to fail

Error

1) test register user should fail when email address already taken and return error (Conduit.UsersTest)
     test/conduit/users/users_test.exs:69
     ** (FunctionClauseError) no function clause matching in Commanded.Middleware.Auditing.delta/1

     The following arguments were given to Commanded.Middleware.Auditing.delta/1:

%Commanded.Middleware.Pipeline{assigns: %{error: :validation_failure, error_reason: %{email: ["has already been taken"]}}, 
...

To Reproduce

Add commanded-audit-middleware to Conduit, and then run mix test.

Suggested Solution

Pattern Matching for delta

for when a delta does not yet have a start_time and error is already thrown.

Filter specific fields from audited commands

It seems that there is not a way to hide secrets, for example, when a command %CreateUser{email: foo@123, password: 123123, password_confirmation: 123123} is given:

This is what phoenix does, by default:

Parameters: %{"_csrf_token" => "URlELFdLASBAPzQzLD4IYDYrG1V1AAAA3s+B42ij0ngdDY1SBIc9Fw==", "_utf8" => "✓", "email" => "foo@123", "password" => "[FILTERED]", "password_confirmation" => "[FILTERED]"}

And this is what audit does:

[debug] QUERY OK db=5.9ms queue=0.1ms
INSERT INTO "command_audit" ("command_type","command_uuid","correlation_id","data","metadata","occurred_at") VALUES ($1,$2,$3,$4,$5,$6) ["Elixir.Accounts.User.Commands.CreateUser", "1918d8b1-dccb-4ae2-9a7b-2f37002dbb23", <<36, 209, 176, 66, 185, 241, 77, 1, 132, 82, 117, 247, 155, 104, 150, 135>>, "{\"password_confirmation\":\"123\",\"password\":\"123\",\"email\":\"foo@123\"}", "{}", {{2017, 12, 16}, {20, 27, 22, 68258}}]

The solution should be having some sensible defaults, and allow people to configure it further.

Use 2 different DB when running an application with 2 Commanded Applications

Hi,

Thanks for this library!

Im facing the following limitation, Im running an application that is currently running 2 different Commanded Applications with 2 different Routers and 2 differente event store DB.

Ideally I would want to add this library and be able to have 2 DB for the audits.
For what I can see that is not possible now.

Is this something that make sense to add to this project?