From 922f4c31387a5f0457dc61aa9b0f76f2eb29a6d2 Mon Sep 17 00:00:00 2001
From: Denis Arh <denis.arh@gmail.com>
Date: Thu, 26 Aug 2021 17:52:21 +0200
Subject: [PATCH] Add explicit option for enabling RBAC logging

---
 app/boot_levels.go      | 9 +++++++--
 pkg/options/RBAC.gen.go | 1 +
 pkg/options/RBAC.yaml   | 4 ++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/boot_levels.go b/app/boot_levels.go
index aac020bca..e259791da 100644
--- a/app/boot_levels.go
+++ b/app/boot_levels.go
@@ -285,7 +285,7 @@ func (app *CortezaApp) Provision(ctx context.Context) (err error) {
 		//       w/o using any access control
 
 		var (
-			ac  = rbac.NewService(app.Log, app.Store)
+			ac  = rbac.NewService(zap.NewNop(), app.Store)
 			acr = make([]*rbac.Role, 0)
 		)
 		for _, r := range auth.ProvisionUser().Roles() {
@@ -337,8 +337,13 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 	}
 
 	if rbac.Global() == nil {
+		log := zap.NewNop()
+		if app.Opt.RBAC.Log {
+			log = app.Log
+		}
+
 		//Initialize RBAC subsystem
-		ac := rbac.NewService(app.Log, app.Store)
+		ac := rbac.NewService(log, app.Store)
 
 		// and (re)load rules from the storage backend
 		ac.Reload(ctx)
diff --git a/pkg/options/RBAC.gen.go b/pkg/options/RBAC.gen.go
index 6674c03a7..4dbf10587 100644
--- a/pkg/options/RBAC.gen.go
+++ b/pkg/options/RBAC.gen.go
@@ -10,6 +10,7 @@ package options
 
 type (
 	RBACOpt struct {
+		Log                bool   `env:"RBAC_LOG"`
 		ServiceUser        string `env:"RBAC_SERVICE_USER"`
 		BypassRoles        string `env:"RBAC_BYPASS_ROLES"`
 		AuthenticatedRoles string `env:"RBAC_AUTHENTICATED_ROLES"`
diff --git a/pkg/options/RBAC.yaml b/pkg/options/RBAC.yaml
index e3cda55a1..c28fd9ffb 100644
--- a/pkg/options/RBAC.yaml
+++ b/pkg/options/RBAC.yaml
@@ -13,6 +13,10 @@ props:
 #    default: true
 #    description: When disabled all operations on all resources are allowed
 
+  - name: log
+    type: bool
+    description: Log RBAC related events and actions
+
   - name: serviceUser
   - name: bypassRoles
     # Using literal string instead of DefaultBypassRole constant for clarity & documentation