Date: 2026-03-27 Status: Accepted
The @Auditable AOP annotation was designed to intercept any annotated method and record an audit event. It works well for generic events (onboarding steps, company creation) where the target ID is a simple method parameter.
For authentication events (login, logout), the audit event must include:
actorEmailactorKvkNumberactorRoleassuranceLevelUsedThe AOP aspect cannot derive these from a method parameter alone — it would need to load the Company and AuthorizedRepresentative after the fact.
The same issue appeared for TokenService.revokeSession(sessionToken): the aspect only has the raw session token string, not the KvK number or role. As a result, audit events for logout were recorded with actorKvkNumber = null and were not findable via AuditRepository.findByActorKvkNumber().
For auth events (LOGIN_SUCCESS, LOGIN_FAILURE, LOGOUT), call auditService.record() directly with full actor info, rather than relying on @Auditable.
CompanyAuthService.authenticateCompany() — removed @Auditable, now calls auditService.record() at each failure point and on success with explicit kvk/email/role/levelTokenService.revokeSession() — removed @Auditable, now calls auditService.record() inside the .map() block once the session entity is loaded (KvK and role available)Keep @Auditable for: onboarding steps, company registration, and other events where the AOP target ID is sufficient.
actorKvkNumber — queryable by KvKCompanyAuthService and TokenService
Reacties