Track who created or changed records via UI

Gemfile

@@ -47,6 +47,8 @@ gem "view_component"
 gem "aws-sdk-s3"
 # Track changes to models for auditing or versioning.
 gem "paper_trail"
+# Store active record objects in version whodunnits
+gem "paper_trail-globalid"
 
 group :development, :test do
   # Call 'byebug' anywhere in the code to stop execution and get a debugger console

Gemfile.lock

@@ -267,6 +267,9 @@ GEM
     paper_trail (12.2.0)
       activerecord (>= 5.2)
       request_store (~> 1.1)
+    paper_trail-globalid (0.2.0)
+      globalid
+      paper_trail (>= 3.0.0)
     parallel (1.21.0)
     parser (3.1.0.0)
       ast (~> 2.4.1)
@@ -469,6 +472,7 @@ DEPENDENCIES
   notifications-ruby-client
   overcommit (>= 0.37.0)
   paper_trail
+  paper_trail-globalid
   pg (~> 1.1)
   postcodes_io
   pry-byebug

app/controllers/application_controller.rb

@@ -1,4 +1,6 @@
 class ApplicationController < ActionController::Base
+  before_action :set_paper_trail_whodunnit
+
   def render_not_found
     render "errors/not_found", status: :not_found
   end
@@ -6,4 +8,10 @@ class ApplicationController < ActionController::Base
   def render_not_found_json(class_name, id)
     render json: { error: "#{class_name} #{id} not found" }, status: :not_found
   end
+
+protected
+
+  def user_for_paper_trail
+    current_user
+  end
 end

spec/requests/case_logs_controller_spec.rb

@@ -34,6 +34,7 @@ RSpec.describe CaseLogsController, type: :request do
     let(:in_progress) { "in_progress" }
     let(:completed) { "completed" }
 
+    context "when API" do
       let(:params) do
         {
           "owning_organisation_id": owning_organisation.id,
@@ -116,6 +117,25 @@ RSpec.describe CaseLogsController, type: :request do
       end
     end
 
+    context "when UI" do
+      let(:user) { FactoryBot.create(:user) }
+      let(:headers) { { "Accept" => "text/html" } }
+
+      before do
+        RequestHelper.stub_http_requests
+        sign_in user
+        post "/logs", headers: headers
+      end
+
+      it "tracks who created the record" do
+        created_id = response.location.match(/[1-9]+/)[0]
+        whodunnit_actor = CaseLog.find_by(id: created_id).versions.last.actor
+        expect(whodunnit_actor).to be_a(User)
+        expect(whodunnit_actor.id).to eq(user.id)
+      end
+    end
+  end
+
   describe "GET" do
     let(:user) { FactoryBot.create(:user) }
     let(:organisation) { user.organisation }

spec/requests/form_controller_spec.rb

@@ -155,6 +155,13 @@ RSpec.describe FormController, type: :request do
             expect(case_log.age1).to eq(answer)
             expect(case_log.age2).to be nil
           end
+
+          it "tracks who updated the record" do
+            case_log.reload
+            whodunnit_actor = case_log.versions.last.actor
+            expect(whodunnit_actor).to be_a(User)
+            expect(whodunnit_actor.id).to eq(user.id)
+          end
         end
       end
 

spec/requests/organisations_controller_spec.rb

@@ -185,6 +185,13 @@ RSpec.describe OrganisationsController, type: :request do
             follow_redirect!
             expect(page).to have_css(".govuk-notification-banner.govuk-notification-banner--success")
           end
+
+          it "tracks who updated the record" do
+            organisation.reload
+            whodunnit_actor = organisation.versions.last.actor
+            expect(whodunnit_actor).to be_a(User)
+            expect(whodunnit_actor.id).to eq(user.id)
+          end
         end
 
         context "with an organisation that the user does not belong to" do

spec/requests/users_controller_spec.rb

@@ -196,6 +196,13 @@ RSpec.describe UsersController, type: :request do
         user.reload
         expect(user.name).to eq(new_value)
       end
+
+      it "tracks who updated the record" do
+        user.reload
+        whodunnit_actor = user.versions.last.actor
+        expect(whodunnit_actor).to be_a(User)
+        expect(whodunnit_actor.id).to eq(user.id)
+      end
     end
 
     context "when the update fails to persist" do