admin_audit_http_client v1.0.0

Breaking

• All config keys were renamed to the audit_http_client_* scheme (audit_http_client_logdir, …_loglevel, …_format, …_exclude_domains); the old 0.2.0 key names are no longer read, there is no fallback — rename them in config.php when upgrading.

Added

• Redact sensitive request and response headers by default
• Redact credentials from logged URIs (query parameters and path secrets)

Fixed

• Declare supported PHP versions
• Adopt the optional handler parameter added to IClientService in NC 35
• Replace the memcache stats store with a process-local array
• Report immediate-path compression stats honestly and injection failures louder
• Make middleware injection idempotent and header lookups case-insensitive
• Clamp the log level and count rewound stream reads once
• Substitute broken UTF-8 in log entries instead of dropping them; rethrow non-throwable rejection reasons cleanly
• Derive stream consumption from the read position and report detached bodies as unknown

---

What's Changed

• build(deps): bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #1
• feat: redact sensitive request and response headers by default by @ernolf in #2
• fix: replace the memcache stats store with a process-local array by @ernolf in #3
• fix: report immediate-path compression stats honestly and injection failures louder by @ernolf in #4
• refactor: drop the dead listener, use DI and correlate with the server request ID by @ernolf in #5
• feat: unify config keys under the audit_http_client_ prefix by @ernolf in #6
• chore: make the app store-ready (docs + ncmake release workflow) by @ernolf in #7
• ci: add the ncmake release workflow that replaced release-asset.yml by @ernolf in #8
• build: make ncmake the single source of the shipped file set by @ernolf in #9
• build: adopt the ncmake release workflow template verbatim (MIT) by @ernolf in #10
• docs(readme): link to the central ncmake install guide by @ernolf in #11
• fix: make middleware injection idempotent and header lookups case-insensitive by @ernolf in #12
• feat: redact credential-bearing query parameters in logged URIs by @ernolf in #13
• refactor: route all log writes through a single LogWriter by @ernolf in #14
• fix: clamp the log level and count rewound stream reads once by @ernolf in #15
• test: cover the resolveLogDir fallback chain by @ernolf in #16
• fix: use the server's sensitive-value placeholder and keep the private- marker by @ernolf in #17
• refactor: declare classes final by @ernolf in #18
• fix: harden log encoding and the rejection rethrow by @ernolf in #19
• fix: redact handler stats URLs and report stream consumption honestly by @ernolf in #21
• fix: redact the key query parameter by default by @ernolf in #22
• build(release): bump version to 1.0.0 by @ernolf in #20

New Contributors

• @dependabot[bot] made their first contribution in #1

Full Changelog: v0.2.0...v1.0.0

admin_audit_http_client v0.2.0

Added

• loglevel_audit_http_client config key (int, default 0): controls which responses are logged — 0 = all, 1 = HTTP 400+ only, 2 = HTTP 500+ only
• audit_http_client_logs config key (string, default 'both'): selects log output format — 'json', 'plain', or 'both'
• audit_http_client_logs_exclude_domain config key (array, default []): list of hostnames to exclude from logging; supports wildcard prefix (*.example.com)

Full Changelog: v0.1.0...v0.2.0

admin_audit_http_client v0.1.0 (Initial Release)

• LoggingClientService: reflection-based IClientService decorator that injects HttpClientLoggerMiddleware into the Guzzle HandlerStack via HandlerStack::unshift()
• HttpClientLoggerMiddleware: logs all outgoing HTTP requests including method, URI, HTTP version, status code, all request/response headers, cURL transfer statistics, and compression metrics
• CountingStream: wraps 2xx response body streams to count decompressed bytes; writes the log entry on stream close or garbage collection
• TransferStatsStore: static store to correlate asynchronous on_stats cURL callback data with the middleware response handler
• LogPathHelper: derives per-host log file paths; writes one .json and one .log file per remote host
• HandlerStackReadyListener: prepared for future event-based injection once a HttpClientHandlerStackReadyEvent is available in Nextcloud core
• logdir_audit_http_client config key with automatic fallback chain: explicit override → sibling of logfile_audit → sibling of logfile → <datadirectory>/admin_audit_http_client_logs/
• Log entries contain: request ID (X-Nextcloud-ReqId), timestamp, method, URI, HTTP version, status, request headers, response headers, cURL handler stats (size_download, speed_download, total_time, etc.), compression stats (encoding, compressed_bytes, decompressed_bytes, ratio)

Full Changelog: https://github.com/ernolf/admin_audit_http_client/commits/v0.1.0