@ Override public boolean outgoingResponse ( RequestDetails theRequestDetails , Bundle theResponseObject , HttpServletRequest theServletRequest , HttpServletResponse theServletResponse ) throws AuthenticationException { if ( myClientParamsOptional && myDataStore == null ) { // auditing is not required or configured, so do nothing here log . debug ( "No auditing configured." ) ; return true ; } if ( theResponseObject == null || theResponseObject . isEmpty ( ) ) { log . debug ( "No bundle to audit" ) ; return true ; } try { log . info ( "Auditing bundle: " + theResponseObject + " from request " + theRequestDetails ) ; SecurityEvent auditEvent = new SecurityEvent ( ) ; auditEvent . setEvent ( getEventInfo ( theRequestDetails ) ) ; // get user info from request if available Participant participant = getParticipant ( theServletRequest ) ; if ( participant == null ) { log . debug ( "No participant to audit" ) ; return true ; // no user to audit - throws exception if client params are required } List < Participant > participants = new ArrayList < SecurityEvent . Participant > ( 1 ) ; participants . add ( participant ) ; auditEvent . setParticipant ( participants ) ; SecurityEventObjectLifecycleEnum lifecycle = mapResourceTypeToSecurityLifecycle ( theRequestDetails . getRestOperationType ( ) ) ; byte [ ] query = getQueryFromRequestDetails ( theRequestDetails ) ; List < ObjectElement > auditableObjects = new ArrayList < SecurityEvent . ObjectElement > ( ) ; for ( BundleEntry entry : theResponseObject . getEntries ( ) ) { IResource resource = entry . getResource ( ) ; ObjectElement auditableObject = getObjectElement ( resource , lifecycle , query ) ; if ( auditableObject != null ) auditableObjects . add ( auditableObject ) ; } if ( auditableObjects . isEmpty ( ) ) { log . debug ( "No auditable resources to audit." ) ; return true ; // no PHI to audit } else { log . debug ( "Auditing " + auditableObjects . size ( ) + " resources." ) ; } auditEvent . setObject ( auditableObjects ) ; auditEvent . setSource ( getSourceElement ( theServletRequest ) ) ; store ( auditEvent ) ; return true ; // success } catch ( Exception e ) { log . error ( "Unable to audit resource: " + theResponseObject + " from request: " + theRequestDetails , e ) ; throw new InternalErrorException ( "Auditing failed, unable to complete request" , e ) ; } }
Intercept the outgoing response to perform auditing of the request data if the bundle contains auditable resources .