Handling auditing errors out of our control

[amstilp]

In some cases, the AnVIL team adds their own people or groups to our resources (e.g., groups, workspace sharing, etc). How do we want to handle this?

• Create an equivalent record in Django (e.g., sharing with the anvil-admins group)? Likely this would need to be done manually from the admin interface.
• Implement a way to ignore certain records (e.g., if an AnVIL dev created a workspace, they may be marked an owner. This is ok and we don't want the record in the app). The audit could report the "ignored" resources but not consider them errors.

---

Task list:

• Managed groups:

  • Add a model to track ignored audit errors for managed group membership
  • Update the ManagedGroupMembershipAudit method to ignore records in the above model
  • Add a list of ignored records to the managed group detail page (staff view only)
  • Add a button to the "Not in app" audit table that will add a record to the ignore model
  • Add a button on the detail page that will let us stop ignoring a record

• Workspaces:

  • Add a model to track ignored audit errors for workspace sharing
  • Update the WorkspaceGroupSharingAudit method to ignore records in the above model
  • Add a list of ignored records to the Workspace detail page (staff view only)
  • Add a button to the "Not in app" audit table that will add a record to the ignore model
  • Add a button on the detail page that will let us stop ignoring a record

[amstilp]

After discussing with @smgogarten, for the second bullet (if we end up implementing this instead of just removing them):

• Add a new model with two fields, workspace and EmailField. This model tracks which emails to ignore when auditing sharing records for a given workspace. This table should only be populated via the Admin interface, so no extra views are necessary.
• Modify the Workspace.audit_sharing() method to ignore any emails in this table.
• Modify AnVILAuditResults classes to handle ignored records - they should be tracked but reported as ignored.
• Modify audit views to show ignored records but not mark them as errors.
• Modify run_anvil_audit command to report ignored records only if --errors-only is not passed.
• Make sure to add tests for case-insensitivity etc.

[amstilp]

Change in strategy - audits can have a button in the "not in app" table to ignore errors.

If there are any errors in the "needs action" table, they should not be ignored because there is a record of them in the app. This would still be a problem.