fix(gdpr): address additional PR review feedback

Apply fixes from second round of code review:

Security/Compliance:
- Sanitize custom consent type names in logs to prevent PII exposure
  (log "CUSTOM" instead of actual custom type name)

Performance/Stability:
- Add configurable maxQueryResults limit to AuditConfig (default 10000)
  to prevent unbounded memory usage when querying large audit logs
- Apply limit in FileAuditLogQueryService.findByUser() stream

Code Quality:
- Inject Spring-configured ObjectMapper via constructor in
  GdprExportService and ConsentAuditService instead of creating new
  instances (respects application's Jackson configuration)
- Update tests with @SPY ObjectMapper for proper injection

Configuration:
- Add user.audit.maxQueryResults property to dsspringuserconfig.properties

Author: devondragon

src/main/java/com/digitalsanctuary/spring/user/audit/AuditConfig.java

@@ -47,4 +47,12 @@ public class AuditConfig {
      */
     private int flushRate;
 
+    /**
+     * Maximum number of audit events to return from a single query.
+     * This prevents unbounded memory usage when querying large audit logs.
+     * Set to 0 or negative to disable the limit (not recommended for production).
+     * Default is 10000.
+     */
+    private int maxQueryResults = 10000;
+
 }

src/main/java/com/digitalsanctuary/spring/user/audit/FileAuditLogQueryService.java

@@ -104,8 +104,10 @@ private List<AuditEventDTO> findByUser(User user, Instant since, String action)
         String userEmail = user.getEmail();
         String userId = user.getId() != null ? user.getId().toString() : null;
 
+        int maxResults = auditConfig.getMaxQueryResults();
+
         try (Stream<String> lines = Files.lines(logPath)) {
-            return lines
+            Stream<AuditEventDTO> stream = lines
                     .skip(1) // Skip header line
                     .map(this::parseLine)
                     .filter(Objects::nonNull)
@@ -114,8 +116,14 @@ private List<AuditEventDTO> findByUser(User user, Instant since, String action)
                             !event.getTimestamp().isBefore(since))
                     .filter(event -> action == null || action.equals(event.getAction()))
                     .sorted(Comparator.comparing(AuditEventDTO::getTimestamp,
-                            Comparator.nullsLast(Comparator.reverseOrder())))
-                    .collect(Collectors.toList());
+                            Comparator.nullsLast(Comparator.reverseOrder())));
+
+            // Apply limit if configured to prevent unbounded memory usage
+            if (maxResults > 0) {
+                stream = stream.limit(maxResults);
+            }
+
+            return stream.collect(Collectors.toList());
         } catch (IOException e) {
             log.error("FileAuditLogQueryService.findByUser: Error reading audit log file", e);
             return Collections.emptyList();

src/main/java/com/digitalsanctuary/spring/user/gdpr/ConsentAuditService.java

@@ -55,9 +55,7 @@ public class ConsentAuditService {
     private final GdprConfig gdprConfig;
     private final ApplicationEventPublisher eventPublisher;
     private final AuditLogQueryService auditLogQueryService;
-
-    /** ObjectMapper for JSON serialization/deserialization of consent extra data. */
-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper;
 
     /**
      * Records that a user has granted consent.
@@ -134,8 +132,10 @@ public ConsentRecord recordConsentGranted(User user, ConsentType consentType, St
         eventPublisher.publishEvent(new ConsentChangedEvent(this, user, record,
                 ConsentChangedEvent.ChangeType.GRANTED));
 
+        // Log consent type safely - avoid exposing custom type names which could contain PII
+        String logTypeName = record.getType() == ConsentType.CUSTOM ? "CUSTOM" : record.getEffectiveTypeName();
         log.info("ConsentAuditService.recordConsentGranted: Recorded consent grant for user {} - type {}",
-                user.getId(), record.getEffectiveTypeName());
+                user.getId(), logTypeName);
 
         return record;
     }
@@ -212,8 +212,10 @@ public ConsentRecord recordConsentWithdrawn(User user, ConsentType consentType,
         eventPublisher.publishEvent(new ConsentChangedEvent(this, user, record,
                 ConsentChangedEvent.ChangeType.WITHDRAWN));
 
+        // Log consent type safely - avoid exposing custom type names which could contain PII
+        String logTypeName = record.getType() == ConsentType.CUSTOM ? "CUSTOM" : record.getEffectiveTypeName();
         log.info("ConsentAuditService.recordConsentWithdrawn: Recorded consent withdrawal for user {} - type {}",
-                user.getId(), record.getEffectiveTypeName());
+                user.getId(), logTypeName);
 
         return record;
     }

src/main/java/com/digitalsanctuary/spring/user/gdpr/GdprExportService.java

@@ -57,9 +57,7 @@ public class GdprExportService {
     private final PasswordResetTokenRepository passwordResetTokenRepository;
     private final List<GdprDataContributor> dataContributors;
     private final ApplicationEventPublisher eventPublisher;
-
-    /** ObjectMapper for JSON deserialization of consent extra data. */
-    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ObjectMapper objectMapper;
 
     /**
      * Exports all GDPR-relevant data for a user.

src/main/resources/config/dsspringuserconfig.properties

@@ -27,6 +27,11 @@ user.audit.flushRate=30000
 # If true, all events will be logged.
 user.audit.logEvents=true
 
+# Maximum number of audit events to return from a single query.
+# Prevents unbounded memory usage when querying large audit logs.
+# Set to 0 or negative to disable the limit (not recommended for production).
+user.audit.maxQueryResults=10000
+
 
 # If true, users can delete their own accounts.  If false, accounts are disabled instead of deleted.
 user.actuallyDeleteAccount=false

src/test/java/com/digitalsanctuary/spring/user/gdpr/ConsentAuditServiceTest.java

@@ -15,7 +15,10 @@
 import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
+import org.mockito.Spy;
 import org.springframework.context.ApplicationEventPublisher;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 import com.digitalsanctuary.spring.user.audit.AuditEvent;
 import com.digitalsanctuary.spring.user.audit.AuditLogQueryService;
 import com.digitalsanctuary.spring.user.event.ConsentChangedEvent;
@@ -38,6 +41,9 @@ class ConsentAuditServiceTest {
     @Mock
     private AuditLogQueryService auditLogQueryService;
 
+    @Spy
+    private ObjectMapper objectMapper = JsonMapper.builder().build();
+
     @Mock
     private HttpServletRequest request;
 

src/test/java/com/digitalsanctuary/spring/user/gdpr/GdprExportServiceTest.java

@@ -16,7 +16,10 @@
 import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
+import org.mockito.Spy;
 import org.springframework.context.ApplicationEventPublisher;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 import com.digitalsanctuary.spring.user.audit.AuditEventDTO;
 import com.digitalsanctuary.spring.user.audit.AuditLogQueryService;
 import com.digitalsanctuary.spring.user.dto.GdprExportDTO;
@@ -48,6 +51,9 @@ class GdprExportServiceTest {
     @Mock
     private ApplicationEventPublisher eventPublisher;
 
+    @Spy
+    private ObjectMapper objectMapper = JsonMapper.builder().build();
+
     @InjectMocks
     private GdprExportService gdprExportService;