AUDIT-36: Add REST endpoint for audit log queries with user/action/date filtering

[AshThe25]

Problem

This module does not have any REST API, but rather only uses the old DWR API. The OpenMRS O3 Frontend dashboard needs an endpoint that returns JSON data for the audit log.

Solution

Introduce a new GET request on /module/auditlog/rest/auditlogs with these parameters:

• user — filters on UUID of the user
• action — multiple values for CREATED, UPDATED, DELETED
• startDate / endDate — ISO 8601 dates
• startIndex / limit — paging with maximum limit set to 100

Changes

• HibernateAuditLogDAO - add new function getAuditLogs(userUuid, ...)
• AuditLogDAO / AuditLogService / AuditLogServiceImpl - add new function wired up through all tiers
• AuditLogRestController - Spring MVC @controller with @responsebody
• AuditLogDTO / AuditLogPageResponse - JSON response DTO classes

Testing

Manual testing with curl on the OpenMRS server. Unit tests coming in a different pull request.

JIRA

AUDIT-36

[AshThe25]

JIRA issue: https://issues.openmrs.org/browse/AUDIT-36

The module has no REST API, uses old DWR instead.
O3 frontend requires a JSON endpoint to show audit log information.

GET /module/auditlog/rest/auditlogs is added.
It supports the following query parameters:

• user UUID
• action in (CREATED, UPDATED, DELETED), comma-separated
• date range, ISO format for both
• pagination: startIndex, limit (not more than 100)

Frontend workspace using this endpoint:
openmrs/openmrs-esm-admin-tools#26

[AshThe25]

Frontend workspace that consumes this endpoint:
openmrs/openmrs-esm-admin-tools#267

[AshThe25]

Added unit tests in the latest commit covering:

• Returns 200 with paginated results
• Returns empty results correctly
• Filters by user UUID
• Parses comma-separated actions
• Rejects startDate after endDate (400)
• Caps limit at 100
• Ignores invalid action values
• AuditLogServiceImpl delegation tests

[praneeth622]

If types is null we match all; if it is an empty list we pass an empty Restrictions.in, which Hibernate turns into 1=0. Worth adding an isEmpty guard so the caller does not accidentally get zero rows

[AshThe25]

Good catch — added isEmpty() guard on both types and actions lists. An empty collection now behaves the same as null instead of generating 1=0. Pushed the fix.

[AshThe25]

@dkayiwa Hi, I'm a GSoC 2026 applicant working on the audit log module enhancement proposal. This PR adds the REST endpoint that the O3 frontend dashboard depends on. Would appreciate a review when you have time.

Related PRs in this series:

• AUDIT-37: add database indexes on auditlog_audit_log for frequently filtered columns #19 — database indexes for query performance
• AUDIT-38: fix inverted null check on user in AuditLogListItem causing NullPointerException #20 — null check inversion fix
• AUDIT-39: fix resource leak in AuditLogUtil.getAsString by using try-with-resources #21 — resource leak fix
• AUDIT-40: Add count endpoint for audit log entries #22 — count endpoint
• AUDIT-41: add depth limit to recursive save() in HibernateAuditLogDAO #23 — recursive save depth limit
• AUDIT-42: restrict ViewAuditLogController to GET requests only #24 — restrict controller to GET
• AUDIT-43: add CSV export endpoint for audit log entries #25 — CSV export
• AUDIT-44: extend count endpoint to support filtering by object type #26 — count by type
• AUDIT-35: escape user-controlled values in viewAuditLog.jsp to fix XSS #27 — XSS fix in viewAuditLog.jsp

[AshThe25]

Hi @ibacher, I see these PRs were closed. Could you share what was wrong so I can learn from it? Happy to rework any of them based on your feedback.