fix(audit): log many-to-many collection changes on CFP selection entities

app/Audit/AbstractAuditLogFormatter.php

@@ -74,6 +74,70 @@ protected function processCollection(PersistentCollectionMetadata $metadata): ?a
         ];
     }
 
+    /**
+     * Shared handler for EVENT_COLLECTION_MANYTOMANY_UPDATE / DELETE (ADR-004).
+     *
+     * Runs the two-step pipeline (handleManyToManyCollection -> processCollection) and builds
+     * "<label> <field> (<TargetEntity>) updated: Added IDs: [..], Removed IDs: [..] by user X"
+     * or "<label> <field> (<TargetEntity>) deleted: Removed IDs: [..] by user X".
+     * Returns null when there is nothing to report, so the entry is not logged.
+     *
+     * A concrete formatter only has to route both event types here from its own
+     * EVENT_COLLECTION_MANYTOMANY_* case and provide the entity wording as $label.
+     */
+    protected function formatManyToManyCollectionChange(array $change_set, string $label): ?string
+    {
+        $metadata = $this->handleManyToManyCollection($change_set);
+        if ($metadata === null) {
+            return null;
+        }
+
+        $collectionData = $this->processCollection($metadata);
+        if (!$collectionData) {
+            return null;
+        }
+
+        $field = $collectionData['field'] ?? 'unknown';
+        $target = $collectionData['target_entity'] ?? 'unknown';
+        $added_ids = $collectionData['added_ids'] ?? [];
+        $removed_ids = $collectionData['removed_ids'] ?? [];
+
+        if ($this->event_type === Interfaces\IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE) {
+            if (empty($removed_ids)) {
+                return null;
+            }
+
+            return sprintf(
+                "%s %s (%s) deleted: Removed IDs: %s by user %s",
+                $label,
+                $field,
+                $target,
+                json_encode($removed_ids),
+                $this->getUserInfo()
+            );
+        }
+
+        $parts = [];
+        if (!empty($added_ids)) {
+            $parts[] = 'Added IDs: ' . json_encode($added_ids);
+        }
+        if (!empty($removed_ids)) {
+            $parts[] = 'Removed IDs: ' . json_encode($removed_ids);
+        }
+        if (empty($parts)) {
+            return null;
+        }
+
+        return sprintf(
+            "%s %s (%s) updated: %s by user %s",
+            $label,
+            $field,
+            $target,
+            implode(', ', $parts),
+            $this->getUserInfo()
+        );
+    }
+
 
     /**
      * Extract IDs from entity objects in collection

app/Audit/ConcreteFormatters/PresentationCategoryAuditLogFormatter.php

@@ -66,6 +66,10 @@ public function format($subject, array $change_set): ?string
                         $summit_name,
                         $this->getUserInfo()
                     );
+
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE:
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE:
+                    return $this->formatManyToManyCollectionChange($change_set, sprintf("Presentation Category '%s' (%s) (%s) for Summit '%s'", $title, $code, $id, $summit_name));
             }
         } catch (\Exception $ex) {
             Log::warning("PresentationCategoryAuditLogFormatter error: " . $ex->getMessage());

app/Audit/ConcreteFormatters/PresentationFormatters/PresentationSpeakerAuditLogFormatter.php

@@ -62,6 +62,10 @@ public function format($subject, array $change_set): ?string
                         $email,
                         $this->getUserInfo()
                     );
+
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE:
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE:
+                    return $this->formatManyToManyCollectionChange($change_set, sprintf("Speaker '%s' (%s)", $full_name, $speaker_id));
             }
         } catch (\Exception $ex) {
             Log::warning("PresentationSpeakerAuditLogFormatter error: " . $ex->getMessage());

app/Audit/ConcreteFormatters/SelectionPlanAuditLogFormatter.php

@@ -80,6 +80,10 @@ public function format($subject, array $change_set): ?string
                         $summit_name,
                         $this->getUserInfo()
                     );
+
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE:
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE:
+                    return $this->formatManyToManyCollectionChange($change_set, sprintf("Selection Plan '%s' (%s) for Summit '%s'", $name, $id, $summit_name));
             }
         } catch (\Exception $ex) {
             Log::warning("SelectionPlanAuditLogFormatter error: " . $ex->getMessage());

app/Audit/ConcreteFormatters/SubmissionInvitationAuditLogFormatter.php

@@ -70,6 +70,10 @@ public function format($subject, array $change_set): ?string
                         $sent_status,
                         $this->getUserInfo()
                     );
+
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE:
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE:
+                    return $this->formatManyToManyCollectionChange($change_set, sprintf("Submission invitation for '%s' (%s)", $email, $id));
             }
         } catch (\Exception $ex) {
             Log::warning("SubmissionInvitationAuditLogFormatter error: " . $ex->getMessage());

app/Audit/ConcreteFormatters/SummitTrackChairAuditLogFormatter.php

@@ -63,6 +63,10 @@ public function format($subject, array $change_set): ?string
                         $member_id,
                         $this->getUserInfo()
                     );
+
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE:
+                case IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE:
+                    return $this->formatManyToManyCollectionChange($change_set, sprintf("Track Chair '%s' (%s)", $member_name, $member_id));
             }
         } catch (\Exception $ex) {
             Log::warning("SummitTrackChairAuditLogFormatter error: " . $ex->getMessage());

tests/OpenTelemetry/Formatters/PresentationCategoryManyToManyAuditLogFormatterTest.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace Tests\OpenTelemetry\Formatters;
+
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use App\Audit\ConcreteFormatters\PresentationCategoryAuditLogFormatter;
+use App\Audit\Interfaces\IAuditStrategy;
+use App\Models\Foundation\Summit\Events\Presentations\TrackQuestions\TrackQuestionTemplate;
+use Mockery;
+use models\main\Tag;
+use models\summit\PresentationCategory;
+use models\summit\Summit;
+use models\summit\SummitAccessLevelType;
+use Tests\OpenTelemetry\Formatters\Support\AuditContextBuilder;
+use Tests\OpenTelemetry\Formatters\Support\PersistentCollectionTestHelper;
+use Tests\TestCase;
+
+/**
+ * PresentationCategory owns three many-to-many collections: allowed_access_levels, allowed_tags and extra_questions.
+ */
+class PresentationCategoryManyToManyAuditLogFormatterTest extends TestCase
+{
+    private const MESSAGE_PREFIX = "Presentation Category 'AI' (AI01) (12) for Summit 'Test Summit'";
+
+    protected function tearDown(): void
+    {
+        Mockery::close();
+        parent::tearDown();
+    }
+
+    public function testUpdateEventReportsAddedAndRemovedIdsFromDiff(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE);
+
+        $result = $formatter->format($this->makeSubject(), [
+            'collection' => $this->makeCollection('allowed_access_levels', SummitAccessLevelType::class, [10, 11], [11, 12]),
+        ]);
+
+        $this->assertStringStartsWith(
+            self::MESSAGE_PREFIX . " allowed_access_levels (SummitAccessLevelType) updated: Added IDs: [12], Removed IDs: [10] by user ",
+            $result
+        );
+    }
+
+    public function testUpdateEventReportsAddedIds(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE);
+
+        $result = $formatter->format($this->makeSubject(), [
+            'collection' => $this->makeCollection('allowed_tags', Tag::class, [], [5, 6]),
+        ]);
+
+        $this->assertStringStartsWith(
+            self::MESSAGE_PREFIX . " allowed_tags (Tag) updated: Added IDs: [5,6] by user ",
+            $result
+        );
+    }
+
+    public function testDeleteEventReportsRemovedIdsFromPayload(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE);
+
+        $result = $formatter->format($this->makeSubject(), [
+            'collection'  => $this->makeCollection('allowed_access_levels', SummitAccessLevelType::class, [], []),
+            'deleted_ids' => [3, 4],
+        ]);
+
+        $this->assertStringStartsWith(
+            self::MESSAGE_PREFIX . " allowed_access_levels (SummitAccessLevelType) deleted: Removed IDs: [3,4] by user ",
+            $result
+        );
+    }
+
+    public function testUpdateEventWithoutDiffIsSuppressed(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE);
+
+        $result = $formatter->format($this->makeSubject(), [
+            'collection' => $this->makeCollection('allowed_tags', Tag::class, [3], [3]),
+        ]);
+
+        $this->assertNull($result);
+    }
+
+    public function testDeleteEventWithNothingToRemoveIsSuppressed(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_DELETE);
+
+        $result = $formatter->format($this->makeSubject(), [
+            'collection'  => $this->makeCollection('allowed_tags', Tag::class, [], []),
+            'deleted_ids' => [],
+        ]);
+
+        $this->assertNull($result);
+    }
+
+    public function testManyToManyEventWithoutCollectionReturnsNull(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE);
+
+        $this->assertNull($formatter->format($this->makeSubject(), []));
+    }
+
+    public function testManyToManyEventWithInvalidSubjectReturnsNull(): void
+    {
+        $formatter = $this->makeFormatter(IAuditStrategy::EVENT_COLLECTION_MANYTOMANY_UPDATE);
+
+        $this->assertNull($formatter->format(new \stdClass(), [
+            'collection' => $this->makeCollection('allowed_access_levels', SummitAccessLevelType::class, [], [7]),
+        ]));
+    }
+
+    private function makeFormatter(string $eventType): PresentationCategoryAuditLogFormatter
+    {
+        $formatter = new PresentationCategoryAuditLogFormatter($eventType);
+        $formatter->setContext(AuditContextBuilder::default()->build());
+        return $formatter;
+    }
+
+    private function makeCollection(string $field, string $targetEntity, array $snapshotIds, array $currentIds)
+    {
+        return PersistentCollectionTestHelper::buildManyToManyCollection(
+            PresentationCategory::class,
+            $field,
+            $targetEntity,
+            $snapshotIds,
+            $currentIds
+        );
+    }
+
+    private function makeSubject(): PresentationCategory
+    {
+        $summit = Mockery::mock(Summit::class);
+        $summit->shouldReceive('getName')->andReturn('Test Summit');
+
+        $category = Mockery::mock(PresentationCategory::class);
+        $category->shouldReceive('getId')->andReturn(12);
+        $category->shouldReceive('getTitle')->andReturn('AI');
+        $category->shouldReceive('getCode')->andReturn('AI01');
+        $category->shouldReceive('getSummit')->andReturn($summit);
+
+        return $category;
+    }
+}