fix(adminaudit): Allow named placeholders via CriticalActionPerformedEvent

apps/admin_audit/lib/Actions/Action.php

@@ -47,17 +47,22 @@ public function log(
 		}
 
 		$replaceArray = [];
+		$context = ['app' => 'admin_audit'];
 		foreach ($elements as $element) {
 			$value = $params[$element];
 			if ($value instanceof \DateTimeInterface) {
 				$value = $value->format('Y-m-d H:i:s');
 			}
 			$replaceArray[] = $value;
+			// Named {placeholders} are interpolated by the logger
+			if (str_contains($text, '{' . $element . '}')) {
+				$context[$element] = $value;
+			}
 		}
 
 		$this->logger->info(
 			vsprintf($text, $replaceArray),
-			['app' => 'admin_audit'],
+			$context,
 		);
 	}
 }

apps/admin_audit/tests/Listener/CriticalActionPerformedEventListenerTest.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\AdminAudit\Tests\Listener;
+
+use OCA\AdminAudit\AuditLogger;
+use OCA\AdminAudit\Listener\CriticalActionPerformedEventListener;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
+use PHPUnit\Framework\MockObject\MockObject;
+use Test\TestCase;
+
+class CriticalActionPerformedEventListenerTest extends TestCase {
+	private AuditLogger&MockObject $logger;
+	private CriticalActionPerformedEventListener $listener;
+
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->logger = $this->createMock(AuditLogger::class);
+		$this->listener = new CriticalActionPerformedEventListener($this->logger);
+	}
+
+	public function testSprintfPlaceholders(): void {
+		$this->logger->expects($this->once())
+			->method('info')
+			->with('Share "42" was accepted by "alice"', ['app' => 'admin_audit']);
+
+		$this->listener->handle(new CriticalActionPerformedEvent('Share "%s" was accepted by "%s"', ['42', 'alice']));
+	}
+
+	public function testNamedPlaceholders(): void {
+		$this->logger->expects($this->once())
+			->method('info')
+			->with(
+				'Bruteforce attempt from "{ip}" detected for action "{action}" not throttled due to allow-list.',
+				['app' => 'admin_audit', 'ip' => '10.0.0.1', 'action' => 'login'],
+			);
+
+		$this->listener->handle(new CriticalActionPerformedEvent(
+			'Bruteforce attempt from "{ip}" detected for action "{action}" not throttled due to allow-list.',
+			['ip' => '10.0.0.1', 'action' => 'login'],
+		));
+	}
+}