From 50b1649965649ca69b80e18f7d30c6f366b19ce9 Mon Sep 17 00:00:00 2001 From: Florian Sylvain Date: Tue, 6 Oct 2026 20:35:03 +0200 Subject: [PATCH] feat: activity log backend foundation --- api/dependecyInjection.go | 216 ++-- api/handlers/activity/activityHandler.go | 243 ++++ api/handlers/apikey/apiKeyHandler.go | 4 +- api/handlers/auth/loginHandler.go | 5 +- api/handlers/auth/passwordResetHandler.go | 4 +- api/handlers/settings/settingsHandler.go | 63 +- api/middleware/apiKey.go | 8 + api/middleware/auditContext.go | 64 + api/middleware/requireSignedIn.go | 20 + api/router.go | 53 +- cmd/server/main.go | 2 +- docs/api.md | 22 + docs/architecture.md | 12 + docs/configuration.md | 4 + features/activity-log-backend.feature | 560 ++++++++ features/activity-log-backend.qa.md | 72 ++ internal/domain/audit/auditDomain.go | 207 +++ internal/domain/audit/auditFilter.go | 98 ++ internal/domain/audit/auditRecorder.go | 31 + .../domain/audit/auditRepositoryInterface.go | 16 + internal/domain/audit/auditSettings.go | 57 + internal/infrastructure/auditing/recorder.go | 57 + .../persistence/database/migrate.go | 2 +- .../persistence/mappers/auditMapper.go | 97 ++ .../persistence/models/auditEventModel.go | 24 + .../persistence/models/auditSettingsModel.go | 10 + .../repositories/auditEventRepository.go | 188 +++ .../repositories/auditSettingsRepository.go | 61 + internal/infrastructure/scheduler/runner.go | 73 +- .../useCases/ActivityRetention.go | 50 + .../useCases/AuthenticateUser.go | 44 +- .../useCases/CleanupActivity.go | 47 + .../infrastructure/useCases/CreateAPIKey.go | 13 +- .../infrastructure/useCases/ExportActivity.go | 88 ++ .../useCases/GetActivitySummary.go | 23 + .../infrastructure/useCases/ListActivity.go | 146 +++ .../useCases/RequestPasswordReset.go | 18 +- .../infrastructure/useCases/ResetPassword.go | 19 +- .../infrastructure/useCases/RevokeAPIKey.go | 18 +- .../infrastructure/useCases/activityQuery.go | 144 +++ test/accept_invitation_test.go | 2 +- test/activity_domain_test.go | 199 +++ test/activity_log_backend_http_test.go | 1136 +++++++++++++++++ test/activity_log_backend_qa_test.go | 173 +++ test/activity_persistence_test.go | 400 ++++++ test/activity_recorder_test.go | 108 ++ test/activity_retention_test.go | 343 +++++ test/activity_support_test.go | 140 ++ test/activity_usecases_test.go | 491 +++++++ test/activity_validation_test.go | 92 ++ test/api_keys_http_test.go | 11 +- test/api_keys_test.go | 56 +- test/cancel_pending_registration_http_test.go | 2 +- test/hasher_test.go | 16 +- test/invitations_test.go | 2 +- ..._password_reset_rate_limiting_http_test.go | 6 +- test/login_logout_cookie_test.go | 2 +- test/not_found_errors_test.go | 2 +- ...ration_gate_and_verification_email_test.go | 2 +- .../registration_status_endpoint_http_test.go | 2 +- test/request_password_reset_http_test.go | 4 +- ...equest_password_reset_mail_failure_test.go | 4 +- test/request_password_reset_test.go | 24 +- test/reset_password_http_test.go | 4 +- test/reset_password_test.go | 36 +- test/runtime_settings_injection_http_test.go | 4 +- test/settings_http_test.go | 14 +- test/sqlite_schema_unchanged_test.go | 6 + test/stale_token_invalidation_http_test.go | 6 +- ...y_client_ip_for_rate_limiting_http_test.go | 6 +- ...nverified_users_and_reregistration_test.go | 2 +- test/user_display_name_test.go | 2 +- test/user_response_field_hygiene_test.go | 6 +- test/user_roles_test.go | 2 +- 74 files changed, 5949 insertions(+), 239 deletions(-) create mode 100644 api/handlers/activity/activityHandler.go create mode 100644 api/middleware/auditContext.go create mode 100644 api/middleware/requireSignedIn.go create mode 100644 features/activity-log-backend.feature create mode 100644 features/activity-log-backend.qa.md create mode 100644 internal/domain/audit/auditDomain.go create mode 100644 internal/domain/audit/auditFilter.go create mode 100644 internal/domain/audit/auditRecorder.go create mode 100644 internal/domain/audit/auditRepositoryInterface.go create mode 100644 internal/domain/audit/auditSettings.go create mode 100644 internal/infrastructure/auditing/recorder.go create mode 100644 internal/infrastructure/persistence/mappers/auditMapper.go create mode 100644 internal/infrastructure/persistence/models/auditEventModel.go create mode 100644 internal/infrastructure/persistence/models/auditSettingsModel.go create mode 100644 internal/infrastructure/persistence/repositories/auditEventRepository.go create mode 100644 internal/infrastructure/persistence/repositories/auditSettingsRepository.go create mode 100644 internal/infrastructure/useCases/ActivityRetention.go create mode 100644 internal/infrastructure/useCases/CleanupActivity.go create mode 100644 internal/infrastructure/useCases/ExportActivity.go create mode 100644 internal/infrastructure/useCases/GetActivitySummary.go create mode 100644 internal/infrastructure/useCases/ListActivity.go create mode 100644 internal/infrastructure/useCases/activityQuery.go create mode 100644 test/activity_domain_test.go create mode 100644 test/activity_log_backend_http_test.go create mode 100644 test/activity_log_backend_qa_test.go create mode 100644 test/activity_persistence_test.go create mode 100644 test/activity_recorder_test.go create mode 100644 test/activity_retention_test.go create mode 100644 test/activity_support_test.go create mode 100644 test/activity_usecases_test.go create mode 100644 test/activity_validation_test.go diff --git a/api/dependecyInjection.go b/api/dependecyInjection.go index 3c9c9bd..8f73ac1 100644 --- a/api/dependecyInjection.go +++ b/api/dependecyInjection.go @@ -3,12 +3,14 @@ package api import ( domainAPIKey "RenewCMS/internal/domain/apikey" domainArticle "RenewCMS/internal/domain/article" + domainAudit "RenewCMS/internal/domain/audit" domainImage "RenewCMS/internal/domain/image" domainInvite "RenewCMS/internal/domain/invite" domainMail "RenewCMS/internal/domain/mail" domainPurge "RenewCMS/internal/domain/purge" domainUpdate "RenewCMS/internal/domain/update" domainUser "RenewCMS/internal/domain/user" + "RenewCMS/internal/infrastructure/auditing" "RenewCMS/internal/infrastructure/config" "RenewCMS/internal/infrastructure/hashing" "RenewCMS/internal/infrastructure/mailer" @@ -19,6 +21,7 @@ import ( "RenewCMS/internal/infrastructure/storage" "RenewCMS/internal/infrastructure/update" "RenewCMS/internal/infrastructure/useCases" + "context" "crypto/ed25519" "log" "net/http" @@ -32,52 +35,73 @@ import ( ) type UseCases struct { - apiKeyAuthOnce sync.Once - apiKeyAuthMiddleware func(http.Handler) http.Handler - Token *jwtauth.JWTAuth - PurgeScheduler *scheduler.Runner - CreateArticleUseCase *useCases.CreateArticleUseCase - GetArticleUseCase *useCases.GetArticleUseCase - ListArticlesUseCase *useCases.ListArticlesUseCase - UpdateArticleUseCase *useCases.UpdateArticleUseCase - DeleteArticleUseCase *useCases.DeleteArticleUseCase - GetUserUseCase *useCases.GetUserUseCase - CreateUserUseCase *useCases.CreateUserUseCase - AuthenticateUserUseCase *useCases.AuthenticateUserUseCase - VerifyUserUseCase *useCases.VerifyUserUseCase - CancelRegistrationUseCase *useCases.CancelRegistrationUseCase - RequestPasswordResetUseCase *useCases.RequestPasswordResetUseCase - ResetPasswordUseCase *useCases.ResetPasswordUseCase - UpdateUserProfileUseCase *useCases.UpdateUserProfileUseCase - ListUsersUseCase *useCases.ListUsersUseCase - CreateInviteUseCase *useCases.CreateInviteUseCase - CancelInviteUseCase *useCases.CancelInviteUseCase - RenewInviteUseCase *useCases.RenewInviteUseCase - ListUsersAndInvitesUseCase *useCases.ListUsersAndInvitesUseCase - GetInviteUseCase *useCases.GetInviteUseCase - AcceptInviteUseCase *useCases.AcceptInviteUseCase - SendMailUseCase *useCases.SendMailUseCase - CreateImageUseCase *useCases.CreateImageUseCase - OpenMediaUseCase *useCases.OpenMediaUseCase - ListMediaUseCase *useCases.ListMediaUseCase - RenameMediaUseCase *useCases.RenameMediaUseCase - DeleteMediaUseCase *useCases.DeleteMediaUseCase - MergeMediaUseCase *useCases.MergeMediaUseCase - GetMediaUsageUseCase *useCases.GetMediaUsageUseCase - GetPurgeSettingsUseCase *useCases.GetPurgeSettingsUseCase - UpdatePurgeSettingsUseCase *useCases.UpdatePurgeSettingsUseCase - PreviewPurgeUseCase *useCases.PreviewPurgeUseCase - RunPurgeUseCase *useCases.RunPurgeUseCase - GetSettingsUseCase *useCases.GetSettingsUseCase - GetUpdateStatusUseCase *useCases.GetUpdateStatusUseCase - CheckForUpdateUseCase *useCases.CheckForUpdateUseCase - StartUpdateDownloadUseCase *useCases.StartUpdateDownloadUseCase - RequestRestartUseCase *useCases.RequestRestartUseCase - RecordRunningInfoUseCase *useCases.RecordRunningInfoUseCase - CreateAPIKeyUseCase *useCases.CreateAPIKeyUseCase - ListAPIKeysUseCase *useCases.ListAPIKeysUseCase - RevokeAPIKeyUseCase *useCases.RevokeAPIKeyUseCase - AuthenticateAPIKeyUseCase *useCases.AuthenticateAPIKeyUseCase + apiKeyAuthOnce sync.Once + apiKeyAuthMiddleware func(http.Handler) http.Handler + Token *jwtauth.JWTAuth + PurgeScheduler *scheduler.Runner + ActivityCleanupScheduler *scheduler.Runner + CreateArticleUseCase *useCases.CreateArticleUseCase + GetArticleUseCase *useCases.GetArticleUseCase + ListArticlesUseCase *useCases.ListArticlesUseCase + UpdateArticleUseCase *useCases.UpdateArticleUseCase + DeleteArticleUseCase *useCases.DeleteArticleUseCase + GetUserUseCase *useCases.GetUserUseCase + CreateUserUseCase *useCases.CreateUserUseCase + AuthenticateUserUseCase *useCases.AuthenticateUserUseCase + VerifyUserUseCase *useCases.VerifyUserUseCase + CancelRegistrationUseCase *useCases.CancelRegistrationUseCase + RequestPasswordResetUseCase *useCases.RequestPasswordResetUseCase + ResetPasswordUseCase *useCases.ResetPasswordUseCase + UpdateUserProfileUseCase *useCases.UpdateUserProfileUseCase + ListUsersUseCase *useCases.ListUsersUseCase + CreateInviteUseCase *useCases.CreateInviteUseCase + CancelInviteUseCase *useCases.CancelInviteUseCase + RenewInviteUseCase *useCases.RenewInviteUseCase + ListUsersAndInvitesUseCase *useCases.ListUsersAndInvitesUseCase + GetInviteUseCase *useCases.GetInviteUseCase + AcceptInviteUseCase *useCases.AcceptInviteUseCase + SendMailUseCase *useCases.SendMailUseCase + CreateImageUseCase *useCases.CreateImageUseCase + OpenMediaUseCase *useCases.OpenMediaUseCase + ListMediaUseCase *useCases.ListMediaUseCase + RenameMediaUseCase *useCases.RenameMediaUseCase + DeleteMediaUseCase *useCases.DeleteMediaUseCase + MergeMediaUseCase *useCases.MergeMediaUseCase + GetMediaUsageUseCase *useCases.GetMediaUsageUseCase + GetPurgeSettingsUseCase *useCases.GetPurgeSettingsUseCase + UpdatePurgeSettingsUseCase *useCases.UpdatePurgeSettingsUseCase + PreviewPurgeUseCase *useCases.PreviewPurgeUseCase + RunPurgeUseCase *useCases.RunPurgeUseCase + GetSettingsUseCase *useCases.GetSettingsUseCase + GetUpdateStatusUseCase *useCases.GetUpdateStatusUseCase + CheckForUpdateUseCase *useCases.CheckForUpdateUseCase + StartUpdateDownloadUseCase *useCases.StartUpdateDownloadUseCase + RequestRestartUseCase *useCases.RequestRestartUseCase + RecordRunningInfoUseCase *useCases.RecordRunningInfoUseCase + CreateAPIKeyUseCase *useCases.CreateAPIKeyUseCase + ListAPIKeysUseCase *useCases.ListAPIKeysUseCase + RevokeAPIKeyUseCase *useCases.RevokeAPIKeyUseCase + AuthenticateAPIKeyUseCase *useCases.AuthenticateAPIKeyUseCase + ListActivityUseCase *useCases.ListActivityUseCase + GetActivitySummaryUseCase *useCases.GetActivitySummaryUseCase + ExportActivityUseCase *useCases.ExportActivityUseCase + GetActivityRetentionUseCase *useCases.GetActivityRetentionUseCase + UpdateActivityRetentionUseCase *useCases.UpdateActivityRetentionUseCase +} + +func (c *UseCases) RunSchedulers(ctx context.Context) { + var running sync.WaitGroup + for _, runner := range []*scheduler.Runner{c.PurgeScheduler, c.ActivityCleanupScheduler} { + if runner == nil { + continue + } + running.Add(1) + go func() { + defer running.Done() + runner.Run(ctx) + }() + } + running.Wait() } type Repositories struct { @@ -87,6 +111,8 @@ type Repositories struct { InviteRepo domainInvite.Repository APIKeyRepo domainAPIKey.Repository PurgeSettingsRepo domainPurge.Repository + AuditRepo domainAudit.Repository + AuditSettingsRepo domainAudit.SettingsRepository MailRepo domainMail.Repository ReleaseFeed domainUpdate.ReleaseFeed UpdateStore domainUpdate.StatusStore @@ -217,6 +243,8 @@ func getRepositories(connection *database.Connection, settings config.Settings) InviteRepo: persistence.NewInviteRepository(db), APIKeyRepo: persistence.NewAPIKeyRepository(db), PurgeSettingsRepo: persistence.NewPurgeSettingsRepository(db), + AuditRepo: persistence.NewAuditEventRepository(db), + AuditSettingsRepo: persistence.NewAuditSettingsRepository(db), MailRepo: mailer.NewMailRepository(settings.Smtp), ReleaseFeed: update.NewGiteaReleaseFeed(settings.UpdateFeedURL), UpdateStore: update.NewJSONStatusStore(filepath.Join(dataDir, updateStatusFileName)), @@ -240,52 +268,60 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings runPurge := useCases.NewRunPurgeUseCase(repos.ImageRepo, repos.ArticleRepo, mergeMedia, repos.PurgeSettingsRepo, time.Now, log.Default()) purgeScheduler := useCases.NewPurgeSchedulerUseCase(repos.PurgeSettingsRepo, runPurge) + recorder := auditing.NewRecorder(repos.AuditRepo, time.Now, log.Default()) + activityCleanup := useCases.NewCleanupActivityUseCase(repos.AuditRepo, repos.AuditSettingsRepo, recorder) return &UseCases{ - PurgeScheduler: scheduler.NewSystemRunner(purgeScheduler, log.Default()), - Token: jwtauth.New("HS256", []byte(settings.JWTSecret), nil), - CreateArticleUseCase: useCases.NewCreateArticleUseCase(repos.ArticleRepo, renderer), - GetArticleUseCase: useCases.NewGetArticleUseCase(repos.ArticleRepo, renderer), - ListArticlesUseCase: useCases.NewListArticlesUseCase(repos.ArticleRepo, renderer), - UpdateArticleUseCase: useCases.NewUpdateArticleUseCase(repos.ArticleRepo, renderer), - DeleteArticleUseCase: useCases.NewDeleteArticleUseCase(repos.ArticleRepo), - GetUserUseCase: useCases.NewGetUserUseCase(repos.UserRepo), - CreateUserUseCase: useCases.NewCreateUserUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL), - AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(repos.UserRepo, hasher), - VerifyUserUseCase: useCases.NewVerifyUserUseCase(repos.UserRepo, hasher), - CancelRegistrationUseCase: useCases.NewCancelRegistrationUseCase(repos.UserRepo), - RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL), - ResetPasswordUseCase: useCases.NewResetPasswordUseCase(repos.UserRepo, hasher, repos.APIKeyRepo, time.Now), - UpdateUserProfileUseCase: useCases.NewUpdateUserProfileUseCase(repos.UserRepo), - ListUsersUseCase: useCases.NewListUsersUseCase(repos.UserRepo), - CreateInviteUseCase: useCases.NewCreateInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL), - CancelInviteUseCase: useCases.NewCancelInviteUseCase(repos.InviteRepo), - RenewInviteUseCase: useCases.NewRenewInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL), - ListUsersAndInvitesUseCase: useCases.NewListUsersAndInvitesUseCase(repos.UserRepo, repos.InviteRepo), - GetInviteUseCase: useCases.NewGetInviteUseCase(repos.InviteRepo, hasher), - AcceptInviteUseCase: useCases.NewAcceptInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher), - SendMailUseCase: useCases.NewSendMailUseCase(repos.MailRepo), - CreateImageUseCase: useCases.NewCreateImageUseCase(repos.ImageRepo, imageStorage), - OpenMediaUseCase: useCases.NewOpenMediaUseCase(imageStorage), - ListMediaUseCase: useCases.NewListMediaUseCase(repos.ImageRepo, repos.ArticleRepo, repos.UserRepo), - RenameMediaUseCase: useCases.NewRenameMediaUseCase(repos.ImageRepo), - DeleteMediaUseCase: useCases.NewDeleteMediaUseCase(repos.ImageRepo, imageStorage), - MergeMediaUseCase: mergeMedia, - GetMediaUsageUseCase: useCases.NewGetMediaUsageUseCase(repos.ImageRepo, repos.ArticleRepo), - GetPurgeSettingsUseCase: useCases.NewGetPurgeSettingsUseCase(repos.PurgeSettingsRepo), - UpdatePurgeSettingsUseCase: useCases.NewUpdatePurgeSettingsUseCase(repos.PurgeSettingsRepo, time.Now), - PreviewPurgeUseCase: useCases.NewPreviewPurgeUseCase(repos.ImageRepo, repos.ArticleRepo), - RunPurgeUseCase: runPurge, - GetSettingsUseCase: useCases.NewGetSettingsUseCase(settings.Version), - GetUpdateStatusUseCase: useCases.NewGetUpdateStatusUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, settings.Container, time.Now), - CheckForUpdateUseCase: useCases.NewCheckForUpdateUseCase(repos.ReleaseFeed, repos.UpdateStore, settings.Version, time.Now), - StartUpdateDownloadUseCase: startUpdateDownloadUseCase(repos, settings), - RequestRestartUseCase: useCases.NewRequestRestartUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, time.Now), - RecordRunningInfoUseCase: useCases.NewRecordRunningInfoUseCase(repos.RunningInfo, settings.Version, os.Getpid(), time.Now), - CreateAPIKeyUseCase: useCases.NewCreateAPIKeyUseCase(repos.APIKeyRepo, keyGenerator, time.Now), - ListAPIKeysUseCase: useCases.NewListAPIKeysUseCase(repos.APIKeyRepo, repos.UserRepo, time.Now), - RevokeAPIKeyUseCase: useCases.NewRevokeAPIKeyUseCase(repos.APIKeyRepo, repos.UserRepo, time.Now), - AuthenticateAPIKeyUseCase: useCases.NewAuthenticateAPIKeyUseCase(repos.APIKeyRepo, keyGenerator, repos.UserRepo, time.Now), + PurgeScheduler: scheduler.NewSystemRunner(purgeScheduler, log.Default()), + ActivityCleanupScheduler: scheduler.NewSystemCleanupRunner(activityCleanup, log.Default()), + Token: jwtauth.New("HS256", []byte(settings.JWTSecret), nil), + CreateArticleUseCase: useCases.NewCreateArticleUseCase(repos.ArticleRepo, renderer), + GetArticleUseCase: useCases.NewGetArticleUseCase(repos.ArticleRepo, renderer), + ListArticlesUseCase: useCases.NewListArticlesUseCase(repos.ArticleRepo, renderer), + UpdateArticleUseCase: useCases.NewUpdateArticleUseCase(repos.ArticleRepo, renderer), + DeleteArticleUseCase: useCases.NewDeleteArticleUseCase(repos.ArticleRepo), + GetUserUseCase: useCases.NewGetUserUseCase(repos.UserRepo), + CreateUserUseCase: useCases.NewCreateUserUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL), + AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(repos.UserRepo, hasher, recorder), + VerifyUserUseCase: useCases.NewVerifyUserUseCase(repos.UserRepo, hasher), + CancelRegistrationUseCase: useCases.NewCancelRegistrationUseCase(repos.UserRepo), + RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(repos.UserRepo, hasher, repos.MailRepo, settings.PublicURL, recorder), + ResetPasswordUseCase: useCases.NewResetPasswordUseCase(repos.UserRepo, hasher, repos.APIKeyRepo, time.Now, recorder), + UpdateUserProfileUseCase: useCases.NewUpdateUserProfileUseCase(repos.UserRepo), + ListUsersUseCase: useCases.NewListUsersUseCase(repos.UserRepo), + CreateInviteUseCase: useCases.NewCreateInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL), + CancelInviteUseCase: useCases.NewCancelInviteUseCase(repos.InviteRepo), + RenewInviteUseCase: useCases.NewRenewInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, repos.MailRepo, settings.PublicURL), + ListUsersAndInvitesUseCase: useCases.NewListUsersAndInvitesUseCase(repos.UserRepo, repos.InviteRepo), + GetInviteUseCase: useCases.NewGetInviteUseCase(repos.InviteRepo, hasher), + AcceptInviteUseCase: useCases.NewAcceptInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher), + SendMailUseCase: useCases.NewSendMailUseCase(repos.MailRepo), + CreateImageUseCase: useCases.NewCreateImageUseCase(repos.ImageRepo, imageStorage), + OpenMediaUseCase: useCases.NewOpenMediaUseCase(imageStorage), + ListMediaUseCase: useCases.NewListMediaUseCase(repos.ImageRepo, repos.ArticleRepo, repos.UserRepo), + RenameMediaUseCase: useCases.NewRenameMediaUseCase(repos.ImageRepo), + DeleteMediaUseCase: useCases.NewDeleteMediaUseCase(repos.ImageRepo, imageStorage), + MergeMediaUseCase: mergeMedia, + GetMediaUsageUseCase: useCases.NewGetMediaUsageUseCase(repos.ImageRepo, repos.ArticleRepo), + GetPurgeSettingsUseCase: useCases.NewGetPurgeSettingsUseCase(repos.PurgeSettingsRepo), + UpdatePurgeSettingsUseCase: useCases.NewUpdatePurgeSettingsUseCase(repos.PurgeSettingsRepo, time.Now), + PreviewPurgeUseCase: useCases.NewPreviewPurgeUseCase(repos.ImageRepo, repos.ArticleRepo), + RunPurgeUseCase: runPurge, + GetSettingsUseCase: useCases.NewGetSettingsUseCase(settings.Version), + GetUpdateStatusUseCase: useCases.NewGetUpdateStatusUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, settings.Container, time.Now), + CheckForUpdateUseCase: useCases.NewCheckForUpdateUseCase(repos.ReleaseFeed, repos.UpdateStore, settings.Version, time.Now), + StartUpdateDownloadUseCase: startUpdateDownloadUseCase(repos, settings), + RequestRestartUseCase: useCases.NewRequestRestartUseCase(repos.UpdateStore, repos.UpdateJobs, repos.UpdateHelper, repos.UpdateResults, repos.RestartRequests, settings.Version, time.Now), + RecordRunningInfoUseCase: useCases.NewRecordRunningInfoUseCase(repos.RunningInfo, settings.Version, os.Getpid(), time.Now), + CreateAPIKeyUseCase: useCases.NewCreateAPIKeyUseCase(repos.APIKeyRepo, keyGenerator, time.Now, recorder), + ListAPIKeysUseCase: useCases.NewListAPIKeysUseCase(repos.APIKeyRepo, repos.UserRepo, time.Now), + RevokeAPIKeyUseCase: useCases.NewRevokeAPIKeyUseCase(repos.APIKeyRepo, repos.UserRepo, time.Now, recorder), + AuthenticateAPIKeyUseCase: useCases.NewAuthenticateAPIKeyUseCase(repos.APIKeyRepo, keyGenerator, repos.UserRepo, time.Now), + ListActivityUseCase: useCases.NewListActivityUseCase(repos.AuditRepo, repos.UserRepo, repos.ArticleRepo, repos.ImageRepo, repos.APIKeyRepo, time.Now), + GetActivitySummaryUseCase: useCases.NewGetActivitySummaryUseCase(repos.AuditRepo, time.Now), + ExportActivityUseCase: useCases.NewExportActivityUseCase(repos.AuditRepo, time.Now), + GetActivityRetentionUseCase: useCases.NewGetActivityRetentionUseCase(repos.AuditSettingsRepo), + UpdateActivityRetentionUseCase: useCases.NewUpdateActivityRetentionUseCase(repos.AuditSettingsRepo, recorder), } } diff --git a/api/handlers/activity/activityHandler.go b/api/handlers/activity/activityHandler.go new file mode 100644 index 0000000..29fd79b --- /dev/null +++ b/api/handlers/activity/activityHandler.go @@ -0,0 +1,243 @@ +package activity + +import ( + "RenewCMS/api/pkg/apperr" + "RenewCMS/api/pkg/claims" + validator "RenewCMS/api/pkg/validator" + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/domain/user" + "RenewCMS/internal/infrastructure/useCases" + "encoding/json" + "errors" + "net/http" + "net/url" + "strconv" + "time" +) + +const ( + csvContentType = "text/csv; charset=utf-8" + csvContentDisposition = `attachment; filename="activity.csv"` +) + +type Handler struct { + ListUseCase *useCases.ListActivityUseCase + SummaryUseCase *useCases.GetActivitySummaryUseCase + ExportUseCase *useCases.ExportActivityUseCase +} + +type filterQuery struct { + Q string `validate:"max=200"` + Actor string `validate:"max=40"` + Category string `validate:"omitempty,oneof=articles media users api_keys auth system"` + Outcome string `validate:"omitempty,oneof=all success failed"` + Security string `validate:"omitempty,oneof=true"` + Range string `validate:"omitempty,oneof=today 7d 30d custom"` + From string `validate:"max=10"` + To string `validate:"max=10"` +} + +type listQuery struct { + filterQuery + Page int `validate:"gte=1"` + Size int `validate:"oneof=25 50 100"` +} + +type actorResponse struct { + Type audit.ActorType `json:"type"` + ID *uint32 `json:"id"` + Name string `json:"name"` +} + +type targetResponse struct { + Type string `json:"type"` + ID string `json:"id"` + Name string `json:"name"` + Exists bool `json:"exists"` +} + +type itemResponse struct { + ID uint64 `json:"id"` + CreatedAt time.Time `json:"created_at"` + Action string `json:"action"` + Category audit.Category `json:"category"` + Actor actorResponse `json:"actor"` + Target *targetResponse `json:"target"` + Outcome audit.Outcome `json:"outcome"` + FailureReason *string `json:"failure_reason"` + Security bool `json:"security"` + Source audit.Source `json:"source"` + IP *string `json:"ip"` + UserAgent *string `json:"user_agent"` + Params map[string]any `json:"params"` + Changes []audit.Change `json:"changes"` +} + +type listResponse struct { + Items []itemResponse `json:"items"` + Total int `json:"total"` + Page int `json:"page"` + Size int `json:"size"` +} + +func NewHandler(list *useCases.ListActivityUseCase, summary *useCases.GetActivitySummaryUseCase, export *useCases.ExportActivityUseCase) *Handler { + return &Handler{ListUseCase: list, SummaryUseCase: summary, ExportUseCase: export} +} + +func readFilterQuery(values url.Values) filterQuery { + return filterQuery{ + Q: values.Get("q"), + Actor: values.Get("actor"), + Category: values.Get("category"), + Outcome: values.Get("outcome"), + Security: values.Get("security"), + Range: values.Get("range"), + From: values.Get("from"), + To: values.Get("to"), + } +} + +func readListQuery(values url.Values) (listQuery, error) { + page, err := intParam(values, "page", 1) + if err != nil { + return listQuery{}, err + } + size, err := intParam(values, "size", 25) + if err != nil { + return listQuery{}, err + } + return listQuery{filterQuery: readFilterQuery(values), Page: page, Size: size}, nil +} + +func intParam(values url.Values, name string, fallback int) (int, error) { + if !values.Has(name) { + return fallback, nil + } + return strconv.Atoi(values.Get(name)) +} + +func toActivityQuery(query filterQuery) useCases.ActivityQuery { + return useCases.ActivityQuery{ + Q: query.Q, + Actor: query.Actor, + Category: query.Category, + Outcome: query.Outcome, + Security: query.Security, + Range: query.Range, + From: query.From, + To: query.To, + } +} + +func writeActivityError(w http.ResponseWriter, err error) { + switch { + case errors.Is(err, audit.ErrInvalidFilter): + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + case errors.Is(err, audit.ErrActorNotAllowed): + http.Error(w, apperr.OwnerOrAdminRequiredErrorMessage, http.StatusForbidden) + case errors.Is(err, user.ErrUserNotFound): + http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized) + default: + http.Error(w, "Internal server error", http.StatusInternalServerError) + } +} + +func (h *Handler) List(w http.ResponseWriter, r *http.Request) { + query, err := readListQuery(r.URL.Query()) + if err != nil || validator.Validate.Struct(query) != nil { + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + return + } + viewerId, ok := claims.UserId(r) + if !ok { + http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized) + return + } + + activityQuery := toActivityQuery(query.filterQuery) + activityQuery.Page, activityQuery.Size = query.Page, query.Size + page, err := h.ListUseCase.ListActivity(useCases.ListActivityCommand{ViewerID: viewerId, Query: activityQuery}) + if err != nil { + writeActivityError(w, err) + return + } + + items := make([]itemResponse, 0, len(page.Items)) + for _, entry := range page.Items { + items = append(items, toItemResponse(entry)) + } + writeJSON(w, listResponse{Items: items, Total: page.Total, Page: page.Page, Size: page.Size}) +} + +func toItemResponse(entry useCases.ActivityEntry) itemResponse { + event := entry.Event + item := itemResponse{ + ID: event.ID, + CreatedAt: event.CreatedAt, + Action: event.Action, + Category: event.Category, + Actor: actorResponse{Type: event.Actor.Type, ID: event.Actor.ID, Name: event.Actor.Name}, + Outcome: event.Outcome, + FailureReason: event.FailureReason, + Security: event.Security, + Source: event.Source, + IP: event.IP, + UserAgent: event.UserAgent, + Params: event.Params, + Changes: event.Changes, + } + if item.Params == nil { + item.Params = map[string]any{} + } + if item.Changes == nil { + item.Changes = []audit.Change{} + } + if event.Target.Type != "" { + item.Target = &targetResponse{Type: event.Target.Type, ID: event.Target.ID, Name: event.Target.Name, Exists: entry.TargetExists} + } + return item +} + +func (h *Handler) Summary(w http.ResponseWriter, r *http.Request) { + query := readFilterQuery(r.URL.Query()) + if validator.Validate.Struct(query) != nil { + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + return + } + + summary, err := h.SummaryUseCase.GetActivitySummary(toActivityQuery(query)) + if err != nil { + writeActivityError(w, err) + return + } + writeJSON(w, summary) +} + +func (h *Handler) Export(w http.ResponseWriter, r *http.Request) { + query := readFilterQuery(r.URL.Query()) + if validator.Validate.Struct(query) != nil { + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + return + } + + prepared, err := h.ExportUseCase.Prepare(toActivityQuery(query)) + if err != nil { + writeActivityError(w, err) + return + } + + w.Header().Set("Content-Type", csvContentType) + w.Header().Set("Content-Disposition", csvContentDisposition) + w.Header().Set("Cache-Control", "no-store") + _ = prepared.WriteCSV(w) +} + +func writeJSON(w http.ResponseWriter, payload any) { + body, err := json.Marshal(payload) + if err != nil { + http.Error(w, "Internal server error", http.StatusInternalServerError) + return + } + w.Header().Set("Cache-Control", "no-store") + _, _ = w.Write(body) +} diff --git a/api/handlers/apikey/apiKeyHandler.go b/api/handlers/apikey/apiKeyHandler.go index 0046e27..b2e3628 100644 --- a/api/handlers/apikey/apiKeyHandler.go +++ b/api/handlers/apikey/apiKeyHandler.go @@ -71,7 +71,7 @@ func (h *Handler) Create(w http.ResponseWriter, r *http.Request) { return } - created, err := h.CreateUseCase.CreateAPIKey(useCases.CreateAPIKeyCommand{ + created, err := h.CreateUseCase.CreateAPIKey(r.Context(), useCases.CreateAPIKeyCommand{ UserID: userId, Name: request.Name, ExpiresAt: request.ExpiresAt, @@ -161,7 +161,7 @@ func (h *Handler) Revoke(w http.ResponseWriter, r *http.Request) { return } - if err := h.RevokeUseCase.RevokeAPIKey(userId, uint32(id)); err != nil { + if err := h.RevokeUseCase.RevokeAPIKey(r.Context(), userId, uint32(id)); err != nil { switch { case errors.Is(err, domain.ErrAPIKeyNotFound): http.Error(w, apperr.APIKeyNotFoundErrorMessage, http.StatusNotFound) diff --git a/api/handlers/auth/loginHandler.go b/api/handlers/auth/loginHandler.go index 7b2c63c..f8bc143 100644 --- a/api/handlers/auth/loginHandler.go +++ b/api/handlers/auth/loginHandler.go @@ -87,7 +87,7 @@ func (h *LoginHandler) Login(w http.ResponseWriter, r *http.Request) { return } - dbUser, err := h.AuthenticateUseCase.Authenticate(credentials.Username, credentials.Password) + dbUser, err := h.AuthenticateUseCase.Authenticate(r.Context(), credentials.Username, credentials.Password) if err != nil { http.Error(w, apperr.LogsErrorMessage, http.StatusForbidden) return @@ -139,7 +139,8 @@ func (h *LoginHandler) RegistrationStatus(w http.ResponseWriter, _ *http.Request _, _ = w.Write(body) } -func (h *LoginHandler) Logout(w http.ResponseWriter, _ *http.Request) { +func (h *LoginHandler) Logout(w http.ResponseWriter, r *http.Request) { + h.AuthenticateUseCase.Logout(r.Context()) removeJwtCookie(w, h.IsProduction) message, _ := json.Marshal(map[string]any{"message": "User logged out! HTTPonly jwt cookie deleted"}) _, _ = w.Write(message) diff --git a/api/handlers/auth/passwordResetHandler.go b/api/handlers/auth/passwordResetHandler.go index 903f368..21471c2 100644 --- a/api/handlers/auth/passwordResetHandler.go +++ b/api/handlers/auth/passwordResetHandler.go @@ -46,7 +46,7 @@ func (h *PasswordResetHandler) RequestPasswordReset(w http.ResponseWriter, r *ht return } - _ = h.RequestPasswordResetUseCase.RequestPasswordReset(credentials.Email) + _ = h.RequestPasswordResetUseCase.RequestPasswordReset(r.Context(), credentials.Email) message, _ := json.Marshal(map[string]any{"message": apperr.PasswordResetRequestedMessage}) _, _ = w.Write(message) @@ -66,7 +66,7 @@ func (h *PasswordResetHandler) ResetPassword(w http.ResponseWriter, r *http.Requ return } - err = h.ResetPasswordUseCase.ResetPassword(credentials.Email, credentials.Code, credentials.Password) + err = h.ResetPasswordUseCase.ResetPassword(r.Context(), credentials.Email, credentials.Code, credentials.Password) if err != nil { if errors.Is(err, user.ErrInvalidPasswordResetCode) || errors.Is(err, user.ErrPasswordResetCodeExpired) { http.Error(w, apperr.PasswordResetFailedErrorMessage, http.StatusForbidden) diff --git a/api/handlers/settings/settingsHandler.go b/api/handlers/settings/settingsHandler.go index cf50d35..9b126f0 100644 --- a/api/handlers/settings/settingsHandler.go +++ b/api/handlers/settings/settingsHandler.go @@ -1,21 +1,76 @@ package settings import ( + "RenewCMS/api/pkg/apperr" + validator "RenewCMS/api/pkg/validator" + "RenewCMS/internal/domain/audit" "RenewCMS/internal/infrastructure/useCases" "encoding/json" + "errors" "net/http" + "time" ) type Handler struct { - GetSettingsUseCase *useCases.GetSettingsUseCase + GetSettingsUseCase *useCases.GetSettingsUseCase + GetActivityRetentionUseCase *useCases.GetActivityRetentionUseCase + UpdateActivityRetentionUseCase *useCases.UpdateActivityRetentionUseCase } -func NewHandler(getSettings *useCases.GetSettingsUseCase) *Handler { - return &Handler{GetSettingsUseCase: getSettings} +type UpdateSettingsRequest struct { + ActivityRetentionDays *int `json:"activity_retention_days" validate:"required,oneof=0 30 90 365"` +} + +type settingsResponse struct { + Version string `json:"version"` + ActivityRetentionDays int `json:"activity_retention_days"` + ActivityLastCleanupAt *time.Time `json:"activity_last_cleanup_at"` + ActivityLastCleanupRemoved int `json:"activity_last_cleanup_removed"` +} + +func NewHandler(getSettings *useCases.GetSettingsUseCase, getRetention *useCases.GetActivityRetentionUseCase, updateRetention *useCases.UpdateActivityRetentionUseCase) *Handler { + return &Handler{GetSettingsUseCase: getSettings, GetActivityRetentionUseCase: getRetention, UpdateActivityRetentionUseCase: updateRetention} } func (h *Handler) GetSettings(w http.ResponseWriter, _ *http.Request) { - body, err := json.Marshal(h.GetSettingsUseCase.GetSettings()) + retention, err := h.GetActivityRetentionUseCase.GetActivityRetention() + if err != nil { + http.Error(w, "Internal server error", http.StatusInternalServerError) + return + } + h.write(w, retention) +} + +func (h *Handler) UpdateSettings(w http.ResponseWriter, r *http.Request) { + var request UpdateSettingsRequest + if err := json.NewDecoder(r.Body).Decode(&request); err != nil { + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + return + } + if err := validator.Validate.Struct(request); err != nil { + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + return + } + + retention, err := h.UpdateActivityRetentionUseCase.UpdateActivityRetention(r.Context(), *request.ActivityRetentionDays) + if err != nil { + if errors.Is(err, audit.ErrInvalidRetention) { + http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest) + return + } + http.Error(w, "Internal server error", http.StatusInternalServerError) + return + } + h.write(w, retention) +} + +func (h *Handler) write(w http.ResponseWriter, retention audit.Settings) { + body, err := json.Marshal(settingsResponse{ + Version: h.GetSettingsUseCase.GetSettings().Version, + ActivityRetentionDays: retention.RetentionDays, + ActivityLastCleanupAt: retention.LastCleanupAt, + ActivityLastCleanupRemoved: retention.LastCleanupRemoved, + }) if err != nil { http.Error(w, "Internal server error", http.StatusInternalServerError) return diff --git a/api/middleware/apiKey.go b/api/middleware/apiKey.go index 7c05976..0ccf9a0 100644 --- a/api/middleware/apiKey.go +++ b/api/middleware/apiKey.go @@ -19,6 +19,8 @@ const bearerScheme = "bearer " type apiKeyIdContextKey struct{} +type apiKeyNameContextKey struct{} + func bearerAPIKey(r *http.Request) (string, bool) { header := r.Header.Get("Authorization") if len(header) < len(bearerScheme) || !strings.EqualFold(header[:len(bearerScheme)], bearerScheme) { @@ -34,6 +36,11 @@ func apiKeyIdFrom(r *http.Request) (uint32, bool) { return id, ok } +func apiKeyNameFrom(r *http.Request) string { + name, _ := r.Context().Value(apiKeyNameContextKey{}).(string) + return name +} + func RequireSession(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if _, isKey := bearerAPIKey(r); isKey { @@ -70,6 +77,7 @@ func APIKeyAuth(authenticate *useCases.AuthenticateAPIKeyUseCase, maxRequests in ctx := jwtauth.NewContext(r.Context(), token, nil) ctx = context.WithValue(ctx, apiKeyIdContextKey{}, authenticated.Key.ID) + ctx = context.WithValue(ctx, apiKeyNameContextKey{}, authenticated.Key.Name) limited.ServeHTTP(w, r.WithContext(ctx)) }) } diff --git a/api/middleware/auditContext.go b/api/middleware/auditContext.go new file mode 100644 index 0000000..041df22 --- /dev/null +++ b/api/middleware/auditContext.go @@ -0,0 +1,64 @@ +package middleware + +import ( + "RenewCMS/api/pkg/claims" + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/useCases" + "net/http" +) + +func AuditContext(getUser *useCases.GetUserUseCase, trustedProxies []string) func(http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + origin := audit.Origin{ + Actor: auditActor(getUser, r), + Source: auditSource(r), + IP: clientIP(r, trustedProxies), + UserAgent: truncatedUserAgent(r), + } + next.ServeHTTP(w, r.WithContext(audit.WithOrigin(r.Context(), origin))) + }) + } +} + +func auditActor(getUser *useCases.GetUserUseCase, r *http.Request) audit.Actor { + if id, ok := apiKeyIdFrom(r); ok { + return audit.APIKeyActor(id, apiKeyNameFrom(r)) + } + userId, ok := claims.UserId(r) + if !ok { + return audit.AnonymousActor("") + } + current, err := getUser.GetUser(userId) + if err != nil { + return audit.AnonymousActor("") + } + tokenVersion, ok := claims.TokenVersion(r) + if !ok || tokenVersion != current.TokenVersion { + return audit.AnonymousActor("") + } + return audit.UserActor(current) +} + +func auditSource(r *http.Request) audit.Source { + if _, ok := apiKeyIdFrom(r); ok { + return audit.SourceAPIKey + } + return audit.SourceWeb +} + +func clientIP(r *http.Request, trustedProxies []string) string { + realIP := r.Header.Get("X-Real-IP") + if realIP != "" && isTrustedProxy(r.RemoteAddr, trustedProxies) { + return realIP + } + return hostOf(r.RemoteAddr) +} + +func truncatedUserAgent(r *http.Request) string { + runes := []rune(r.Header.Get("User-Agent")) + if len(runes) > audit.MaxUserAgentLength { + runes = runes[:audit.MaxUserAgentLength] + } + return string(runes) +} diff --git a/api/middleware/requireSignedIn.go b/api/middleware/requireSignedIn.go new file mode 100644 index 0000000..66390c9 --- /dev/null +++ b/api/middleware/requireSignedIn.go @@ -0,0 +1,20 @@ +package middleware + +import ( + "RenewCMS/api/pkg/apperr" + "net/http" + + "github.com/go-chi/jwtauth/v5" + "github.com/lestrrat-go/jwx/v2/jwt" +) + +func RequireSignedIn(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + token, _, err := jwtauth.FromContext(r.Context()) + if err != nil || token == nil || jwt.Validate(token) != nil { + http.Error(w, apperr.UnauthorizedErrorMessage, http.StatusUnauthorized) + return + } + next.ServeHTTP(w, r) + }) +} diff --git a/api/router.go b/api/router.go index 84db634..a999b9b 100644 --- a/api/router.go +++ b/api/router.go @@ -1,6 +1,7 @@ package api import ( + "RenewCMS/api/handlers/activity" "RenewCMS/api/handlers/apikey" "RenewCMS/api/handlers/article" "RenewCMS/api/handlers/auth" @@ -71,6 +72,8 @@ func NewArticleRouter(container *UseCases) http.Handler { func NewAuthRouter(container *UseCases, isProduction bool, rateLimit config.AuthRateLimitSettings, trustedProxies []string) http.Handler { r := chi.NewRouter() + r.Use(jwtauth.Verifier(container.Token)) + r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies)) loginHandler := auth.NewLoginHandler(container.Token, container.CreateUserUseCase, container.AuthenticateUserUseCase, isProduction) verificationHandler := auth.NewVerificationHandler(container.VerifyUserUseCase, container.CancelRegistrationUseCase, isProduction) @@ -140,17 +143,51 @@ func NewUserRouter(container *UseCases, rateLimit config.AuthRateLimitSettings, return r } -func NewSettingsRouter(container *UseCases) http.Handler { +func NewSettingsRouter(container *UseCases, trustedProxies []string) http.Handler { r := chi.NewRouter() - settingsHandler := settings.NewHandler(container.GetSettingsUseCase) + settingsHandler := settings.NewHandler(container.GetSettingsUseCase, container.GetActivityRetentionUseCase, container.UpdateActivityRetentionUseCase) + r.Group(func(r chi.Router) { + r.Use(jwtauth.Verifier(container.Token)) + r.Use(container.apiKeyAuth()) + r.Use(jwtauth.Authenticator(container.Token)) + r.Use(middleware.RequireCurrentToken(container.GetUserUseCase)) + r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase)) + r.Get("/", settingsHandler.GetSettings) + }) + r.Group(func(r chi.Router) { + r.Use(middleware.RequireSession) + r.Use(jwtauth.Verifier(container.Token)) + r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies)) + r.Use(middleware.RequireSignedIn) + r.Use(jwtauth.Authenticator(container.Token)) + r.Use(middleware.RequireCurrentToken(container.GetUserUseCase)) + r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase)) + r.Use(middleware.RequireOwner(container.GetUserUseCase)) + r.Patch("/", settingsHandler.UpdateSettings) + }) + return r +} + +func NewActivityRouter(container *UseCases, trustedProxies []string) http.Handler { + r := chi.NewRouter() + + activityHandler := activity.NewHandler(container.ListActivityUseCase, container.GetActivitySummaryUseCase, container.ExportActivityUseCase) + + r.Use(middleware.RequireSession) r.Use(jwtauth.Verifier(container.Token)) - r.Use(container.apiKeyAuth()) + r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies)) + r.Use(middleware.RequireSignedIn) r.Use(jwtauth.Authenticator(container.Token)) r.Use(middleware.RequireCurrentToken(container.GetUserUseCase)) r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase)) - r.Get("/", settingsHandler.GetSettings) + r.Get("/", activityHandler.List) + r.Group(func(r chi.Router) { + r.Use(middleware.RequireOwnerOrAdmin(container.GetUserUseCase)) + r.Get("/summary", activityHandler.Summary) + r.Get("/export", activityHandler.Export) + }) return r } @@ -189,13 +226,14 @@ func NewSystemRouter(container *UseCases) http.Handler { return r } -func NewAPIKeyRouter(container *UseCases) http.Handler { +func NewAPIKeyRouter(container *UseCases, trustedProxies []string) http.Handler { r := chi.NewRouter() apiKeyHandler := apikey.NewHandler(container.CreateAPIKeyUseCase, container.ListAPIKeysUseCase, container.RevokeAPIKeyUseCase) r.Use(middleware.RequireSession) r.Use(jwtauth.Verifier(container.Token)) + r.Use(middleware.AuditContext(container.GetUserUseCase, trustedProxies)) r.Use(jwtauth.Authenticator(container.Token)) r.Use(middleware.RequireCurrentToken(container.GetUserUseCase)) r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase)) @@ -244,9 +282,10 @@ func InitBackendRoutes(container *UseCases, settings config.Settings) *chi.Mux { r.Mount("/article", NewArticleRouter(container)) }) r.Mount("/user", NewUserRouter(container, settings.AuthRateLimit, settings.TrustedProxies)) - r.Mount("/settings", NewSettingsRouter(container)) + r.Mount("/settings", NewSettingsRouter(container, settings.TrustedProxies)) + r.Mount("/activity", NewActivityRouter(container, settings.TrustedProxies)) r.Mount("/media", NewMediaRouter(container)) - r.Mount("/api-key", NewAPIKeyRouter(container)) + r.Mount("/api-key", NewAPIKeyRouter(container, settings.TrustedProxies)) r.Mount("/system", NewSystemRouter(container)) r.Mount("/auth", NewAuthRouter(container, settings.IsProduction(), settings.AuthRateLimit, settings.TrustedProxies)) diff --git a/cmd/server/main.go b/cmd/server/main.go index de73b3c..7168a3b 100644 --- a/cmd/server/main.go +++ b/cmd/server/main.go @@ -92,7 +92,7 @@ func run() error { validator.InitValidator() server := newServer(api.InitRoutes(container, settings), settings) - return serveUntilStopped(server, settings, container.RecordRunningInfoUseCase.Record, container.PurgeScheduler.Run) + return serveUntilStopped(server, settings, container.RecordRunningInfoUseCase.Record, container.RunSchedulers) } func initEnvVariables() { diff --git a/docs/api.md b/docs/api.md index b525ed9..9792a1e 100644 --- a/docs/api.md +++ b/docs/api.md @@ -27,6 +27,28 @@ for example `https://cms.example/v1/article/`. | Users and invites | GET /v1/user/, PATCH /v1/user/me, POST /v1/user/invite (owner only), DELETE /v1/user/invite/{id} (owner only), POST /v1/user/invite/{id}/renew (owner only), GET /v1/auth/me | | Settings | GET /v1/settings | +## Activity log +The activity routes are session only: a key answers 403 "This action needs a real session." and a +key never reads the audit trail. Events are append-only; there is no `POST`, `PUT`, `PATCH` or +`DELETE` under `/v1/activity`. + +| Route | Who | Purpose | +| --- | --- | --- | +| `GET /v1/activity` | Any verified user | Filtered, paged events. Owner and admin see every event; any other role is scoped to its own events, and `actor` set to someone else answers 403 "Only owners and admins can do this." | +| `GET /v1/activity/summary` | Owner, admin | Counts for the range, the previous period, active people and seven-bucket series. | +| `GET /v1/activity/export` | Owner, admin | The same filters as the list without `page` or `size`, as a `text/csv; charset=utf-8` attachment (`when,actor,action,target,outcome,source,ip`). Cells starting with `=`, `+`, `-` or `@` get a leading quote. | + +Query: `q`, `actor` (`user:ID`, `key:ID`, `system`), `category` (`articles`, `media`, `users`, +`api_keys`, `auth`, `system`), `outcome` (`all`, `success`, `failed`), `security` (`true`), `range` +(`today`, `7d`, `30d`, `custom`; default `7d`), `from` and `to` (dates, with `custom`), `page` (from +1) and `size` (25, 50 or 100). Any invalid value answers 400 with the body-mismatch message. Dates +are UTC. The list answers `{ items, total, page, size }`, newest first (`created_at`, then `id`). + +`GET /v1/settings` also returns `activity_retention_days` (30, 90, 365 or 0 for forever, default +90), `activity_last_cleanup_at` and `activity_last_cleanup_removed`. `PATCH /v1/settings` with +`{"activity_retention_days": 30}` is session only and owner only (403 "Only the owner can do this."); +any other value answers 400. + Article routes accept `?format=markdown|html|json` (default `markdown`). `GET /v1/media/` accepts `q`, `hash`, `cursor`, `filter`, `sort` and `limit`. diff --git a/docs/architecture.md b/docs/architecture.md index dced11b..2621eaf 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -55,6 +55,18 @@ The use cases `GetPurgeSettings`, `UpdatePurgeSettings`, `PreviewPurge` and `Run | `GET /v1/media/purge-preview` | Groups, copies, distinct articles, the first 5 groups, `more` and the fingerprint. | | `POST /v1/media/purge` | Runs the purge. Optional `fingerprint`; 409 when stale or when a run is in progress. | +### Activity log + +`internal/domain/audit` holds the append-only `Event` (actor, target and failure-reason snapshots, outcome, security flag, source, ip, user agent, `params` and `changes`), the closed vocabularies (actor type, category, outcome, source, change kind), the `Filter`, `Summary` and `Settings` types, the `Repository` interface (`Append`, `List`, `Summary`, `DeleteOlderThan`: no way to edit or delete one event), the `SettingsRepository` (`Get`, `SaveRetention`, `SaveLastCleanup`; no row means 90 days) and the sentinels `ErrInvalidFilter`, `ErrInvalidRetention`, `ErrInvalidEvent` and `ErrActorNotAllowed`. The `Recorder` port is `Record(ctx, event)`; it returns nothing, so a caller can never fail on it. + +`internal/infrastructure/auditing.Recorder` is the adapter. It fills a missing actor, source, ip and user agent from the `audit.Origin` carried by the request context, stamps `created_at` from the injected clock in UTC, bounds long names, drops an event outside the vocabulary, and recovers from any error or panic of the repository by writing one line to the process log (the action and the error only). `middleware.AuditContext` builds the origin after the credential middleware: a session gives a `user` actor and source `web`, an API key an `api_key` actor and source `api_key`, no valid credential an `anonymous` actor; the ip is the peer address, or `X-Real-IP` when the peer is a trusted proxy; the user agent is cut to 255 characters. Use cases that produce events (authenticate and logout, password reset request and completion, API key create and revoke, retention change, cleanup) take the context and an `audit.Recorder`; secrets (passwords, raw keys, reset codes, tokens and their hashes) are never put in an event or in its log line. + +Persistence is `models.AuditEvent` (`audit_events`, indexes on `created_at`, `(actor_type, actor_id, created_at)` and `(category, created_at)`; `params` and `changes` are JSON text) and `models.AuditSettings` (one row), both in `AutoMigrate`. The queries use only portable SQL (`LOWER(...) LIKE ... ESCAPE '!'`, `COUNT(DISTINCT ...)`, `CASE` sums), so they run on SQLite, MySQL/MariaDB and PostgreSQL. The summary splits the range into seven equal buckets, oldest first. + +The use cases `ListActivity`, `GetActivitySummary` and `ExportActivity` turn the raw query into a domain filter (`range` defaults to 7 days; `custom` needs two dates, `to` included), scope a caller who is not owner or admin to its own events, and resolve `target.exists` at read time. The export reads the log through `List` in pages of 500 and writes the CSV with `encoding/csv`. `/v1/activity` and the settings `PATCH` sit behind `RequireSession`, the verifier, the current-token and verified-user checks; summary and export also behind `RequireOwnerOrAdmin`, the settings `PATCH` behind `RequireOwner`. + +`CleanupActivityUseCase.Tick(now)` follows the `PurgeScheduler` model. With a retention of 0 it never runs. Otherwise it is due once a day, at or after 03:00 in the location of `now` and when the last cleanup is before today's 03:00. It deletes events older than `now` minus the retention days (never newer than 24 hours), records the run (`activity_last_cleanup_at`, `activity_last_cleanup_removed`) even when nothing was removed, and only then records a `system.activity_cleanup` event when something was removed. A failing delete returns the error and leaves the last-cleanup fields as they were, so the next tick retries. `scheduler.Runner` now wraps a task with a label: `NewRunner` keeps the purge behaviour and log line, and `NewCleanupRunner` ticks the cleanup. `UseCases.RunSchedulers` runs both runners and `cmd/server/main.go` starts it with the server's signal context. + ### Image metadata backfill At boot, `BackfillImageMetadataUseCase` (through `image.Repository.ListMissingMetadata` and `UpdateMetadata`) fills `filename`, `size`, `content_type`, `width`, `height` and `sha256` for image rows that lack them, reading the bytes through `image.Storage` (the files in `UPLOAD_DIR` with the local adapter, the bucket objects with the S3 adapter). It is idempotent, and a row whose file is missing or unreadable is left as it is without stopping the boot. The old `article_id` column and the `article_images` table are kept and never written. diff --git a/docs/configuration.md b/docs/configuration.md index 7e34650..8c878d6 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -103,6 +103,10 @@ Relative paths are resolved against the process's working directory. In producti For example, `WorkingDirectory=/var/lib/renewcms` with `DB_FILE=./data/renewcms.db` puts the database in `/var/lib/renewcms/data`. Browser-update `--data-dir` must name that directory, because the app reads helper status and update records beside the database. It is not necessarily `WorkingDirectory` or `ReadWritePaths`. Do not change an existing `DB_FILE` merely to match the helper: that could open a different, empty database. See [browser-update setup](deployment.md#browser-updates). +## Activity log retention + +The activity log needs no environment variable. Its retention period (30, 90, 365 days or forever, 90 by default) is a setting the owner changes with `PATCH /v1/settings`, and the daily cleanup runs at 03:00 in the server's time zone (`TZ`, or the host's zone). + ## Adding a variable 1. Read it in the code where it is needed (infrastructure or `api/`, never `internal/domain`). diff --git a/features/activity-log-backend.feature b/features/activity-log-backend.feature new file mode 100644 index 0000000..45f0929 --- /dev/null +++ b/features/activity-log-backend.feature @@ -0,0 +1,560 @@ +Feature: The back-office keeps an append-only activity log that owners can read and retention can prune + + As the owner of a RenewCMS site + I want every important action recorded with who, what, when and from where + So that I can review activity, spot failed logins and keep the log from growing forever + + Background: + Given the spec of record is docs/design/screens/activity.md ("Roles", "API contract", "What is recorded") and docs/design/screens/settings.md ("Activity retention") + And this slice is backend only: no SPA, no new env var, no change to the design + And error responses are plain text from http.Error and success responses are JSON with snake_case fields + And the layering rule holds: internal/domain/audit imports only the stdlib and other domain packages, use cases see only domain interfaces, handlers see only use cases, persistence owns GORM, and no comment is added anywhere + And validation of query and body goes through validate tags and validator.Validate.Struct where a struct exists + And the error text for a malformed query or body is "The request cannot be processed due to a mismatch in the format of the body." + + Rule: The domain event is a complete snapshot and the repository is append-only + + Scenario: An event carries everything the log needs + Given an event is built for the action "article.publish" in category "articles" + Then it holds an actor snapshot (type, id, name), the action code and its params, the category, a target snapshot (type, id, name), an outcome, a failure_reason, a security flag, a source, an ip, a user_agent, changes and a created_at + + Scenario Outline: The vocabulary is closed + Then the allowed values are exactly + + Examples: + | field | values | + | actor.type | user, api_key, system, anonymous | + | category | articles, media, users, api_keys, auth, system | + | outcome | success, failed | + | source | web, api_key, system | + | change.kind | text, body | + + Scenario: The repository exposes no way to edit or delete one event + Then the audit Repository interface has exactly the methods Append, List, Summary and DeleteOlderThan + And the persistence implementation exposes no other exported method than those and its constructor + And the HTTP surface has no POST, PUT, PATCH or DELETE under /v1/activity + + Scenario: The sentinel errors are matchable + Then the audit package declares Err sentinels for an invalid filter and an invalid retention period + And each is asserted with errors.Is + + Rule: The recorder never fails or blocks the caller + + Scenario: A failing repository does not change the caller's result + Given the audit repository fails on Append with the error "disk full" + When a user logs in with valid credentials through POST /v1/auth/login + Then the response is 200 with a jwt cookie and the usual JSON message + And the process log contains a line naming the failed audit write and "disk full" + + Scenario: A panicking repository does not crash the request + Given the audit repository panics on Append + When a user logs out through POST /v1/auth/logout + Then the response is 200 and the process continues serving + + Scenario: The recorder fills the event from the audit context + Given a context holding actor user 3 "marta", source "web", ip "203.0.113.12" and user agent "Mozilla/5.0 test" + When the recorder records an event that has no actor, source, ip or user agent + Then the stored event has those values + And created_at is the injected clock's time in UTC + + Scenario: Secrets never reach the log or the stored event + Given actions that handle a password, a raw API key, a reset code and a jwt + When they are recorded + Then no stored field, no params and no process log line contains any of those values or their hashes + + Rule: The audit context is set by middleware from the credentials and the trusted-proxy IP + + Scenario: A session sets a user actor with source web + Given a request with a valid jwt cookie for user 3 "marta" + When it passes the audit context middleware + Then the context holds actor type "user", id 3, name "marta" and source "web" + + Scenario: An API key sets an api_key actor with source api_key + Given a request with "Authorization: Bearer " for the key 7 named "Deploy bot" + When it passes the audit context middleware + Then the context holds actor type "api_key", id 7, name "Deploy bot" and source "api_key" + + Scenario: No credentials sets an anonymous actor + Given a request without a cookie or key + Then the context holds actor type "anonymous" and source "web" + + Scenario Outline: The ip comes from the trusted-proxy real IP only + Given the trusted proxies are "10.0.0.5" + And the request peer is "" and X-Real-IP is "
" + Then the context ip is "" + + Examples: + | peer | header | ip | + | 10.0.0.5:443 | 203.0.113.12 | 203.0.113.12 | + | 198.51.100.9:443 | 203.0.113.12 | 198.51.100.9 | + | 198.51.100.9:443 | | 198.51.100.9 | + + Scenario: The user agent is stored as sent and bounded + Given the User-Agent header is 400 characters long + Then the context user agent is its first 255 characters + + Rule: Persistence stores events portably and indexed + + Background: + Given the persistence tests run against a real in-memory SQLite database migrated with the model list of migrate.go + And the SQL stays portable across SQLite, MySQL/MariaDB and PostgreSQL + + Scenario: The model is migrated with its indexes + Then the audit events table exists + And it has an index on created_at, an index on (actor_type, actor_id, created_at) and an index on (category, created_at) + + Scenario: An appended event round-trips + When an event with params {"merged": 3}, changes and a null failure_reason is appended + Then listing returns it with every field equal, params and changes included + + Scenario: List sorts by created_at descending then id descending + Given three events with the same created_at and one older + Then List returns the three by id descending, then the older one + + Scenario Outline: Filters narrow the list and the total + Given events across actors, categories, outcomes and days + When List runs with + Then items and total contain exactly + + Examples: + | filter | expected | + | actor user:3 | events of user 3 only | + | actor key:7 | events of api key 7 only | + | actor system | events with actor type system only | + | category auth | auth events only | + | outcome failed | failed events only | + | outcome success | succeeded events only | + | security true | events whose security flag is true | + | q "SPRING" | events whose actor or target name contains "spring", case-insensitive | + | q "50%_" | only names containing the literal text 50%_ | + | from 2026-10-01 to 2026-10-03 | events from 2026-10-01T00:00:00Z to the end of 2026-10-03 | + + Scenario: Paging slices the sorted list and total is the unpaged count + Given 60 events + When List runs with page 2 and size 25 + Then 25 items are returned, the 26th to 50th of the sorted list, and total is 60 + + Scenario: A page past the end is empty + When List runs with page 9 and size 25 over 60 events + Then items is empty and total is 60 + + Scenario: The summary counts the range and the previous period + Given events in the last 7 days and in the 7 days before + When Summary runs for range 7d + Then total, previous_total, failed and security are the counts of those periods + And active_people.users counts distinct user actors and active_people.api_keys counts distinct key actors, with anonymous and system excluded + And series holds seven daily counts for total, active, failed and security, oldest first + + Scenario: DeleteOlderThan removes only events before the cutoff + Given events at 100, 40, 31, 29 and 1 days ago + When DeleteOlderThan runs with the cutoff 30 days ago + Then it returns 3 and only the 29-day and 1-day events remain + + Rule: Reading the log is session only and scoped by role + + Background: + Given the handler is mounted at /v1/activity behind jwtauth.Verifier, jwtauth.Authenticator, the current-token check and the verified-user check + And the routes sit behind RequireSession, so no API key reaches them + + Scenario Outline: The credentials gate answers before any data + When GET is sent + Then the response is with body "" + And the audit repository was not read + + Examples: + | path | credentials | status | body | + | /v1/activity | without a jwt cookie | 401 | You must be logged in to access this resource. | + | /v1/activity/summary | without a jwt cookie | 401 | You must be logged in to access this resource. | + | /v1/activity/export | without a jwt cookie | 401 | You must be logged in to access this resource. | + | /v1/activity | with a valid API key | 403 | This action needs a real session. | + | /v1/activity/summary | with a valid API key | 403 | This action needs a real session. | + | /v1/activity/export | with a valid API key | 403 | This action needs a real session. | + | /v1/activity | with an unverified user's cookie | 403 | You must verify your account to access this resource. | + + Scenario Outline: Owner and admin see every event + Given events by users 1, 2 and 3, an api key and the system + When GET /v1/activity is sent with the cookie of the + Then the response is 200 and total counts the events of every actor + + Examples: + | role | + | owner | + | admin | + + Scenario: Another role is scoped to its own events + Given a verified user 3 whose role is neither owner nor admin + And events by users 1, 2 and 3 + When GET /v1/activity is sent with user 3's cookie + Then every item has actor type "user" and id 3 + And total counts only user 3's events + + Scenario Outline: A scoped caller cannot ask for another actor + Given a verified user 3 whose role is neither owner nor admin + When GET /v1/activity?actor= is sent with user 3's cookie + Then the response is + + Examples: + | actor | status | + | user:3 | 200 | + | user:2 | 403 | + | key:7 | 403 | + | system | 403 | + + Scenario Outline: A scoped caller cannot read the summary or the export + Given a verified user 3 whose role is neither owner nor admin + When GET is sent with user 3's cookie + Then the response is 403 with body "Only owners and admins can do this." + + Examples: + | path | + | /v1/activity/summary | + | /v1/activity/export | + + Rule: GET /v1/activity lists filtered, paged events + + Scenario: The default request + Given 30 events over the last 3 days + When the owner sends GET /v1/activity + Then the response is 200 with {"items": [...], "total": 30, "page": 1, "size": 25} + And items has 25 entries, newest first + + Scenario: An item has the documented shape + Given user 3 "Marta Alves" published the article 8 "Spring release" at 2026-10-06T10:42:18Z from 203.0.113.12 with "Chrome 129 on Windows" + When the owner sends GET /v1/activity + Then the first item is + """ + {"id": 4821, "created_at": "2026-10-06T10:42:18Z", "action": "article.publish", "category": "articles", "actor": {"type": "user", "id": 3, "name": "Marta Alves"}, "target": {"type": "article", "id": "8", "name": "Spring release", "exists": true}, "outcome": "success", "failure_reason": null, "security": false, "source": "web", "ip": "203.0.113.12", "user_agent": "Chrome 129 on Windows", "params": {}, "changes": [{"field": "online", "kind": "text", "before": "false", "after": "true"}]} + """ + + Scenario: A system event has no ip or user agent + Given a system event "system.activity_cleanup" + When the owner sends GET /v1/activity + Then its item has actor {"type": "system", "id": null, "name": "System"}, source "system", ip null and user_agent null + + Scenario: A renamed or deleted user still reads correctly + Given an event recorded when user 3 was named "Marta Alves" + And user 3 has since been renamed "M. Alves" and then deleted + When the owner sends GET /v1/activity + Then the item's actor.name is still "Marta Alves" + + Scenario Outline: target.exists is resolved when the list is read + Given an event whose target is "" named "" + And + When the owner sends GET /v1/activity + Then the item's target.name is "" and target.exists is + + Examples: + | type | id | name | state | exists | + | article | 8 | Spring release | the article still exists | true | + | article | 8 | Spring release | the article was deleted | false | + | user | 3 | Marta Alves | the user was deleted | false | + + Scenario: A body change carries a delta and never text + Given an event with a body change of +312 characters + Then its change is {"field": "body", "kind": "body", "delta": 312} with no before and no after + + Scenario Outline: The filters are applied through the query + When the owner sends GET /v1/activity? + Then the response is 200 and items match + + Examples: + | query | expected | + | q=spring | the actor or target name contains spring | + | actor=user:3 | events of user 3 | + | actor=key:7 | events of api key 7 | + | actor=system | system events | + | category=auth | auth events | + | outcome=failed | failed events | + | outcome=success | succeeded events | + | outcome=all | both outcomes | + | security=true | events with the security flag | + | range=today | events since 00:00 UTC today | + | range=7d | events of the last 7 days | + | range=30d | events of the last 30 days | + | range=custom&from=2026-09-01&to=2026-09-30 | events from 1 to 30 September 2026 UTC | + | page=2&size=50 | the second page of 50 | + + Scenario: Omitting range means 7 days + Given events 2 days old and 10 days old + When the owner sends GET /v1/activity + Then only the 2-day-old event is listed + + Scenario Outline: Invalid values answer 400 + When the owner sends GET /v1/activity? + Then the response is 400 with body "The request cannot be processed due to a mismatch in the format of the body." + And the audit repository was not read + + Examples: + | query | + | actor=user:abc | + | actor=user:-1 | + | actor=group:3 | + | category=billing | + | outcome=maybe | + | security=false | + | range=year | + | range=custom | + | range=custom&from=2026-09-30&to=2026-09-01 | + | range=custom&from=yesterday&to=today | + | page=0 | + | page=abc | + | size=10 | + | size=200 | + + Rule: GET /v1/activity/summary answers the strip + + Scenario: The summary of the last seven days + Given 12 events in the last 7 days, 3 failed, 2 with the security flag, by 2 users and 1 api key + And 10 events in the 7 days before + When the owner sends GET /v1/activity/summary?range=7d + Then the response is 200 and the body is + """ + {"total": 12, "previous_total": 10, "active_people": {"users": 2, "api_keys": 1}, "failed": 3, "security": 2, "series": {"total": [...7 numbers], "active": [...7], "failed": [...7], "security": [...7]}} + """ + And each series array has 7 entries, oldest first, and the total series sums to 12 + + Scenario: An empty log answers zeros + Given no events + When the owner sends GET /v1/activity/summary + Then every number is 0 and every series array is seven zeros + + Scenario: The summary uses the same filters as the range + When the owner sends GET /v1/activity/summary?range=custom&from=2026-09-01&to=2026-09-07 + Then the counts cover exactly that range and previous_total covers the 7 days immediately before 2026-09-01 + + Scenario: An invalid range answers 400 + When the owner sends GET /v1/activity/summary?range=year + Then the response is 400 with the body-mismatch message + + Rule: GET /v1/activity/export streams a safe CSV + + Scenario: The response is a CSV attachment + Given 3 events + When the owner sends GET /v1/activity/export + Then the response is 200 with Content-Type "text/csv; charset=utf-8" and Content-Disposition starting with "attachment" + And the first row is "when,actor,action,target,outcome,source,ip" + And there are 3 data rows, newest first + + Scenario: A row holds the documented columns only + Given user 3 "Marta Alves" published "Spring release" at 2026-10-06T10:42:18Z from 203.0.113.12 with changes and a user agent + Then the row is "2026-10-06T10:42:18Z,Marta Alves,article.publish,Spring release,success,web,203.0.113.12" + And the file contains no changes and no user agent + + Scenario Outline: Cells that a spreadsheet would evaluate are neutralised + Given an event whose is "" + Then the cell is "" + + Examples: + | column | value | cell | + | actor | =cmd | '=cmd | + | target | +1+1 | '+1+1 | + | target | -2 | '-2 | + | actor | @SUM(A1) | '@SUM(A1) | + | target | Spring release | Spring release | + | target | a=b | a=b | + + Scenario: Commas, quotes and newlines are quoted + Given a target whose name contains a comma, double quotes and a newline + Then the cell is quoted with doubled inner quotes and the file still has one row for the event + + Scenario: The export uses the list filters without paging + Given 60 events of which 8 failed + When the owner sends GET /v1/activity/export?outcome=failed&page=2&size=25 + Then the file has the 8 failed rows and page and size are ignored + + Scenario: A system event has an empty ip cell + Given a system event + Then its ip cell is empty + + Scenario: An invalid filter answers 400 before any byte is streamed + When the owner sends GET /v1/activity/export?outcome=maybe + Then the response is 400 with the body-mismatch message and no CSV header + + Scenario: A large export is read in batches + Given 1200 events + When the owner exports them + Then the file has 1200 rows and the repository was read through List in pages, not all at once + + Rule: The retention period is a setting only the owner can change + + Scenario: The default is 90 days + Given no retention row exists + When a verified user sends GET /v1/settings + Then the body has "activity_retention_days": 90, "activity_last_cleanup_at": null and "activity_last_cleanup_removed": 0 + And the existing fields of the response are unchanged + + Scenario: The last cleanup is reported + Given a cleanup ran at 2026-10-06T03:00:00Z and removed 142 events + When a verified user sends GET /v1/settings + Then "activity_last_cleanup_at" is "2026-10-06T03:00:00Z" and "activity_last_cleanup_removed" is 142 + + Scenario Outline: The owner sets a valid period + When the owner sends PATCH /v1/settings with body {"activity_retention_days": } + Then the response is 200 and the body has "activity_retention_days": + And a following GET /v1/settings returns + + Examples: + | days | + | 30 | + | 90 | + | 365 | + | 0 | + + Scenario Outline: Any other value answers 400 and changes nothing + Given the stored retention is 90 + When the owner sends PATCH /v1/settings with body + Then the response is 400 with body "The request cannot be processed due to a mismatch in the format of the body." + And the stored retention is still 90 + + Examples: + | body | + | {"activity_retention_days": 7} | + | {"activity_retention_days": -1} | + | {"activity_retention_days": 366} | + | {"activity_retention_days": 30.5} | + | {"activity_retention_days": "30"} | + | {"activity_retention_days": null} | + | {} | + | not json | + + Scenario: An admin cannot change it + When an admin sends PATCH /v1/settings with body {"activity_retention_days": 30} + Then the response is 403 with body "Only the owner can do this." + And the stored retention is unchanged + + Scenario Outline: The gate answers before the body is read + When PATCH /v1/settings is sent with body {"activity_retention_days": 30} + Then the response is with body "" + + Examples: + | credentials | status | body | + | without a jwt cookie | 401 | You must be logged in to access this resource. | + | with an owner's API key | 403 | This action needs a real session. | + | with an unverified owner | 403 | You must verify your account to access this resource. | + + Scenario: A change is recorded as a system event by the owner + Given the stored retention is 90 + When the owner sends PATCH /v1/settings with body {"activity_retention_days": 30} + Then one event exists with action "system.activity_retention_changed", category "system", actor the owner, source "web", outcome "success", security false and params {"from": 90, "to": 30} + + Scenario: Setting the same value records nothing + Given the stored retention is 90 + When the owner sends PATCH /v1/settings with body {"activity_retention_days": 90} + Then the response is 200 and no event is recorded + + Rule: A daily cleanup removes events past the retention period + + Background: + Given the cleanup is a use case with a Tick(now) like PurgeScheduler, driven by the scheduler runner with hand-fed channels and an injected clock + And the server time zone is the injected clock's location + + Scenario Outline: The cleanup is due once a day at or after 03:00 + Given the retention is 90 and the last cleanup was at + When Tick runs at + Then ran is + + Examples: + | last | now | ran | + | never | 2026-10-06T02:59:00 | false | + | never | 2026-10-06T03:00:00 | true | + | never | 2026-10-06T14:00:00 | true | + | 2026-10-05T03:00:00 | 2026-10-06T02:59:00 | false | + | 2026-10-05T03:00:00 | 2026-10-06T03:00:00 | true | + | 2026-10-06T03:00:00 | 2026-10-06T04:00:00 | false | + | 2026-10-06T03:00:00 | 2026-10-07T03:00:00 | true | + + Scenario: Forever never runs + Given the retention is 0 + When Tick runs at 2026-10-06T03:00:00 + Then ran is false and DeleteOlderThan is not called + + Scenario: The cutoff is now minus the retention days + Given the retention is 30 and events at 40, 31, 29 and 1 days ago + When the cleanup runs at 2026-10-06T03:00:00 + Then the events 31 and 40 days old are removed and the others remain + And the last cleanup time is the clock's time and the removed count is 2 + + Scenario: The last 24 hours are never removed + Given the cleanup is asked for a cutoff newer than 24 hours ago + Then the effective cutoff is 24 hours before now + + Scenario: A cleanup that removes nothing still records the run + Given the retention is 90 and no event is older than 90 days + When the cleanup runs + Then the last cleanup time is the clock's time, the removed count is 0 and no system.activity_cleanup event is recorded + + Scenario: A cleanup that removes events records a system event after deleting + Given 142 events older than the retention + When the cleanup runs + Then one event exists with action "system.activity_cleanup", category "system", actor type "system", source "system", ip null, user_agent null, outcome "success" and params {"removed": 142} + And that event is not among the removed ones + + Scenario: A failing delete is retried at the next tick + Given DeleteOlderThan fails + When Tick runs + Then the error is returned and logged, the last cleanup fields are unchanged and the next tick runs the cleanup again + + Scenario: A shortened period applies at the next cleanup + Given the retention was 90 and the owner sets 30 + Then no event is removed by the change itself + And the next cleanup removes events older than 30 days + + Scenario: The scheduler stops with the process + When the context is cancelled + Then the runner returns and no goroutine outlives it + + Rule: The first producers record the right events + + Scenario Outline: Authentication events + When + Then one event exists with action "", category "auth", , source "web", outcome "", security , failure_reason and the request ip and user agent + + Examples: + | trigger | action | actor | outcome | security | reason | + | POST /v1/auth/login with the right username and password | auth.login | actor user with the account's name | success | false | null | + | POST /v1/auth/login with the right username and a wrong password | auth.login_failed | actor anonymous named by the attempted username | failed | true | "Wrong username or password." | + | POST /v1/auth/login with an unknown username | auth.login_failed | actor anonymous named by the attempted username | failed | true | "Wrong username or password." | + | POST /v1/auth/logout with a valid jwt cookie | auth.logout | actor user | success | false | null | + | POST /v1/auth/password-reset for an existing account | auth.password_reset_requested | actor user | success | true | null | + | POST /v1/auth/password-reset/confirm with a valid code | auth.password_reset_completed | actor user | success | true | null | + + Scenario: A failed login reveals no more than the response does + Given a wrong password for an existing user and an unknown username + Then both events have the same failure_reason, actor type anonymous and no target + And neither event holds the password + + Scenario Outline: Nothing is recorded when nothing happened + When + Then no event is recorded and the response is unchanged + + Examples: + | trigger | + | POST /v1/auth/logout without a jwt cookie | + | POST /v1/auth/password-reset for an unknown email | + | POST /v1/auth/password-reset/confirm with an invalid code | + | POST /v1/auth/login with a body that fails validation | + | POST /v1/auth/login answered 429 by the rate limiter | + + Scenario: A reset event never holds the code + When a password reset is requested and completed + Then neither event nor the process log contains the raw code, its hash or the new password + + Scenario: Creating an API key is recorded + When the owner sends POST /v1/api-key with a name "Deploy bot" + Then one event exists with action "api_key.create", category "api_keys", actor the owner, source "web", target {"type": "api_key", "id": "", "name": "Deploy bot"}, outcome "success" and security false + And no stored field and no response of the activity API contains the raw key or its hash + + Scenario: Revoking an API key is recorded + Given the API key 7 named "Deploy bot" + When the owner sends DELETE /v1/api-key/7 + Then one event exists with action "api_key.revoke", category "api_keys", actor the owner, target {"type": "api_key", "id": "7", "name": "Deploy bot"} and outcome "success" + + Scenario: A revoke of an unknown key records nothing + When the owner sends DELETE /v1/api-key/99 + Then the response is 404 and no event is recorded + + Scenario: The recorded events are readable through the API + Given a failed login, an API key creation and a retention change were recorded + When the owner sends GET /v1/activity + Then the three events are listed newest first with their documented items + And GET /v1/activity?security=true lists only the failed login diff --git a/features/activity-log-backend.qa.md b/features/activity-log-backend.qa.md new file mode 100644 index 0000000..7c134c6 --- /dev/null +++ b/features/activity-log-backend.qa.md @@ -0,0 +1,72 @@ +# QA procedure: activity-log-backend + +Go only, no SPA. Package `test` (black-box), new files `test/activity_log_domain_test.go`, `test/activity_log_persistence_test.go`, `test/activity_log_http_test.go` and `test/activity_cleanup_test.go`. Fake and helper type names must be unique across the package. No live server, no real SMTP, no real SQLite file, no real sleeping, no `time.Ticker`. No env var is added. Never put a secret value in a test name or log assertion helper beyond the fixed test strings. + +## Setup shared by every case +1. `validator.InitValidator()` once. `jwtauth.New("HS256", []byte("test-secret"), nil)` standing in for `JWT_SECRET`. +2. Fakes: `fakeAuditClock` (mutable, `Now()` and `Set(t)`, UTC), `mockAuditRepo` (in-memory slice, `Append`, `List`, `Summary`, `DeleteOlderThan`, failure and panic switches, call counters per method), existing `mockUserRepo` extended with users: owner 1, admin 2, a verified user 3 with role `"editor"` (domain has only owner and admin, so the role is a plain string in the fake), an unverified user 4. Fake API key repo with key 7 "Deploy bot" and a raw key built with `apikey.RawKeyPrefix`. +3. Router: a fresh `chi.NewRouter()` mirroring `api/router.go`. Mount `/activity` (RequireSession, `jwtauth.Verifier`, `jwtauth.Authenticator`, `RequireCurrentToken`, `RequireVerifiedUser`, then the audit context middleware), `/settings` with the new PATCH, `/api-key` and `/auth` over the real use cases and the fakes. `httptest.NewRecorder` per request. Cookies are real `jwt` cookies signed with the test token carrying `user_id` and `token_version`. +4. Capture the standard log with `log.SetOutput(&buf)` and restore with `t.Cleanup`. No parallel tests except where `-race` is stated. +5. Seed helper `seedEvents(repo, n, spec)` building events with explicit `created_at` from the clock. + +## A. Domain (no HTTP) +6. Vocabulary table: for each of actor type, category, outcome, source and change kind, the exported constants equal the allowed set from the feature; an invalid value is rejected by the domain constructor or validator with the matching `Err` sentinel (`errors.Is`). +7. Append-only guard: `reflect.TypeOf((*audit.Repository)(nil)).Elem()` has exactly `Append`, `List`, `Summary`, `DeleteOlderThan`. The persistence implementation's exported method set (via `reflect`) equals the same four. Router walk (`chi.Walk`) finds only GET under `/v1/activity`. +8. Recorder: with `mockAuditRepo` failing (`errors.New("disk full")`), `Record` returns without error, and `buf` names the failed write and `disk full`. A panicking repo is recovered. A context holding actor, source, ip and user agent fills an event that lacks them; an event that already has an actor keeps it. `created_at` equals `fakeAuditClock.Now()` in UTC. + +## B. Persistence (real in-memory SQLite, same model list as `api/dependecyInjection.go` and `migrate.go`) +9. Migrate, then query `sqlite_master` and assert the table and three indexes: `created_at`; `(actor_type, actor_id, created_at)`; `(category, created_at)`. Assert the audit model is in the `migrate.go` list (migrate the full list, not just the audit model). +10. Round-trip: append an event with params, changes (text and body kinds) and a null failure_reason; `List` returns equal fields. A system event round-trips with null ip and user agent. +11. Order: three events with identical `created_at` come back by id descending, older last. +12. Filter table from the feature (actor user, key, system, category, outcome, security, `q` case-insensitive, `q` containing `%` and `_` matched literally, date range inclusive of the whole `to` day UTC). Assert items and total for each. +13. Paging: 60 events, page 2 size 25 gives items 26-50 and total 60; page 9 gives empty items and total 60. +14. Summary: events in the last 7 days and the 7 days before; assert total, previous_total, failed, security, distinct user and key counts (anonymous and system excluded) and the four seven-element series, oldest first. +15. `DeleteOlderThan`: events at 100, 40, 31, 29, 1 days; cutoff 30 days; returns 3, remaining ids as expected. +16. Portability: assert no raw dialect-specific SQL (`ILIKE`, `strftime`, `date_trunc`, backticks) appears in the repository source. Cross-database run is manual (see below). + +## C. Audit context middleware (probe handler echoing the context as JSON) +17. Table: valid cookie for user 3 gives `{type user, id 3, name, source web}`; valid `Authorization: Bearer ` gives `{api_key, 7, "Deploy bot", source api_key}`; none gives anonymous and web. +18. IP table with `TrustedProxyRealIP([]string{"10.0.0.5"})` in front: trusted peer plus `X-Real-IP` gives the header; untrusted peer ignores it; no header gives the peer. User agent of 400 characters is cut to 255. + +## D. Read endpoints (HTTP) +19. Gate table: no cookie 401 `You must be logged in to access this resource.`; API key 403 `This action needs a real session.`; unverified cookie 403 `You must verify your account to access this resource.`, each for list, summary and export, with `mockAuditRepo` List/Summary counters at 0. +20. Roles: owner and admin see all actors; user 3 sees only its own with `total` of its own count; `actor=user:3` is 200, `actor=user:2`, `actor=key:7`, `actor=system` are 403 (body `Only owners and admins can do this.`); summary and export for user 3 are 403 with the same body. +21. Shape: decode the first item into a map and compare with the JSON in the feature, including `"failure_reason": null`, `"params": {}`, integer `actor.id`, string `target.id`, `exists`. System event has `actor.id` null, `ip` null, `user_agent` null. Renamed and deleted user keeps the snapshot name. `exists` table with fake article repo (present, deleted) and user repo (deleted). A `body` change has `delta` and no `before` or `after`. +22. Query table: every row of the filter outline, asserted against the seeded set; default range 7d (2-day event in, 10-day event out); default `page` 1, `size` 25. +23. 400 table: every invalid query row gives exactly `The request cannot be processed due to a mismatch in the format of the body.` with the repo read counter at 0. +24. Summary: the 7d example (12 / 10 / 2 users + 1 key / 3 / 2 and seven-length series that sum to the total); empty log all zeros; custom range previous period is the 7 days immediately before; invalid range 400. +25. Export: status 200, `Content-Type: text/csv; charset=utf-8`, `Content-Disposition` begins `attachment`. Parse with `encoding/csv`: header `when,actor,action,target,outcome,source,ip`, row values as in the feature, no changes and no user agent column, system ip cell empty. Formula table (`=cmd`, `+1+1`, `-2`, `@SUM(A1)` get a leading `'`; `Spring release` and `a=b` untouched). A name with comma, quotes and a newline is one parseable record. `outcome=failed&page=2&size=25` returns only failed rows. 1200 events yield 1200 rows and `mockAuditRepo` saw more than one `List` call with a bounded size. Invalid filter gives 400 with no `Content-Type: text/csv`. + +## E. Retention settings (HTTP) +26. `GET /v1/settings` with no stored row: `activity_retention_days` 90, `activity_last_cleanup_at` null, `activity_last_cleanup_removed` 0, existing fields (`version`) unchanged. With a stored cleanup: values echoed (RFC3339 UTC). +27. `PATCH` accepts 30, 90, 365, 0 (200, body echoes, a following GET agrees). 400 table: 7, -1, 366, 30.5, `"30"`, null, `{}`, non-JSON, each with the body-mismatch message and the stored value unchanged. +28. Gate: admin 403 `Only the owner can do this.`; no cookie 401; owner API key 403 `This action needs a real session.`; unverified owner 403 verification text. +29. Event: PATCH 90 to 30 records one `system.activity_retention_changed` event with actor owner, source web and params `{"from":90,"to":30}`; PATCH to the same value records none. + +## F. Cleanup scheduler (no HTTP, hand-fed channels, `fakeAuditClock`) +30. Tick table from the feature (never/last cleanup versus now, boundary at exactly 03:00, same-day second tick not due, next-day tick due). Assert `ran` and the `DeleteOlderThan` call count. Retention 0 never calls it. +31. Cutoff: retention 30, events at 40, 31, 29, 1 days; run at 03:00; 31 and 40 removed; `last_cleanup_at` equals the clock; removed count 2. A request for a cutoff inside 24 hours is clamped to now minus 24 hours. +32. Zero removed: fields updated, no `system.activity_cleanup` event. 142 removed: one event with action `system.activity_cleanup`, actor type system, source system, ip and user agent null, params `{"removed":142}`, and it is not deleted by the run that created it. +33. `DeleteOlderThan` failure: Tick returns the error, last-cleanup fields unchanged, the log buffer holds the error, the next Tick runs again after healing. +34. Runner: one tick runs one Tick; cancelling the context returns `Run` within a timeout; a done channel proves no goroutine outlives it (`-race`). +35. Shortening retention from 90 to 30 deletes nothing at PATCH time (repo `DeleteOlderThan` counter 0); the next due Tick deletes older than 30. + +## G. Producers (HTTP) +36. Login: right credentials gives `auth.login` (actor user, source web, security false, failure_reason null, ip and user agent from the request); wrong password and unknown username give `auth.login_failed` with actor anonymous named by the attempted username, outcome failed, security true, failure_reason `Wrong username or password.`, identical for both; validation failure and a rate-limited 429 record nothing. No stored field or log line contains the password. +37. Logout with a valid cookie gives `auth.logout`; without a cookie records nothing. +38. Password reset: request for an existing account gives `auth.password_reset_requested` (security true); unknown email records nothing and the response is byte-identical to the existing account's response except `Date`; confirm with a valid code gives `auth.password_reset_completed`; invalid code records nothing. Neither the raw code, its hash nor the new password appears in any stored field or in `buf`. +39. API key: `POST /v1/api-key` records `api_key.create` with the target `{api_key, , name}`; `DELETE /v1/api-key/7` records `api_key.revoke`; `DELETE /v1/api-key/99` is 404 and records nothing. Marshal every stored event and every `/v1/activity` response and assert the raw key and its hash are absent. +40. Recorder failure on each producer: the HTTP status and body equal those of the same request with a healthy repository. +41. End to end: record a failed login, a key creation and a retention change, then `GET /v1/activity` lists them newest first, and `?security=true` returns only the failed login. + +## H. Layering and hygiene guards +42. Grep-style test: `internal/domain/audit` imports only the stdlib and other `internal/domain/*`; the audit use cases import no `gorm`, `persistence`, `mailer`, `net/http`, chi or `api/...`; handlers import no `persistence`, `models` or `gorm`; the persistence repository asserts `var _ audit.Repository = &X{}`; the GORM model lives in `persistence/models` with a mapper. +43. Grep the new and edited files, Go and docs, for comments: none; only tool directives. +44. Docs read: `docs/api.md` lists the three activity routes, the query parameters, response shapes, the 400/401/403 answers and the PATCH `/v1/settings` contract with the three new GET fields; `docs/architecture.md` describes `domain/audit`, the recorder and context, the persistence model and indexes, and the retention scheduler; `docs/configuration.md` states that retention is stored in the database (default 90) and that no env var was added. + +## Manual (not automated) +45. Real boot with `task dev:api`: log in with a wrong password, log in correctly, create and revoke an API key, PATCH retention as owner (with the session cookie), then read `/v1/activity` and `/v1/activity/export` and open the CSV in a spreadsheet to confirm injected cells show as text. +46. Behind a reverse proxy with `TRUSTED_PROXIES` containing the proxy: the stored ip is the client's, not the proxy's. Without it: the proxy's. +47. Backdate events in the SQLite file, set retention to 30 and either wait for 03:00 or move the system clock; confirm removed rows and the new Last cleanup values in `GET /v1/settings`. +48. Run the persistence suite against a MySQL/MariaDB and a PostgreSQL instance through the documented database settings of `docs/configuration.md`: index creation, case-insensitive `q`, literal `%` and `_`, date-range boundaries, and `DeleteOlderThan` counts. +49. SIGINT during a cleanup: the process exits after the run ends, with no database error on close. diff --git a/internal/domain/audit/auditDomain.go b/internal/domain/audit/auditDomain.go new file mode 100644 index 0000000..60342e7 --- /dev/null +++ b/internal/domain/audit/auditDomain.go @@ -0,0 +1,207 @@ +package audit + +import ( + "RenewCMS/internal/domain/user" + "errors" + "slices" + "strconv" + "strings" + "time" +) + +var ErrInvalidFilter = errors.New("invalid activity filter") +var ErrInvalidRetention = errors.New("invalid activity retention period") +var ErrInvalidEvent = errors.New("invalid activity event") +var ErrActorNotAllowed = errors.New("activity of another actor is not allowed") + +type ActorType string + +const ( + ActorUser ActorType = "user" + ActorAPIKey ActorType = "api_key" + ActorSystem ActorType = "system" + ActorAnonymous ActorType = "anonymous" +) + +type Category string + +const ( + CategoryArticles Category = "articles" + CategoryMedia Category = "media" + CategoryUsers Category = "users" + CategoryAPIKeys Category = "api_keys" + CategoryAuth Category = "auth" + CategorySystem Category = "system" +) + +type Outcome string + +const ( + OutcomeSuccess Outcome = "success" + OutcomeFailed Outcome = "failed" +) + +type Source string + +const ( + SourceWeb Source = "web" + SourceAPIKey Source = "api_key" + SourceSystem Source = "system" +) + +type ChangeKind string + +const ( + ChangeText ChangeKind = "text" + ChangeBody ChangeKind = "body" +) + +const ( + ActionLogin = "auth.login" + ActionLoginFailed = "auth.login_failed" + ActionLogout = "auth.logout" + ActionPasswordResetRequest = "auth.password_reset_requested" + ActionPasswordResetDone = "auth.password_reset_completed" + ActionAPIKeyCreate = "api_key.create" + ActionAPIKeyRevoke = "api_key.revoke" + ActionRetentionChanged = "system.activity_retention_changed" + ActionCleanup = "system.activity_cleanup" +) + +const ( + TargetAPIKey = "api_key" + TargetUser = "user" +) + +const ( + SystemActorName = "System" + ReasonWrongLogin = "Wrong username or password." + MaxUserAgentLength = 255 + ParamRemoved = "removed" + ParamFrom = "from" + ParamTo = "to" + maxNameLength = 255 + maxActionLength = 64 + maxFailureReasonSize = 255 +) + +func ActorTypes() []ActorType { + return []ActorType{ActorUser, ActorAPIKey, ActorSystem, ActorAnonymous} +} + +func Categories() []Category { + return []Category{CategoryArticles, CategoryMedia, CategoryUsers, CategoryAPIKeys, CategoryAuth, CategorySystem} +} + +func Outcomes() []Outcome { + return []Outcome{OutcomeSuccess, OutcomeFailed} +} + +func Sources() []Source { + return []Source{SourceWeb, SourceAPIKey, SourceSystem} +} + +func ChangeKinds() []ChangeKind { + return []ChangeKind{ChangeText, ChangeBody} +} + +type Actor struct { + Type ActorType `json:"type"` + ID *uint32 `json:"id"` + Name string `json:"name"` +} + +type Target struct { + Type string `json:"type"` + ID string `json:"id"` + Name string `json:"name"` +} + +type Change struct { + Field string `json:"field"` + Kind ChangeKind `json:"kind"` + Before *string `json:"before,omitempty"` + After *string `json:"after,omitempty"` + Delta *int `json:"delta,omitempty"` +} + +type Event struct { + ID uint64 `json:"id"` + CreatedAt time.Time `json:"created_at"` + Action string `json:"action"` + Category Category `json:"category"` + Actor Actor `json:"actor"` + Target Target `json:"target"` + Outcome Outcome `json:"outcome"` + FailureReason *string `json:"failure_reason"` + Security bool `json:"security"` + Source Source `json:"source"` + IP *string `json:"ip"` + UserAgent *string `json:"user_agent"` + Params map[string]any `json:"params"` + Changes []Change `json:"changes"` +} + +func NewEvent(action string, category Category) Event { + return Event{ + Action: action, + Category: category, + Outcome: OutcomeSuccess, + Params: map[string]any{}, + Changes: []Change{}, + } +} + +func SystemActor() Actor { + return Actor{Type: ActorSystem, Name: SystemActorName} +} + +func UserActor(u user.User) Actor { + id := u.ID + name := strings.TrimSpace(u.DisplayName) + if name == "" { + name = u.Username + } + return Actor{Type: ActorUser, ID: &id, Name: name} +} + +func AnonymousActor(name string) Actor { + return Actor{Type: ActorAnonymous, Name: name} +} + +func APIKeyActor(id uint32, name string) Actor { + return Actor{Type: ActorAPIKey, ID: &id, Name: name} +} + +func APIKeyTarget(id uint32, name string) Target { + return Target{Type: TargetAPIKey, ID: strconv.FormatUint(uint64(id), 10), Name: name} +} + +func (e Event) Validate() error { + if e.Action == "" || len(e.Action) > maxActionLength { + return ErrInvalidEvent + } + if !slices.Contains(Categories(), e.Category) || !slices.Contains(Outcomes(), e.Outcome) || !slices.Contains(Sources(), e.Source) || !slices.Contains(ActorTypes(), e.Actor.Type) { + return ErrInvalidEvent + } + if e.FailureReason != nil && len(*e.FailureReason) > maxFailureReasonSize { + return ErrInvalidEvent + } + for _, change := range e.Changes { + if change.Kind != ChangeText && change.Kind != ChangeBody { + return ErrInvalidEvent + } + } + return nil +} + +func (e Event) Truncated() Event { + e.Actor.Name = truncate(e.Actor.Name, maxNameLength) + e.Target.Name = truncate(e.Target.Name, maxNameLength) + return e +} + +func truncate(value string, limit int) string { + runes := []rune(value) + return string(runes[:min(len(runes), limit)]) +} diff --git a/internal/domain/audit/auditFilter.go b/internal/domain/audit/auditFilter.go new file mode 100644 index 0000000..c11880e --- /dev/null +++ b/internal/domain/audit/auditFilter.go @@ -0,0 +1,98 @@ +package audit + +import ( + "slices" + "strconv" + "strings" + "time" +) + +const SeriesBuckets = 7 + +type ActorRef struct { + Type ActorType + ID *uint32 +} + +const ( + userActorPrefix = "user:" + apiKeyActorPrefix = "key:" + systemActorRef = "system" +) + +func ParseActor(raw string) (ActorRef, error) { + if raw == systemActorRef { + return ActorRef{Type: ActorSystem}, nil + } + if rest, ok := strings.CutPrefix(raw, userActorPrefix); ok { + return parseActorID(ActorUser, rest) + } + if rest, ok := strings.CutPrefix(raw, apiKeyActorPrefix); ok { + return parseActorID(ActorAPIKey, rest) + } + return ActorRef{}, ErrInvalidFilter +} + +func parseActorID(actorType ActorType, raw string) (ActorRef, error) { + id, err := strconv.ParseUint(raw, 10, 32) + if err != nil { + return ActorRef{}, ErrInvalidFilter + } + value := uint32(id) + return ActorRef{Type: actorType, ID: &value}, nil +} + +func ParseCategory(raw string) (Category, error) { + category := Category(raw) + if !slices.Contains(Categories(), category) { + return "", ErrInvalidFilter + } + return category, nil +} + +type Filter struct { + Query string + Actor *ActorRef + Category Category + Outcome Outcome + Security bool + From *time.Time + To *time.Time + Page int + Size int +} + +type Page struct { + Items []Event + Total int +} + +type SummaryQuery struct { + From time.Time + To time.Time +} + +func (q SummaryQuery) Previous() SummaryQuery { + return SummaryQuery{From: q.From.Add(-q.To.Sub(q.From)), To: q.From} +} + +type ActivePeople struct { + Users int `json:"users"` + APIKeys int `json:"api_keys"` +} + +type Series struct { + Total []int `json:"total"` + Active []int `json:"active"` + Failed []int `json:"failed"` + Security []int `json:"security"` +} + +type Summary struct { + Total int `json:"total"` + PreviousTotal int `json:"previous_total"` + ActivePeople ActivePeople `json:"active_people"` + Failed int `json:"failed"` + Security int `json:"security"` + Series Series `json:"series"` +} diff --git a/internal/domain/audit/auditRecorder.go b/internal/domain/audit/auditRecorder.go new file mode 100644 index 0000000..187b246 --- /dev/null +++ b/internal/domain/audit/auditRecorder.go @@ -0,0 +1,31 @@ +package audit + +import "context" + +type Recorder interface { + Record(ctx context.Context, event Event) +} + +type discardRecorder struct{} + +func (discardRecorder) Record(context.Context, Event) {} + +var Discard Recorder = discardRecorder{} + +type Origin struct { + Actor Actor + Source Source + IP string + UserAgent string +} + +type originContextKey struct{} + +func WithOrigin(ctx context.Context, origin Origin) context.Context { + return context.WithValue(ctx, originContextKey{}, origin) +} + +func OriginFrom(ctx context.Context) (Origin, bool) { + origin, ok := ctx.Value(originContextKey{}).(Origin) + return origin, ok +} diff --git a/internal/domain/audit/auditRepositoryInterface.go b/internal/domain/audit/auditRepositoryInterface.go new file mode 100644 index 0000000..8ae23c5 --- /dev/null +++ b/internal/domain/audit/auditRepositoryInterface.go @@ -0,0 +1,16 @@ +package audit + +import "time" + +type Repository interface { + Append(event Event) (Event, error) + List(filter Filter) (Page, error) + Summary(query SummaryQuery) (Summary, error) + DeleteOlderThan(cutoff time.Time) (int, error) +} + +type SettingsRepository interface { + Get() (Settings, error) + SaveRetention(days int) error + SaveLastCleanup(at time.Time, removed int) error +} diff --git a/internal/domain/audit/auditSettings.go b/internal/domain/audit/auditSettings.go new file mode 100644 index 0000000..903cd88 --- /dev/null +++ b/internal/domain/audit/auditSettings.go @@ -0,0 +1,57 @@ +package audit + +import "time" + +const ( + DefaultRetentionDays = 90 + ForeverRetentionDays = 0 + CleanupHour = 3 + KeepRecentHours = 24 +) + +func RetentionOptions() []int { + return []int{30, 90, 365, ForeverRetentionDays} +} + +func ValidateRetentionDays(days int) error { + for _, option := range RetentionOptions() { + if option == days { + return nil + } + } + return ErrInvalidRetention +} + +type Settings struct { + RetentionDays int `json:"activity_retention_days"` + LastCleanupAt *time.Time `json:"activity_last_cleanup_at"` + LastCleanupRemoved int `json:"activity_last_cleanup_removed"` +} + +func DefaultSettings() Settings { + return Settings{RetentionDays: DefaultRetentionDays} +} + +func (s Settings) CleanupDue(now time.Time) bool { + todayRun := time.Date(now.Year(), now.Month(), now.Day(), CleanupHour, 0, 0, 0, now.Location()) + if now.Before(todayRun) { + return false + } + return s.LastCleanupAt == nil || s.LastCleanupAt.Before(todayRun) +} + +func ClampCutoff(now time.Time, cutoff time.Time) time.Time { + newest := now.Add(-KeepRecentHours * time.Hour) + if cutoff.After(newest) { + return newest + } + return cutoff +} + +func RetentionCutoff(now time.Time, retentionDays int) time.Time { + return ClampCutoff(now, now.Add(-time.Duration(retentionDays)*24*time.Hour)) +} + +type CleanupResult struct { + Removed int +} diff --git a/internal/infrastructure/auditing/recorder.go b/internal/infrastructure/auditing/recorder.go new file mode 100644 index 0000000..103e03f --- /dev/null +++ b/internal/infrastructure/auditing/recorder.go @@ -0,0 +1,57 @@ +package auditing + +import ( + "RenewCMS/internal/domain/audit" + "context" + "log" + "time" +) + +type Recorder struct { + repository audit.Repository + now func() time.Time + logger *log.Logger +} + +var _ audit.Recorder = &Recorder{} + +func NewRecorder(repository audit.Repository, now func() time.Time, logger *log.Logger) *Recorder { + return &Recorder{repository, now, logger} +} + +func (r *Recorder) Record(ctx context.Context, event audit.Event) { + defer func() { + if recovered := recover(); recovered != nil { + r.logger.Printf("audit: writing the %s event panicked: %v", event.Action, recovered) + } + }() + + event = r.complete(ctx, event).Truncated() + if err := event.Validate(); err != nil { + r.logger.Printf("audit: dropped the %s event: %v", event.Action, err) + return + } + if _, err := r.repository.Append(event); err != nil { + r.logger.Printf("audit: failed to write the %s event: %v", event.Action, err) + } +} + +func (r *Recorder) complete(ctx context.Context, event audit.Event) audit.Event { + origin, _ := audit.OriginFrom(ctx) + if event.Actor.Type == "" { + event.Actor = origin.Actor + } + if event.Source == "" { + event.Source = origin.Source + } + if event.IP == nil && origin.IP != "" { + ip := origin.IP + event.IP = &ip + } + if event.UserAgent == nil && origin.UserAgent != "" { + userAgent := origin.UserAgent + event.UserAgent = &userAgent + } + event.CreatedAt = r.now().UTC() + return event +} diff --git a/internal/infrastructure/persistence/database/migrate.go b/internal/infrastructure/persistence/database/migrate.go index 15b5e91..65c49a6 100644 --- a/internal/infrastructure/persistence/database/migrate.go +++ b/internal/infrastructure/persistence/database/migrate.go @@ -7,7 +7,7 @@ import ( ) func Migrate(db *gorm.DB) error { - err := tableOptionsFor(db).AutoMigrate(&models.Article{}, &models.Image{}, &models.User{}, &models.Invite{}, &models.APIKey{}, &models.PurgeSettings{}) + err := tableOptionsFor(db).AutoMigrate(&models.Article{}, &models.Image{}, &models.User{}, &models.Invite{}, &models.APIKey{}, &models.PurgeSettings{}, &models.AuditEvent{}, &models.AuditSettings{}) if err != nil { return err } diff --git a/internal/infrastructure/persistence/mappers/auditMapper.go b/internal/infrastructure/persistence/mappers/auditMapper.go new file mode 100644 index 0000000..4a6a2e1 --- /dev/null +++ b/internal/infrastructure/persistence/mappers/auditMapper.go @@ -0,0 +1,97 @@ +package mappers + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/persistence/models" + "encoding/json" +) + +const ( + emptyParams = "{}" + emptyChanges = "[]" +) + +func AuditEventToModel(e audit.Event) (models.AuditEvent, error) { + params, err := encodeJSON(e.Params, emptyParams) + if err != nil { + return models.AuditEvent{}, err + } + changes, err := encodeJSON(e.Changes, emptyChanges) + if err != nil { + return models.AuditEvent{}, err + } + return models.AuditEvent{ + ID: e.ID, + CreatedAt: e.CreatedAt.UTC(), + Action: e.Action, + Category: string(e.Category), + ActorType: string(e.Actor.Type), + ActorID: e.Actor.ID, + ActorName: e.Actor.Name, + TargetType: e.Target.Type, + TargetID: e.Target.ID, + TargetName: e.Target.Name, + Outcome: string(e.Outcome), + FailureReason: e.FailureReason, + Security: e.Security, + Source: string(e.Source), + IP: e.IP, + UserAgent: e.UserAgent, + Params: params, + Changes: changes, + }, nil +} + +func AuditEventToDomain(m models.AuditEvent) (audit.Event, error) { + params := map[string]any{} + if err := json.Unmarshal([]byte(m.Params), ¶ms); err != nil { + return audit.Event{}, err + } + changes := []audit.Change{} + if err := json.Unmarshal([]byte(m.Changes), &changes); err != nil { + return audit.Event{}, err + } + return audit.Event{ + ID: m.ID, + CreatedAt: m.CreatedAt.UTC(), + Action: m.Action, + Category: audit.Category(m.Category), + Actor: audit.Actor{Type: audit.ActorType(m.ActorType), ID: m.ActorID, Name: m.ActorName}, + Target: audit.Target{Type: m.TargetType, ID: m.TargetID, Name: m.TargetName}, + Outcome: audit.Outcome(m.Outcome), + FailureReason: m.FailureReason, + Security: m.Security, + Source: audit.Source(m.Source), + IP: m.IP, + UserAgent: m.UserAgent, + Params: params, + Changes: changes, + }, nil +} + +func encodeJSON(value any, empty string) (string, error) { + encoded, err := json.Marshal(value) + if err != nil { + return "", err + } + if string(encoded) == "null" { + return empty, nil + } + return string(encoded), nil +} + +func AuditSettingsToDomain(m models.AuditSettings) audit.Settings { + return audit.Settings{ + RetentionDays: m.RetentionDays, + LastCleanupAt: m.LastCleanupAt, + LastCleanupRemoved: m.LastCleanupRemoved, + } +} + +func AuditSettingsToModel(s audit.Settings) models.AuditSettings { + return models.AuditSettings{ + RetentionDays: s.RetentionDays, + LastCleanupAt: s.LastCleanupAt, + LastCleanupRemoved: s.LastCleanupRemoved, + } +} diff --git a/internal/infrastructure/persistence/models/auditEventModel.go b/internal/infrastructure/persistence/models/auditEventModel.go new file mode 100644 index 0000000..ac8e2e4 --- /dev/null +++ b/internal/infrastructure/persistence/models/auditEventModel.go @@ -0,0 +1,24 @@ +package models + +import "time" + +type AuditEvent struct { + ID uint64 `gorm:"primaryKey;autoIncrement"` + CreatedAt time.Time `gorm:"not null;index:idx_audit_events_created_at;index:idx_audit_events_actor,priority:3;index:idx_audit_events_category,priority:2"` + Action string `gorm:"not null;size:64"` + Category string `gorm:"not null;size:16;index:idx_audit_events_category,priority:1"` + ActorType string `gorm:"not null;size:16;index:idx_audit_events_actor,priority:1"` + ActorID *uint32 `gorm:"index:idx_audit_events_actor,priority:2"` + ActorName string `gorm:"not null;size:255"` + TargetType string `gorm:"not null;size:32"` + TargetID string `gorm:"not null;size:64"` + TargetName string `gorm:"not null;size:255"` + Outcome string `gorm:"not null;size:16"` + FailureReason *string `gorm:"size:255"` + Security bool `gorm:"not null"` + Source string `gorm:"not null;size:16"` + IP *string `gorm:"size:64"` + UserAgent *string `gorm:"size:255"` + Params string `gorm:"not null;type:text"` + Changes string `gorm:"not null;type:text"` +} diff --git a/internal/infrastructure/persistence/models/auditSettingsModel.go b/internal/infrastructure/persistence/models/auditSettingsModel.go new file mode 100644 index 0000000..bda6733 --- /dev/null +++ b/internal/infrastructure/persistence/models/auditSettingsModel.go @@ -0,0 +1,10 @@ +package models + +import "time" + +type AuditSettings struct { + ID uint32 `gorm:"primaryKey"` + RetentionDays int `gorm:"not null"` + LastCleanupAt *time.Time + LastCleanupRemoved int `gorm:"not null"` +} diff --git a/internal/infrastructure/persistence/repositories/auditEventRepository.go b/internal/infrastructure/persistence/repositories/auditEventRepository.go new file mode 100644 index 0000000..b81d1b8 --- /dev/null +++ b/internal/infrastructure/persistence/repositories/auditEventRepository.go @@ -0,0 +1,188 @@ +package persistence + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/persistence/mappers" + entity "RenewCMS/internal/infrastructure/persistence/models" + "strings" + "time" + + "gorm.io/gorm" +) + +const likeEscape = " ESCAPE '!'" + +type AuditEventRepository struct { + db *gorm.DB +} + +var _ audit.Repository = &AuditEventRepository{} + +func NewAuditEventRepository(db *gorm.DB) *AuditEventRepository { + return &AuditEventRepository{db} +} + +func (a *AuditEventRepository) Append(event audit.Event) (audit.Event, error) { + model, err := mappers.AuditEventToModel(event) + if err != nil { + return audit.Event{}, err + } + model.ID = 0 + if err := a.db.Create(&model).Error; err != nil { + return audit.Event{}, err + } + return mappers.AuditEventToDomain(model) +} + +func (a *AuditEventRepository) List(filter audit.Filter) (audit.Page, error) { + var total int64 + if err := a.filtered(filter).Count(&total).Error; err != nil { + return audit.Page{}, err + } + + query := a.filtered(filter).Order("created_at DESC, id DESC") + if filter.Size > 0 { + query = query.Limit(filter.Size).Offset(offsetOf(filter)) + } + var found []entity.AuditEvent + if err := query.Find(&found).Error; err != nil { + return audit.Page{}, err + } + + items := make([]audit.Event, 0, len(found)) + for _, model := range found { + event, err := mappers.AuditEventToDomain(model) + if err != nil { + return audit.Page{}, err + } + items = append(items, event) + } + return audit.Page{Items: items, Total: int(total)}, nil +} + +func offsetOf(filter audit.Filter) int { + if filter.Page < 1 { + return 0 + } + return (filter.Page - 1) * filter.Size +} + +func (a *AuditEventRepository) filtered(filter audit.Filter) *gorm.DB { + query := a.db.Model(&entity.AuditEvent{}) + if filter.Actor != nil { + query = query.Where("actor_type = ?", string(filter.Actor.Type)) + if filter.Actor.ID != nil { + query = query.Where("actor_id = ?", *filter.Actor.ID) + } + } + if filter.Category != "" { + query = query.Where("category = ?", string(filter.Category)) + } + if filter.Outcome != "" { + query = query.Where("outcome = ?", string(filter.Outcome)) + } + if filter.Security { + query = query.Where("security = ?", true) + } + if filter.From != nil { + query = query.Where("created_at >= ?", filter.From.UTC()) + } + if filter.To != nil { + query = query.Where("created_at < ?", filter.To.UTC()) + } + if filter.Query != "" { + pattern := containsPattern(strings.ToLower(filter.Query)) + query = query.Where("(LOWER(actor_name) LIKE ?"+likeEscape+" OR LOWER(target_name) LIKE ?"+likeEscape+")", pattern, pattern) + } + return query +} + +func (a *AuditEventRepository) Summary(query audit.SummaryQuery) (audit.Summary, error) { + var summary audit.Summary + totals, err := a.countsBetween(query.From, query.To) + if err != nil { + return audit.Summary{}, err + } + summary.Total, summary.Failed, summary.Security = totals.Total, totals.Failed, totals.Security + + previous := query.Previous() + previousTotals, err := a.countsBetween(previous.From, previous.To) + if err != nil { + return audit.Summary{}, err + } + summary.PreviousTotal = previousTotals.Total + + if summary.ActivePeople.Users, err = a.distinctActors(audit.ActorUser, query.From, query.To); err != nil { + return audit.Summary{}, err + } + if summary.ActivePeople.APIKeys, err = a.distinctActors(audit.ActorAPIKey, query.From, query.To); err != nil { + return audit.Summary{}, err + } + summary.Series, err = a.series(query) + return summary, err +} + +type countsRow struct { + Total int + Failed int + Security int +} + +func (a *AuditEventRepository) countsBetween(from time.Time, to time.Time) (countsRow, error) { + var row countsRow + err := a.db.Model(&entity.AuditEvent{}). + Select("COUNT(*) AS total, "+ + "COALESCE(SUM(CASE WHEN outcome = ? THEN 1 ELSE 0 END), 0) AS failed, "+ + "COALESCE(SUM(CASE WHEN security = ? THEN 1 ELSE 0 END), 0) AS security", string(audit.OutcomeFailed), true). + Where("created_at >= ? AND created_at < ?", from.UTC(), to.UTC()). + Scan(&row).Error + return row, err +} + +func (a *AuditEventRepository) distinctActors(actorType audit.ActorType, from time.Time, to time.Time) (int, error) { + var count int64 + err := a.db.Model(&entity.AuditEvent{}). + Where("actor_type = ? AND created_at >= ? AND created_at < ?", string(actorType), from.UTC(), to.UTC()). + Distinct("actor_id"). + Count(&count).Error + return int(count), err +} + +func (a *AuditEventRepository) series(query audit.SummaryQuery) (audit.Series, error) { + series := audit.Series{ + Total: make([]int, audit.SeriesBuckets), + Active: make([]int, audit.SeriesBuckets), + Failed: make([]int, audit.SeriesBuckets), + Security: make([]int, audit.SeriesBuckets), + } + width := query.To.Sub(query.From) / audit.SeriesBuckets + if width <= 0 { + return series, nil + } + for i := 0; i < audit.SeriesBuckets; i++ { + from := query.From.Add(time.Duration(i) * width) + to := from.Add(width) + if i == audit.SeriesBuckets-1 { + to = query.To + } + counts, err := a.countsBetween(from, to) + if err != nil { + return audit.Series{}, err + } + users, err := a.distinctActors(audit.ActorUser, from, to) + if err != nil { + return audit.Series{}, err + } + keys, err := a.distinctActors(audit.ActorAPIKey, from, to) + if err != nil { + return audit.Series{}, err + } + series.Total[i], series.Failed[i], series.Security[i], series.Active[i] = counts.Total, counts.Failed, counts.Security, users+keys + } + return series, nil +} + +func (a *AuditEventRepository) DeleteOlderThan(cutoff time.Time) (int, error) { + result := a.db.Where("created_at < ?", cutoff.UTC()).Delete(&entity.AuditEvent{}) + return int(result.RowsAffected), result.Error +} diff --git a/internal/infrastructure/persistence/repositories/auditSettingsRepository.go b/internal/infrastructure/persistence/repositories/auditSettingsRepository.go new file mode 100644 index 0000000..b3bedab --- /dev/null +++ b/internal/infrastructure/persistence/repositories/auditSettingsRepository.go @@ -0,0 +1,61 @@ +package persistence + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/persistence/mappers" + entity "RenewCMS/internal/infrastructure/persistence/models" + "errors" + "time" + + "gorm.io/gorm" +) + +const auditSettingsRowID uint32 = 1 + +type AuditSettingsRepository struct { + db *gorm.DB +} + +var _ audit.SettingsRepository = &AuditSettingsRepository{} + +func NewAuditSettingsRepository(db *gorm.DB) *AuditSettingsRepository { + return &AuditSettingsRepository{db} +} + +func (a *AuditSettingsRepository) Get() (audit.Settings, error) { + var model entity.AuditSettings + err := a.db.First(&model, auditSettingsRowID).Error + if errors.Is(err, gorm.ErrRecordNotFound) { + return audit.DefaultSettings(), nil + } + if err != nil { + return audit.Settings{}, err + } + return mappers.AuditSettingsToDomain(model), nil +} + +func (a *AuditSettingsRepository) SaveRetention(days int) error { + return a.update(map[string]any{"retention_days": days}, func(settings *audit.Settings) { + settings.RetentionDays = days + }) +} + +func (a *AuditSettingsRepository) SaveLastCleanup(at time.Time, removed int) error { + utc := at.UTC() + return a.update(map[string]any{"last_cleanup_at": utc, "last_cleanup_removed": removed}, func(settings *audit.Settings) { + settings.LastCleanupAt = &utc + settings.LastCleanupRemoved = removed + }) +} + +func (a *AuditSettingsRepository) update(columns map[string]any, apply func(*audit.Settings)) error { + result := a.db.Model(&entity.AuditSettings{}).Where("id = ?", auditSettingsRowID).Updates(columns) + if result.Error != nil || result.RowsAffected > 0 { + return result.Error + } + settings := audit.DefaultSettings() + apply(&settings) + model := mappers.AuditSettingsToModel(settings) + model.ID = auditSettingsRowID + return a.db.Create(&model).Error +} diff --git a/internal/infrastructure/scheduler/runner.go b/internal/infrastructure/scheduler/runner.go index 3548754..778d457 100644 --- a/internal/infrastructure/scheduler/runner.go +++ b/internal/infrastructure/scheduler/runner.go @@ -1,9 +1,11 @@ package scheduler import ( + "RenewCMS/internal/domain/audit" "RenewCMS/internal/domain/purge" "context" "errors" + "fmt" "log" "time" ) @@ -17,8 +19,39 @@ type Job interface { Tick(now time.Time) (purge.RunResult, bool, error) } +type CleanupJob interface { + Tick(now time.Time) (audit.CleanupResult, bool, error) +} + +type task interface { + tick(now time.Time) (summary string, ran bool, err error) +} + +type purgeTask struct { + job Job +} + +func (p purgeTask) tick(now time.Time) (string, bool, error) { + result, ran, err := p.job.Tick(now) + if errors.Is(err, purge.ErrPurgeBusy) { + return "", false, nil + } + summary := fmt.Sprintf("groups_purged=%d merged=%d articles_updated=%d failed_groups=%d", result.GroupsPurged, result.Merged, result.ArticlesUpdated, result.FailedGroups) + return summary, ran, err +} + +type cleanupTask struct { + job CleanupJob +} + +func (c cleanupTask) tick(now time.Time) (string, bool, error) { + result, ran, err := c.job.Tick(now) + return fmt.Sprintf("removed=%d", result.Removed), ran, err +} + type Runner struct { - job Job + label string + task task now func() time.Time ticks <-chan time.Time startup <-chan time.Time @@ -26,14 +59,39 @@ type Runner struct { release func() } +const ( + purgeLabel = "automatic purge" + cleanupLabel = "activity cleanup" +) + +func newRunner(label string, task task, now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time, logger *log.Logger) *Runner { + return &Runner{label: label, task: task, now: now, ticks: ticks, startup: startup, logger: logger, release: func() {}} +} + func NewRunner(job Job, now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time, logger *log.Logger) *Runner { - return &Runner{job: job, now: now, ticks: ticks, startup: startup, logger: logger, release: func() {}} + return newRunner(purgeLabel, purgeTask{job}, now, ticks, startup, logger) +} + +func NewCleanupRunner(job CleanupJob, now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time, logger *log.Logger) *Runner { + return newRunner(cleanupLabel, cleanupTask{job}, now, ticks, startup, logger) } func NewSystemRunner(job Job, logger *log.Logger) *Runner { + return withSystemTimers(func(now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time) *Runner { + return NewRunner(job, now, ticks, startup, logger) + }) +} + +func NewSystemCleanupRunner(job CleanupJob, logger *log.Logger) *Runner { + return withSystemTimers(func(now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time) *Runner { + return NewCleanupRunner(job, now, ticks, startup, logger) + }) +} + +func withSystemTimers(build func(now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time) *Runner) *Runner { ticker := time.NewTicker(TickInterval) startup := time.NewTimer(StartupDelay) - runner := NewRunner(job, time.Now, ticker.C, startup.C, logger) + runner := build(time.Now, ticker.C, startup.C) runner.release = func() { ticker.Stop() startup.Stop() @@ -61,15 +119,12 @@ func (r *Runner) tick(ctx context.Context) { if ctx.Err() != nil { return } - result, ran, err := r.job.Tick(r.now()) - if errors.Is(err, purge.ErrPurgeBusy) { - return - } + summary, ran, err := r.task.tick(r.now()) if err != nil { - r.logger.Printf("scheduler: automatic purge failed: %v", err) + r.logger.Printf("scheduler: %s failed: %v", r.label, err) return } if ran { - r.logger.Printf("scheduler: automatic purge completed: groups_purged=%d merged=%d articles_updated=%d failed_groups=%d", result.GroupsPurged, result.Merged, result.ArticlesUpdated, result.FailedGroups) + r.logger.Printf("scheduler: %s completed: %s", r.label, summary) } } diff --git a/internal/infrastructure/useCases/ActivityRetention.go b/internal/infrastructure/useCases/ActivityRetention.go new file mode 100644 index 0000000..461e7dc --- /dev/null +++ b/internal/infrastructure/useCases/ActivityRetention.go @@ -0,0 +1,50 @@ +package useCases + +import ( + "RenewCMS/internal/domain/audit" + "context" +) + +type GetActivityRetentionUseCase struct { + settings audit.SettingsRepository +} + +func NewGetActivityRetentionUseCase(settings audit.SettingsRepository) *GetActivityRetentionUseCase { + return &GetActivityRetentionUseCase{settings} +} + +func (g *GetActivityRetentionUseCase) GetActivityRetention() (audit.Settings, error) { + return g.settings.Get() +} + +type UpdateActivityRetentionUseCase struct { + settings audit.SettingsRepository + recorder audit.Recorder +} + +func NewUpdateActivityRetentionUseCase(settings audit.SettingsRepository, recorder audit.Recorder) *UpdateActivityRetentionUseCase { + return &UpdateActivityRetentionUseCase{settings, recorder} +} + +func (u *UpdateActivityRetentionUseCase) UpdateActivityRetention(ctx context.Context, days int) (audit.Settings, error) { + if err := audit.ValidateRetentionDays(days); err != nil { + return audit.Settings{}, err + } + current, err := u.settings.Get() + if err != nil { + return audit.Settings{}, err + } + if current.RetentionDays == days { + return current, nil + } + if err := u.settings.SaveRetention(days); err != nil { + return audit.Settings{}, err + } + + event := audit.NewEvent(audit.ActionRetentionChanged, audit.CategorySystem) + event.Params = map[string]any{audit.ParamFrom: current.RetentionDays, audit.ParamTo: days} + u.recorder.Record(ctx, event) + + current.RetentionDays = days + return current, nil +} diff --git a/internal/infrastructure/useCases/AuthenticateUser.go b/internal/infrastructure/useCases/AuthenticateUser.go index 9376bb2..aae827e 100644 --- a/internal/infrastructure/useCases/AuthenticateUser.go +++ b/internal/infrastructure/useCases/AuthenticateUser.go @@ -1,20 +1,37 @@ package useCases import ( + "RenewCMS/internal/domain/audit" "RenewCMS/internal/domain/hash" "RenewCMS/internal/domain/user" + "context" + "errors" ) type AuthenticateUserUseCase struct { userRepository user.Repository hasher hash.Hasher + recorder audit.Recorder } -func NewAuthenticateUserUseCase(userRepository user.Repository, hasher hash.Hasher) *AuthenticateUserUseCase { - return &AuthenticateUserUseCase{userRepository, hasher} +func NewAuthenticateUserUseCase(userRepository user.Repository, hasher hash.Hasher, recorder audit.Recorder) *AuthenticateUserUseCase { + return &AuthenticateUserUseCase{userRepository, hasher, recorder} } -func (a *AuthenticateUserUseCase) Authenticate(username string, password string) (user.User, error) { +func (a *AuthenticateUserUseCase) Authenticate(ctx context.Context, username string, password string) (user.User, error) { + dbUser, err := a.verifyCredentials(username, password) + if err != nil { + a.recordRejectedLogin(ctx, username, err) + return user.User{}, err + } + + event := audit.NewEvent(audit.ActionLogin, audit.CategoryAuth) + event.Actor = audit.UserActor(dbUser) + a.recorder.Record(ctx, event) + return dbUser, nil +} + +func (a *AuthenticateUserUseCase) verifyCredentials(username string, password string) (user.User, error) { dbUser, err := a.userRepository.GetByUsername(username) if err != nil { return user.User{}, err @@ -26,3 +43,24 @@ func (a *AuthenticateUserUseCase) Authenticate(username string, password string) return dbUser, nil } + +func (a *AuthenticateUserUseCase) recordRejectedLogin(ctx context.Context, username string, cause error) { + if !errors.Is(cause, user.ErrUserNotFound) && !errors.Is(cause, user.ErrInvalidCredentials) { + return + } + reason := audit.ReasonWrongLogin + event := audit.NewEvent(audit.ActionLoginFailed, audit.CategoryAuth) + event.Actor = audit.AnonymousActor(username) + event.Outcome = audit.OutcomeFailed + event.FailureReason = &reason + event.Security = true + a.recorder.Record(ctx, event) +} + +func (a *AuthenticateUserUseCase) Logout(ctx context.Context) { + origin, ok := audit.OriginFrom(ctx) + if !ok || origin.Actor.Type != audit.ActorUser { + return + } + a.recorder.Record(ctx, audit.NewEvent(audit.ActionLogout, audit.CategoryAuth)) +} diff --git a/internal/infrastructure/useCases/CleanupActivity.go b/internal/infrastructure/useCases/CleanupActivity.go new file mode 100644 index 0000000..443f215 --- /dev/null +++ b/internal/infrastructure/useCases/CleanupActivity.go @@ -0,0 +1,47 @@ +package useCases + +import ( + "RenewCMS/internal/domain/audit" + "context" + "time" +) + +type CleanupActivityUseCase struct { + events audit.Repository + settings audit.SettingsRepository + recorder audit.Recorder +} + +func NewCleanupActivityUseCase(events audit.Repository, settings audit.SettingsRepository, recorder audit.Recorder) *CleanupActivityUseCase { + return &CleanupActivityUseCase{events, settings, recorder} +} + +func (c *CleanupActivityUseCase) Tick(now time.Time) (audit.CleanupResult, bool, error) { + settings, err := c.settings.Get() + if err != nil { + return audit.CleanupResult{}, false, err + } + if settings.RetentionDays == audit.ForeverRetentionDays || !settings.CleanupDue(now) { + return audit.CleanupResult{}, false, nil + } + + removed, err := c.events.DeleteOlderThan(audit.RetentionCutoff(now, settings.RetentionDays)) + if err != nil { + return audit.CleanupResult{}, false, err + } + if err := c.settings.SaveLastCleanup(now, removed); err != nil { + return audit.CleanupResult{}, false, err + } + if removed > 0 { + c.recordCleanup(removed) + } + return audit.CleanupResult{Removed: removed}, true, nil +} + +func (c *CleanupActivityUseCase) recordCleanup(removed int) { + event := audit.NewEvent(audit.ActionCleanup, audit.CategorySystem) + event.Actor = audit.SystemActor() + event.Source = audit.SourceSystem + event.Params = map[string]any{audit.ParamRemoved: removed} + c.recorder.Record(context.Background(), event) +} diff --git a/internal/infrastructure/useCases/CreateAPIKey.go b/internal/infrastructure/useCases/CreateAPIKey.go index 24bc194..a7ad446 100644 --- a/internal/infrastructure/useCases/CreateAPIKey.go +++ b/internal/infrastructure/useCases/CreateAPIKey.go @@ -2,6 +2,8 @@ package useCases import ( "RenewCMS/internal/domain/apikey" + "RenewCMS/internal/domain/audit" + "context" "time" ) @@ -9,6 +11,7 @@ type CreateAPIKeyUseCase struct { apiKeyRepository apikey.Repository keyGenerator apikey.KeyGenerator now func() time.Time + recorder audit.Recorder } type CreateAPIKeyCommand struct { @@ -22,11 +25,11 @@ type CreatedAPIKey struct { RawKey string } -func NewCreateAPIKeyUseCase(apiKeyRepository apikey.Repository, keyGenerator apikey.KeyGenerator, now func() time.Time) *CreateAPIKeyUseCase { - return &CreateAPIKeyUseCase{apiKeyRepository, keyGenerator, now} +func NewCreateAPIKeyUseCase(apiKeyRepository apikey.Repository, keyGenerator apikey.KeyGenerator, now func() time.Time, recorder audit.Recorder) *CreateAPIKeyUseCase { + return &CreateAPIKeyUseCase{apiKeyRepository, keyGenerator, now, recorder} } -func (c *CreateAPIKeyUseCase) CreateAPIKey(command CreateAPIKeyCommand) (CreatedAPIKey, error) { +func (c *CreateAPIKeyUseCase) CreateAPIKey(ctx context.Context, command CreateAPIKeyCommand) (CreatedAPIKey, error) { now := c.now() if command.ExpiresAt != nil && !command.ExpiresAt.After(now) { return CreatedAPIKey{}, apikey.ErrExpiryNotInFuture @@ -45,5 +48,9 @@ func (c *CreateAPIKeyUseCase) CreateAPIKey(command CreateAPIKeyCommand) (Created return CreatedAPIKey{}, err } + event := audit.NewEvent(audit.ActionAPIKeyCreate, audit.CategoryAPIKeys) + event.Target = audit.APIKeyTarget(stored.ID, stored.Name) + c.recorder.Record(ctx, event) + return CreatedAPIKey{Key: stored, RawKey: rawKey}, nil } diff --git a/internal/infrastructure/useCases/ExportActivity.go b/internal/infrastructure/useCases/ExportActivity.go new file mode 100644 index 0000000..8bcec66 --- /dev/null +++ b/internal/infrastructure/useCases/ExportActivity.go @@ -0,0 +1,88 @@ +package useCases + +import ( + "RenewCMS/internal/domain/audit" + "encoding/csv" + "io" + "strings" + "time" +) + +const exportBatchSize = 500 + +const formulaGuard = "'" +const formulaStarts = "=+-@" + +var exportHeader = []string{"when", "actor", "action", "target", "outcome", "source", "ip"} + +type ExportActivityUseCase struct { + events audit.Repository + now func() time.Time +} + +type ActivityExport struct { + events audit.Repository + filter audit.Filter +} + +func NewExportActivityUseCase(events audit.Repository, now func() time.Time) *ExportActivityUseCase { + return &ExportActivityUseCase{events, now} +} + +func (e *ExportActivityUseCase) Prepare(query ActivityQuery) (*ActivityExport, error) { + filter, err := buildActivityFilter(query, e.now()) + if err != nil { + return nil, err + } + return &ActivityExport{events: e.events, filter: filter}, nil +} + +func (a *ActivityExport) WriteCSV(w io.Writer) error { + writer := csv.NewWriter(w) + if err := writer.Write(exportHeader); err != nil { + return err + } + for page := 1; ; page++ { + filter := a.filter + filter.Page, filter.Size = page, exportBatchSize + found, err := a.events.List(filter) + if err != nil { + return err + } + for _, event := range found.Items { + if err := writer.Write(exportRow(event)); err != nil { + return err + } + } + writer.Flush() + if err := writer.Error(); err != nil { + return err + } + if len(found.Items) < exportBatchSize || page*exportBatchSize >= found.Total { + return nil + } + } +} + +func exportRow(event audit.Event) []string { + ip := "" + if event.IP != nil { + ip = *event.IP + } + return []string{ + event.CreatedAt.UTC().Format(time.RFC3339), + guardCell(event.Actor.Name), + guardCell(event.Action), + guardCell(event.Target.Name), + string(event.Outcome), + string(event.Source), + guardCell(ip), + } +} + +func guardCell(value string) string { + if value != "" && strings.ContainsRune(formulaStarts, rune(value[0])) { + return formulaGuard + value + } + return value +} diff --git a/internal/infrastructure/useCases/GetActivitySummary.go b/internal/infrastructure/useCases/GetActivitySummary.go new file mode 100644 index 0000000..d4024e2 --- /dev/null +++ b/internal/infrastructure/useCases/GetActivitySummary.go @@ -0,0 +1,23 @@ +package useCases + +import ( + "RenewCMS/internal/domain/audit" + "time" +) + +type GetActivitySummaryUseCase struct { + events audit.Repository + now func() time.Time +} + +func NewGetActivitySummaryUseCase(events audit.Repository, now func() time.Time) *GetActivitySummaryUseCase { + return &GetActivitySummaryUseCase{events, now} +} + +func (g *GetActivitySummaryUseCase) GetActivitySummary(query ActivityQuery) (audit.Summary, error) { + window, err := resolveActivityWindow(query, g.now()) + if err != nil { + return audit.Summary{}, err + } + return g.events.Summary(audit.SummaryQuery{From: window.from, To: window.to}) +} diff --git a/internal/infrastructure/useCases/ListActivity.go b/internal/infrastructure/useCases/ListActivity.go new file mode 100644 index 0000000..6e7d2cd --- /dev/null +++ b/internal/infrastructure/useCases/ListActivity.go @@ -0,0 +1,146 @@ +package useCases + +import ( + "RenewCMS/internal/domain/apikey" + "RenewCMS/internal/domain/article" + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/domain/image" + "RenewCMS/internal/domain/user" + "errors" + "strconv" + "time" +) + +const ( + targetArticle = "article" + targetImage = "image" +) + +type ListActivityUseCase struct { + events audit.Repository + users user.Repository + articles article.Repository + images image.Repository + apiKeys apikey.Repository + now func() time.Time +} + +type ListActivityCommand struct { + ViewerID uint32 + Query ActivityQuery +} + +type ActivityEntry struct { + Event audit.Event + TargetExists bool +} + +type ActivityPage struct { + Items []ActivityEntry + Total int + Page int + Size int +} + +func NewListActivityUseCase(events audit.Repository, users user.Repository, articles article.Repository, images image.Repository, apiKeys apikey.Repository, now func() time.Time) *ListActivityUseCase { + return &ListActivityUseCase{events, users, articles, images, apiKeys, now} +} + +func (l *ListActivityUseCase) ListActivity(command ListActivityCommand) (ActivityPage, error) { + filter, err := buildActivityFilter(command.Query, l.now()) + if err != nil { + return ActivityPage{}, err + } + if filter.Page, filter.Size, err = resolveActivityPaging(command.Query); err != nil { + return ActivityPage{}, err + } + if err := l.scopeToViewer(&filter, command.ViewerID); err != nil { + return ActivityPage{}, err + } + + found, err := l.events.List(filter) + if err != nil { + return ActivityPage{}, err + } + entries, err := l.withTargetState(found.Items) + if err != nil { + return ActivityPage{}, err + } + return ActivityPage{Items: entries, Total: found.Total, Page: filter.Page, Size: filter.Size}, nil +} + +func (l *ListActivityUseCase) scopeToViewer(filter *audit.Filter, viewerID uint32) error { + viewer, err := l.users.Get(viewerID) + if err != nil { + return err + } + if viewer.Role == user.RoleOwner || viewer.Role == user.RoleAdmin { + return nil + } + own := audit.ActorRef{Type: audit.ActorUser, ID: &viewer.ID} + if filter.Actor != nil && !sameActor(*filter.Actor, own) { + return audit.ErrActorNotAllowed + } + filter.Actor = &own + return nil +} + +func sameActor(a audit.ActorRef, b audit.ActorRef) bool { + return a.Type == b.Type && a.ID != nil && b.ID != nil && *a.ID == *b.ID +} + +type targetKey struct { + kind string + id string +} + +func (l *ListActivityUseCase) withTargetState(events []audit.Event) ([]ActivityEntry, error) { + known := map[targetKey]bool{} + entries := make([]ActivityEntry, 0, len(events)) + for _, event := range events { + key := targetKey{event.Target.Type, event.Target.ID} + exists, resolved := known[key] + if !resolved { + var err error + if exists, err = l.targetExists(event.Target); err != nil { + return nil, err + } + known[key] = exists + } + entries = append(entries, ActivityEntry{Event: event, TargetExists: exists}) + } + return entries, nil +} + +func (l *ListActivityUseCase) targetExists(target audit.Target) (bool, error) { + id, err := strconv.ParseUint(target.ID, 10, 32) + if err != nil { + return true, nil + } + switch target.Type { + case targetArticle: + _, err = l.articles.Get(uint32(id)) + return existsUnless(err, article.ErrArticleNotFound) + case audit.TargetUser: + _, err = l.users.Get(uint32(id)) + return existsUnless(err, user.ErrUserNotFound) + case audit.TargetAPIKey: + _, err = l.apiKeys.Get(uint32(id)) + return existsUnless(err, apikey.ErrAPIKeyNotFound) + case targetImage: + _, err = l.images.Get(uint32(id)) + return existsUnless(err, image.ErrImageNotFound) + default: + return true, nil + } +} + +func existsUnless(err error, notFound error) (bool, error) { + if err == nil { + return true, nil + } + if errors.Is(err, notFound) { + return false, nil + } + return false, err +} diff --git a/internal/infrastructure/useCases/RequestPasswordReset.go b/internal/infrastructure/useCases/RequestPasswordReset.go index fbe00e6..b389ef4 100644 --- a/internal/infrastructure/useCases/RequestPasswordReset.go +++ b/internal/infrastructure/useCases/RequestPasswordReset.go @@ -1,9 +1,11 @@ package useCases import ( + "RenewCMS/internal/domain/audit" "RenewCMS/internal/domain/hash" "RenewCMS/internal/domain/mail" "RenewCMS/internal/domain/user" + "context" "log" "time" @@ -15,6 +17,7 @@ type RequestPasswordResetUseCase struct { hasher hash.Hasher mailRepository mail.Repository publicURL string + recorder audit.Recorder } type MailPasswordResetData struct { @@ -23,11 +26,11 @@ type MailPasswordResetData struct { Email string } -func NewRequestPasswordResetUseCase(userRepository user.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string) *RequestPasswordResetUseCase { - return &RequestPasswordResetUseCase{userRepository, hasher, mailRepository, publicURL} +func NewRequestPasswordResetUseCase(userRepository user.Repository, hasher hash.Hasher, mailRepository mail.Repository, publicURL string, recorder audit.Recorder) *RequestPasswordResetUseCase { + return &RequestPasswordResetUseCase{userRepository, hasher, mailRepository, publicURL, recorder} } -func (g *RequestPasswordResetUseCase) RequestPasswordReset(email string) error { +func (g *RequestPasswordResetUseCase) RequestPasswordReset(ctx context.Context, email string) error { foundUser, err := g.userRepository.GetByEmail(email) if err != nil { return nil @@ -46,6 +49,8 @@ func (g *RequestPasswordResetUseCase) RequestPasswordReset(email string) error { return nil } + g.recordRequest(ctx, foundUser) + if err := g.mailRepository.Send(foundUser.Email, "password-reset", MailPasswordResetData{ Host: g.publicURL, VerificationCode: rawCode, @@ -57,3 +62,10 @@ func (g *RequestPasswordResetUseCase) RequestPasswordReset(email string) error { return nil } + +func (g *RequestPasswordResetUseCase) recordRequest(ctx context.Context, requester user.User) { + event := audit.NewEvent(audit.ActionPasswordResetRequest, audit.CategoryAuth) + event.Actor = audit.UserActor(requester) + event.Security = true + g.recorder.Record(ctx, event) +} diff --git a/internal/infrastructure/useCases/ResetPassword.go b/internal/infrastructure/useCases/ResetPassword.go index cb7bc46..d45f0ec 100644 --- a/internal/infrastructure/useCases/ResetPassword.go +++ b/internal/infrastructure/useCases/ResetPassword.go @@ -2,8 +2,10 @@ package useCases import ( "RenewCMS/internal/domain/apikey" + "RenewCMS/internal/domain/audit" "RenewCMS/internal/domain/hash" "RenewCMS/internal/domain/user" + "context" "time" ) @@ -12,13 +14,14 @@ type ResetPasswordUseCase struct { hasher hash.Hasher apiKeys apikey.Repository now func() time.Time + recorder audit.Recorder } -func NewResetPasswordUseCase(userRepository user.Repository, hasher hash.Hasher, apiKeys apikey.Repository, now func() time.Time) *ResetPasswordUseCase { - return &ResetPasswordUseCase{userRepository, hasher, apiKeys, now} +func NewResetPasswordUseCase(userRepository user.Repository, hasher hash.Hasher, apiKeys apikey.Repository, now func() time.Time, recorder audit.Recorder) *ResetPasswordUseCase { + return &ResetPasswordUseCase{userRepository, hasher, apiKeys, now, recorder} } -func (r *ResetPasswordUseCase) ResetPassword(email string, code string, newPassword string) error { +func (r *ResetPasswordUseCase) ResetPassword(ctx context.Context, email string, code string, newPassword string) error { dbUser, err := r.userRepository.GetByEmail(email) if err != nil { return user.ErrInvalidPasswordResetCode @@ -41,5 +44,13 @@ func (r *ResetPasswordUseCase) ResetPassword(email string, code string, newPassw return err } - return r.apiKeys.RevokeAllByUser(dbUser.ID, r.now()) + if err := r.apiKeys.RevokeAllByUser(dbUser.ID, r.now()); err != nil { + return err + } + + event := audit.NewEvent(audit.ActionPasswordResetDone, audit.CategoryAuth) + event.Actor = audit.UserActor(dbUser) + event.Security = true + r.recorder.Record(ctx, event) + return nil } diff --git a/internal/infrastructure/useCases/RevokeAPIKey.go b/internal/infrastructure/useCases/RevokeAPIKey.go index 4cc1917..fda380e 100644 --- a/internal/infrastructure/useCases/RevokeAPIKey.go +++ b/internal/infrastructure/useCases/RevokeAPIKey.go @@ -2,7 +2,9 @@ package useCases import ( "RenewCMS/internal/domain/apikey" + "RenewCMS/internal/domain/audit" "RenewCMS/internal/domain/user" + "context" "time" ) @@ -10,13 +12,14 @@ type RevokeAPIKeyUseCase struct { apiKeyRepository apikey.Repository userRepository user.Repository now func() time.Time + recorder audit.Recorder } -func NewRevokeAPIKeyUseCase(apiKeyRepository apikey.Repository, userRepository user.Repository, now func() time.Time) *RevokeAPIKeyUseCase { - return &RevokeAPIKeyUseCase{apiKeyRepository, userRepository, now} +func NewRevokeAPIKeyUseCase(apiKeyRepository apikey.Repository, userRepository user.Repository, now func() time.Time, recorder audit.Recorder) *RevokeAPIKeyUseCase { + return &RevokeAPIKeyUseCase{apiKeyRepository, userRepository, now, recorder} } -func (r *RevokeAPIKeyUseCase) RevokeAPIKey(requesterId uint32, keyId uint32) error { +func (r *RevokeAPIKeyUseCase) RevokeAPIKey(ctx context.Context, requesterId uint32, keyId uint32) error { key, err := r.apiKeyRepository.Get(keyId) if err != nil { return err @@ -35,5 +38,12 @@ func (r *RevokeAPIKeyUseCase) RevokeAPIKey(requesterId uint32, keyId uint32) err return nil } - return r.apiKeyRepository.Revoke(key.ID, r.now()) + if err := r.apiKeyRepository.Revoke(key.ID, r.now()); err != nil { + return err + } + + event := audit.NewEvent(audit.ActionAPIKeyRevoke, audit.CategoryAPIKeys) + event.Target = audit.APIKeyTarget(key.ID, key.Name) + r.recorder.Record(ctx, event) + return nil } diff --git a/internal/infrastructure/useCases/activityQuery.go b/internal/infrastructure/useCases/activityQuery.go new file mode 100644 index 0000000..a418f0d --- /dev/null +++ b/internal/infrastructure/useCases/activityQuery.go @@ -0,0 +1,144 @@ +package useCases + +import ( + "RenewCMS/internal/domain/audit" + "time" +) + +const ( + activityRangeToday = "today" + activityRange7Days = "7d" + activityRange30Days = "30d" + activityRangeCustom = "custom" + activityDateLayout = "2006-01-02" + activityDefaultSize = 25 + outcomeAll = "all" + securityOnly = "true" +) + +var activityPageSizes = []int{25, 50, 100} + +type ActivityQuery struct { + Q string + Actor string + Category string + Outcome string + Security string + Range string + From string + To string + Page int + Size int +} + +type activityWindow struct { + from time.Time + to time.Time + explicit bool +} + +func resolveActivityWindow(query ActivityQuery, now time.Time) (activityWindow, error) { + utc := now.UTC() + end := utc.Add(time.Second) + switch query.Range { + case "", activityRange7Days: + return activityWindow{from: end.AddDate(0, 0, -7), to: end}, nil + case activityRange30Days: + return activityWindow{from: end.AddDate(0, 0, -30), to: end}, nil + case activityRangeToday: + return activityWindow{from: time.Date(utc.Year(), utc.Month(), utc.Day(), 0, 0, 0, 0, time.UTC), to: end}, nil + case activityRangeCustom: + return resolveCustomWindow(query) + default: + return activityWindow{}, audit.ErrInvalidFilter + } +} + +func resolveCustomWindow(query ActivityQuery) (activityWindow, error) { + from, err := time.Parse(activityDateLayout, query.From) + if err != nil { + return activityWindow{}, audit.ErrInvalidFilter + } + last, err := time.Parse(activityDateLayout, query.To) + if err != nil || last.Before(from) { + return activityWindow{}, audit.ErrInvalidFilter + } + return activityWindow{from: from, to: last.AddDate(0, 0, 1), explicit: true}, nil +} + +func buildActivityFilter(query ActivityQuery, now time.Time) (audit.Filter, error) { + window, err := resolveActivityWindow(query, now) + if err != nil { + return audit.Filter{}, err + } + filter := audit.Filter{Query: query.Q, From: &window.from} + if window.explicit { + filter.To = &window.to + } + if filter.Outcome, err = parseActivityOutcome(query.Outcome); err != nil { + return audit.Filter{}, err + } + if filter.Security, err = parseActivitySecurity(query.Security); err != nil { + return audit.Filter{}, err + } + if query.Category != "" { + if filter.Category, err = audit.ParseCategory(query.Category); err != nil { + return audit.Filter{}, err + } + } + if query.Actor != "" { + actor, err := audit.ParseActor(query.Actor) + if err != nil { + return audit.Filter{}, err + } + filter.Actor = &actor + } + return filter, nil +} + +func parseActivityOutcome(raw string) (audit.Outcome, error) { + switch raw { + case "", outcomeAll: + return "", nil + case string(audit.OutcomeSuccess): + return audit.OutcomeSuccess, nil + case string(audit.OutcomeFailed): + return audit.OutcomeFailed, nil + default: + return "", audit.ErrInvalidFilter + } +} + +func parseActivitySecurity(raw string) (bool, error) { + switch raw { + case "": + return false, nil + case securityOnly: + return true, nil + default: + return false, audit.ErrInvalidFilter + } +} + +func resolveActivityPaging(query ActivityQuery) (int, int, error) { + page, size := query.Page, query.Size + if page == 0 { + page = 1 + } + if size == 0 { + size = activityDefaultSize + } + if page < 1 || !containsInt(activityPageSizes, size) { + return 0, 0, audit.ErrInvalidFilter + } + return page, size, nil +} + +func containsInt(values []int, wanted int) bool { + for _, value := range values { + if value == wanted { + return true + } + } + return false +} diff --git a/test/accept_invitation_test.go b/test/accept_invitation_test.go index 179c26c..2175d34 100644 --- a/test/accept_invitation_test.go +++ b/test/accept_invitation_test.go @@ -70,7 +70,7 @@ func newAcceptInviteFixture(t *testing.T, maxAttempts int) *acceptInviteFixture registerHandler := auth.NewLoginHandler( f.token, useCases.NewCreateUserUseCase(f.users, f.hasher, f.mail, invitePublicURL), - useCases.NewAuthenticateUserUseCase(f.users, f.hasher), + useCases.NewAuthenticateUserUseCase(f.users, f.hasher, discardRecorder), true, ) diff --git a/test/activity_domain_test.go b/test/activity_domain_test.go new file mode 100644 index 0000000..70b1758 --- /dev/null +++ b/test/activity_domain_test.go @@ -0,0 +1,199 @@ +package test + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/domain/user" + "errors" + "reflect" + "sort" + "testing" + "time" +) + +func activityStrings[T ~string](values []T) []string { + result := make([]string, 0, len(values)) + for _, value := range values { + result = append(result, string(value)) + } + sort.Strings(result) + return result +} + +func TestActivityDomain(t *testing.T) { + t.Run("An event carries everything the log needs", func(t *testing.T) { + event := audit.NewEvent("article.publish", audit.CategoryArticles) + + if event.Action != "article.publish" || event.Category != audit.CategoryArticles { + t.Fatalf("unexpected action or category: %+v", event) + } + if event.Outcome != audit.OutcomeSuccess { + t.Errorf("expected a successful outcome by default, got %q", event.Outcome) + } + wanted := []string{"ID", "CreatedAt", "Action", "Params", "Category", "Actor", "Target", "Outcome", "FailureReason", "Security", "Source", "IP", "UserAgent", "Changes"} + eventType := reflect.TypeOf(event) + for _, name := range wanted { + if _, ok := eventType.FieldByName(name); !ok { + t.Errorf("the event has no %s field", name) + } + } + actorType := reflect.TypeOf(event.Actor) + for _, name := range []string{"Type", "ID", "Name"} { + if _, ok := actorType.FieldByName(name); !ok { + t.Errorf("the actor snapshot has no %s field", name) + } + } + targetType := reflect.TypeOf(event.Target) + for _, name := range []string{"Type", "ID", "Name"} { + if _, ok := targetType.FieldByName(name); !ok { + t.Errorf("the target snapshot has no %s field", name) + } + } + }) + + vocabulary := []struct { + field string + got []string + wanted []string + }{ + {"actor.type", activityStrings(audit.ActorTypes()), []string{"anonymous", "api_key", "system", "user"}}, + {"category", activityStrings(audit.Categories()), []string{"api_keys", "articles", "auth", "media", "system", "users"}}, + {"outcome", activityStrings(audit.Outcomes()), []string{"failed", "success"}}, + {"source", activityStrings(audit.Sources()), []string{"api_key", "system", "web"}}, + {"change.kind", activityStrings(audit.ChangeKinds()), []string{"body", "text"}}, + } + for _, c := range vocabulary { + t.Run("The vocabulary is closed: "+c.field, func(t *testing.T) { + if !reflect.DeepEqual(c.got, c.wanted) { + t.Errorf("expected %v, got %v", c.wanted, c.got) + } + }) + } + + t.Run("The repository exposes no way to edit or delete one event", func(t *testing.T) { + repoType := reflect.TypeOf((*audit.Repository)(nil)).Elem() + var names []string + for i := 0; i < repoType.NumMethod(); i++ { + names = append(names, repoType.Method(i).Name) + } + sort.Strings(names) + wanted := []string{"Append", "DeleteOlderThan", "List", "Summary"} + if !reflect.DeepEqual(names, wanted) { + t.Errorf("expected methods %v, got %v", wanted, names) + } + }) + + t.Run("The sentinel errors are matchable", func(t *testing.T) { + if !errors.Is(audit.ErrInvalidFilter, audit.ErrInvalidFilter) || !errors.Is(audit.ErrInvalidRetention, audit.ErrInvalidRetention) { + t.Fatal("sentinels must match themselves") + } + if errors.Is(audit.ErrInvalidFilter, audit.ErrInvalidRetention) { + t.Error("the sentinels must be distinct") + } + if _, err := audit.ParseActor("group:3"); !errors.Is(err, audit.ErrInvalidFilter) { + t.Errorf("expected ErrInvalidFilter, got %v", err) + } + if err := audit.ValidateRetentionDays(7); !errors.Is(err, audit.ErrInvalidRetention) { + t.Errorf("expected ErrInvalidRetention, got %v", err) + } + }) + + t.Run("An actor reference is parsed from its query form", func(t *testing.T) { + cases := []struct { + raw string + wantType audit.ActorType + wantID uint32 + wantErr bool + }{ + {"user:3", audit.ActorUser, 3, false}, + {"key:7", audit.ActorAPIKey, 7, false}, + {"system", audit.ActorSystem, 0, false}, + {"user:abc", "", 0, true}, + {"user:-1", "", 0, true}, + {"user:", "", 0, true}, + {"group:3", "", 0, true}, + {"system:1", "", 0, true}, + } + for _, c := range cases { + ref, err := audit.ParseActor(c.raw) + if c.wantErr { + if !errors.Is(err, audit.ErrInvalidFilter) { + t.Errorf("%q: expected ErrInvalidFilter, got %v", c.raw, err) + } + continue + } + if err != nil || ref.Type != c.wantType { + t.Fatalf("%q: unexpected result %+v, %v", c.raw, ref, err) + } + if c.wantID != 0 && (ref.ID == nil || *ref.ID != c.wantID) { + t.Errorf("%q: expected id %d, got %v", c.raw, c.wantID, ref.ID) + } + } + }) + + t.Run("A user actor reads the display name and falls back to the username", func(t *testing.T) { + named := audit.UserActor(user.User{ID: 3, Username: "marta", DisplayName: "Marta Alves"}) + if named.Type != audit.ActorUser || named.ID == nil || *named.ID != 3 || named.Name != "Marta Alves" { + t.Errorf("unexpected actor %+v", named) + } + plain := audit.UserActor(user.User{ID: 4, Username: "dev"}) + if plain.Name != "dev" { + t.Errorf("expected the username, got %q", plain.Name) + } + }) + + t.Run("Only the documented retention periods are valid", func(t *testing.T) { + for _, days := range []int{30, 90, 365, 0} { + if err := audit.ValidateRetentionDays(days); err != nil { + t.Errorf("%d should be valid: %v", days, err) + } + } + for _, days := range []int{7, -1, 366, 1} { + if err := audit.ValidateRetentionDays(days); !errors.Is(err, audit.ErrInvalidRetention) { + t.Errorf("%d should be invalid, got %v", days, err) + } + } + if audit.DefaultSettings().RetentionDays != 90 { + t.Errorf("the default retention must be 90 days") + } + }) + + t.Run("The cleanup is due once a day at or after 03:00", func(t *testing.T) { + at := func(day, hour, minute int) time.Time { + return time.Date(2026, time.October, day, hour, minute, 0, 0, time.UTC) + } + cases := []struct { + name string + last *time.Time + now time.Time + due bool + }{ + {"never before 03:00", nil, at(6, 2, 59), false}, + {"never at 03:00", nil, at(6, 3, 0), true}, + {"never at 14:00", nil, at(6, 14, 0), true}, + {"yesterday before 03:00", ptrTime(at(5, 3, 0)), at(6, 2, 59), false}, + {"yesterday at 03:00", ptrTime(at(5, 3, 0)), at(6, 3, 0), true}, + {"today already", ptrTime(at(6, 3, 0)), at(6, 4, 0), false}, + {"tomorrow at 03:00", ptrTime(at(6, 3, 0)), at(7, 3, 0), true}, + } + for _, c := range cases { + settings := audit.Settings{RetentionDays: 90, LastCleanupAt: c.last} + if got := settings.CleanupDue(c.now); got != c.due { + t.Errorf("%s: expected %v, got %v", c.name, c.due, got) + } + } + }) + + t.Run("The last 24 hours are never removed", func(t *testing.T) { + now := time.Date(2026, time.October, 6, 3, 0, 0, 0, time.UTC) + tooRecent := now.Add(-time.Hour) + if got := audit.ClampCutoff(now, tooRecent); !got.Equal(now.Add(-24 * time.Hour)) { + t.Errorf("expected the 24 hour floor, got %v", got) + } + older := now.Add(-48 * time.Hour) + if got := audit.ClampCutoff(now, older); !got.Equal(older) { + t.Errorf("expected the older cutoff to stay, got %v", got) + } + }) +} + +func ptrTime(t time.Time) *time.Time { return &t } diff --git a/test/activity_log_backend_http_test.go b/test/activity_log_backend_http_test.go new file mode 100644 index 0000000..2bc1bfe --- /dev/null +++ b/test/activity_log_backend_http_test.go @@ -0,0 +1,1136 @@ +package test + +import ( + "RenewCMS/api" + "RenewCMS/api/middleware" + "RenewCMS/api/pkg/apperr" + validator "RenewCMS/api/pkg/validator" + "RenewCMS/internal/domain/apikey" + "RenewCMS/internal/domain/article" + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/domain/user" + "RenewCMS/internal/infrastructure/config" + "RenewCMS/internal/infrastructure/hashing" + "RenewCMS/internal/infrastructure/useCases" + "encoding/csv" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "reflect" + "strconv" + "strings" + "testing" + "time" + + "github.com/go-chi/chi/v5" + "github.com/go-chi/jwtauth/v5" +) + +const ( + activityOwnerID = 1 + activityAdminID = 2 + activityEditorID = 3 + activityUnverifiedID = 4 + activityPassword = "oldpassword1" + activityUserAgent = "Mozilla/5.0 test" + activityPeer = "203.0.113.12:5050" + activityMismatch = apperr.BodyErrorMessage +) + +type activityHTTPEnv struct { + *activityHarness + users *mockUserRepo + keys *mockAPIKeyRepo + articles *mockArticleRepo + mail *mockMailRepo + token *jwtauth.JWTAuth + generator *hashing.SHA256KeyGenerator + router http.Handler +} + +func newActivityHTTPEnv(t *testing.T, attempts int) *activityHTTPEnv { + t.Helper() + validator.InitValidator() + h := newActivityHarness(t) + e := &activityHTTPEnv{ + activityHarness: h, + users: newMockUserRepo(), + keys: newMockAPIKeyRepo(), + articles: newMockArticleRepo(), + mail: newMockMailRepo(), + token: jwtauth.New("HS256", []byte("test-secret"), nil), + generator: hashing.NewSHA256KeyGenerator(), + } + e.users.users[activityOwnerID] = user.User{ID: activityOwnerID, Username: "marta", DisplayName: "Marta Alves", Email: "marta@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: user.RoleOwner} + e.users.users[activityAdminID] = user.User{ID: activityAdminID, Username: "dev", Email: "dev@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: user.RoleAdmin} + e.users.users[activityEditorID] = user.User{ID: activityEditorID, Username: "ed", Email: "ed@example.com", Password: "hashed:" + activityPassword, IsVerified: true, Role: "editor"} + e.users.users[activityUnverifiedID] = user.User{ID: activityUnverifiedID, Username: "quinn", Email: "quinn@example.com", IsVerified: false, Role: user.RoleOwner} + e.users.nextID = 4 + + hasher := &stubHasher{} + resetClock := time.Now + container := &api.UseCases{ + Token: e.token, + GetUserUseCase: useCases.NewGetUserUseCase(e.users), + AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(e.users, hasher, h.recorder), + RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(e.users, hasher, e.mail, "https://cms.example.com", h.recorder), + ResetPasswordUseCase: useCases.NewResetPasswordUseCase(e.users, hasher, e.keys, resetClock, h.recorder), + CreateAPIKeyUseCase: useCases.NewCreateAPIKeyUseCase(e.keys, e.generator, h.clock, h.recorder), + ListAPIKeysUseCase: useCases.NewListAPIKeysUseCase(e.keys, e.users, h.clock), + RevokeAPIKeyUseCase: useCases.NewRevokeAPIKeyUseCase(e.keys, e.users, h.clock, h.recorder), + AuthenticateAPIKeyUseCase: useCases.NewAuthenticateAPIKeyUseCase(e.keys, e.generator, e.users, h.clock), + GetSettingsUseCase: useCases.NewGetSettingsUseCase("v-test"), + GetActivityRetentionUseCase: useCases.NewGetActivityRetentionUseCase(h.settings), + UpdateActivityRetentionUseCase: useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder), + ListActivityUseCase: useCases.NewListActivityUseCase(h.probe, e.users, e.articles, newMockImageRepo(), e.keys, h.clock), + GetActivitySummaryUseCase: useCases.NewGetActivitySummaryUseCase(h.probe, h.clock), + ExportActivityUseCase: useCases.NewExportActivityUseCase(h.probe, h.clock), + } + settings := config.Settings{AuthRateLimit: config.AuthRateLimitSettings{MaxAttempts: attempts, Window: time.Minute}} + router := chi.NewRouter() + router.Mount("/v1", api.InitBackendRoutes(container, settings)) + e.router = router + return e +} + +type activityRequest func(*http.Request) + +func asUser(e *activityHTTPEnv, id uint32) activityRequest { + return func(r *http.Request) { + _, tokenString, _ := e.token.Encode(map[string]any{"user_id": id, "token_version": 0}) + r.AddCookie(&http.Cookie{Name: "jwt", Value: tokenString}) + } +} + +func withBearer(raw string) activityRequest { + return func(r *http.Request) { r.Header.Set("Authorization", "Bearer "+raw) } +} + +func (e *activityHTTPEnv) send(method string, path string, body string, options ...activityRequest) *httptest.ResponseRecorder { + var req *http.Request + if body == "" { + req = httptest.NewRequest(method, path, nil) + } else { + req = httptest.NewRequest(method, path, strings.NewReader(body)) + req.Header.Set("Content-Type", "application/json") + } + req.RemoteAddr = activityPeer + req.Header.Set("User-Agent", activityUserAgent) + for _, option := range options { + option(req) + } + rec := httptest.NewRecorder() + e.router.ServeHTTP(rec, req) + return rec +} + +func (e *activityHTTPEnv) get(path string, options ...activityRequest) *httptest.ResponseRecorder { + return e.send(http.MethodGet, path, "", options...) +} + +func (e *activityHTTPEnv) issueKey(t *testing.T, owner uint32, name string) (string, uint32) { + t.Helper() + raw, prefix, hashed := e.generator.Generate() + stored, err := e.keys.Create(apikey.APIKey{UserID: owner, Name: name, Prefix: prefix, HashedKey: hashed, CreatedAt: e.now}) + if err != nil { + t.Fatal(err) + } + return raw, stored.ID +} + +func (e *activityHTTPEnv) seedBy(t *testing.T, actor audit.Actor, ago time.Duration, mutate ...func(*audit.Event)) audit.Event { + t.Helper() + event := activityUserEvent(0, "", e.now.Add(-ago)) + event.Actor = actor + if actor.Type == audit.ActorSystem { + event.Source = audit.SourceSystem + } + if actor.Type == audit.ActorAPIKey { + event.Source = audit.SourceAPIKey + } + for _, apply := range mutate { + apply(&event) + } + return e.seed(t, event) +} + +func userActor(id uint32, name string) audit.Actor { + return audit.Actor{Type: audit.ActorUser, ID: activityPtr(id), Name: name} +} + +type activityList struct { + Items []map[string]any `json:"items"` + Total int `json:"total"` + Page int `json:"page"` + Size int `json:"size"` +} + +func decodeActivityList(t *testing.T, rec *httptest.ResponseRecorder) activityList { + t.Helper() + if rec.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String()) + } + var list activityList + if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil { + t.Fatalf("unexpected body %q: %v", rec.Body.String(), err) + } + return list +} + +func (l activityList) ids() []uint64 { + ids := make([]uint64, 0, len(l.Items)) + for _, item := range l.Items { + ids = append(ids, uint64(item["id"].(float64))) + } + return ids +} + +func assertPlain(t *testing.T, rec *httptest.ResponseRecorder, status int, body string) { + t.Helper() + if rec.Code != status || strings.TrimSpace(rec.Body.String()) != body { + t.Errorf("expected %d %q, got %d %q", status, body, rec.Code, strings.TrimSpace(rec.Body.String())) + } +} + +func TestActivityLogBackendAudienceGates(t *testing.T) { + t.Run("The credentials gate answers before any data", func(t *testing.T) { + paths := []string{"/v1/activity", "/v1/activity/summary", "/v1/activity/export"} + for _, path := range paths { + t.Run("no cookie "+path, func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + assertPlain(t, e.get(path), http.StatusUnauthorized, apperr.UnauthorizedErrorMessage) + if e.probe.reads != 0 { + t.Error("the audit repository was read") + } + }) + t.Run("API key "+path, func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + raw, _ := e.issueKey(t, activityOwnerID, "Deploy bot") + assertPlain(t, e.get(path, withBearer(raw)), http.StatusForbidden, apperr.SessionRequiredErrorMessage) + if e.probe.reads != 0 { + t.Error("the audit repository was read") + } + }) + } + e := newActivityHTTPEnv(t, 1000) + assertPlain(t, e.get("/v1/activity", asUser(e, activityUnverifiedID)), http.StatusForbidden, apperr.VerificationRequiredErrorMessage) + if e.probe.reads != 0 { + t.Error("the audit repository was read") + } + }) + + t.Run("Owner and admin see every event", func(t *testing.T) { + for _, role := range []struct { + name string + id uint32 + }{{"owner", activityOwnerID}, {"admin", activityAdminID}} { + t.Run(role.name, func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.seedBy(t, userActor(1, "a"), time.Hour) + e.seedBy(t, userActor(2, "b"), time.Hour) + e.seedBy(t, userActor(3, "c"), time.Hour) + e.seedBy(t, audit.APIKeyActor(7, "bot"), time.Hour) + e.seedBy(t, audit.SystemActor(), time.Hour) + + list := decodeActivityList(t, e.get("/v1/activity", asUser(e, role.id))) + + if list.Total != 5 { + t.Errorf("expected 5 events, got %d", list.Total) + } + }) + } + }) + + t.Run("Another role is scoped to its own events", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.seedBy(t, userActor(1, "a"), time.Hour) + e.seedBy(t, userActor(2, "b"), time.Hour) + e.seedBy(t, userActor(3, "c"), time.Hour) + e.seedBy(t, userActor(3, "c"), 2*time.Hour) + + list := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityEditorID))) + + if list.Total != 2 { + t.Fatalf("expected user 3's 2 events, got %d", list.Total) + } + for _, item := range list.Items { + actor := item["actor"].(map[string]any) + if actor["type"] != "user" || actor["id"] != float64(3) { + t.Errorf("unexpected actor %v", actor) + } + } + }) + + t.Run("A scoped caller cannot ask for another actor", func(t *testing.T) { + for actor, status := range map[string]int{"user:3": 200, "user:2": 403, "key:7": 403, "system": 403} { + e := newActivityHTTPEnv(t, 1000) + rec := e.get("/v1/activity?actor="+actor, asUser(e, activityEditorID)) + if rec.Code != status { + t.Errorf("%s: expected %d, got %d", actor, status, rec.Code) + } + } + }) + + t.Run("A scoped caller cannot read the summary or the export", func(t *testing.T) { + for _, path := range []string{"/v1/activity/summary", "/v1/activity/export"} { + e := newActivityHTTPEnv(t, 1000) + assertPlain(t, e.get(path, asUser(e, activityEditorID)), http.StatusForbidden, apperr.OwnerOrAdminRequiredErrorMessage) + if e.probe.reads != 0 { + t.Error("the audit repository was read") + } + } + }) + + t.Run("The repository exposes no way to edit or delete one event", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + for _, method := range []string{http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete} { + for _, path := range []string{"/v1/activity", "/v1/activity/1", "/v1/activity/summary", "/v1/activity/export"} { + rec := e.send(method, path, `{}`, asUser(e, activityOwnerID)) + if rec.Code != http.StatusMethodNotAllowed && rec.Code != http.StatusNotFound { + t.Errorf("%s %s: expected 404 or 405, got %d", method, path, rec.Code) + } + } + } + }) +} + +func TestActivityLogBackendList(t *testing.T) { + t.Run("The default request", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + for i := 0; i < 30; i++ { + e.seedBy(t, userActor(1, "a"), time.Duration(i+1)*time.Hour) + } + + rec := e.get("/v1/activity", asUser(e, activityOwnerID)) + list := decodeActivityList(t, rec) + + if list.Total != 30 || list.Page != 1 || list.Size != 25 || len(list.Items) != 25 { + t.Fatalf("unexpected list %d/%d/%d with %d items", list.Total, list.Page, list.Size, len(list.Items)) + } + for i := 1; i < len(list.Items); i++ { + if list.Items[i]["created_at"].(string) > list.Items[i-1]["created_at"].(string) { + t.Errorf("expected newest first, got %v then %v", list.Items[i-1]["created_at"], list.Items[i]["created_at"]) + break + } + } + }) + + t.Run("An item has the documented shape", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.articles.articles[8] = article.Article{ID: 8, Title: "Spring release"} + stored := e.seed(t, func() audit.Event { + event := activityUserEvent(3, "Marta Alves", time.Date(2026, time.October, 6, 10, 42, 18, 0, time.UTC)) + event.Target = audit.Target{Type: "article", ID: "8", Name: "Spring release"} + event.IP = activityPtr("203.0.113.12") + event.UserAgent = activityPtr("Chrome 129 on Windows") + event.Changes = []audit.Change{{Field: "online", Kind: audit.ChangeText, Before: activityPtr("false"), After: activityPtr("true")}} + return event + }()) + + rec := e.get("/v1/activity", asUser(e, activityOwnerID)) + + var got struct { + Items []json.RawMessage `json:"items"` + } + _ = json.Unmarshal(rec.Body.Bytes(), &got) + want := fmt.Sprintf(`{"id": %d, "created_at": "2026-10-06T10:42:18Z", "action": "article.publish", "category": "articles", "actor": {"type": "user", "id": 3, "name": "Marta Alves"}, "target": {"type": "article", "id": "8", "name": "Spring release", "exists": true}, "outcome": "success", "failure_reason": null, "security": false, "source": "web", "ip": "203.0.113.12", "user_agent": "Chrome 129 on Windows", "params": {}, "changes": [{"field": "online", "kind": "text", "before": "false", "after": "true"}]}`, stored.ID) + assertJSONEqual(t, want, string(got.Items[0])) + }) + + t.Run("A system event has no ip or user agent", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.seedBy(t, audit.SystemActor(), time.Hour) + + item := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityOwnerID))).Items[0] + + assertJSONValue(t, item["actor"], `{"type": "system", "id": null, "name": "System"}`) + if item["source"] != "system" || item["ip"] != nil || item["user_agent"] != nil { + t.Errorf("unexpected item %v", item) + } + }) + + t.Run("A renamed or deleted user still reads correctly", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.seedBy(t, userActor(9, "Marta Alves"), time.Hour) + e.users.users[9] = user.User{ID: 9, Username: "marta2", DisplayName: "M. Alves", IsVerified: true} + delete(e.users.users, 9) + + item := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityOwnerID))).Items[0] + + if item["actor"].(map[string]any)["name"] != "Marta Alves" { + t.Errorf("unexpected actor %v", item["actor"]) + } + }) + + t.Run("target.exists is resolved when the list is read", func(t *testing.T) { + cases := []struct { + name string + target audit.Target + setup func(*activityHTTPEnv) + exists bool + }{ + {"the article still exists", audit.Target{Type: "article", ID: "8", Name: "Spring release"}, func(e *activityHTTPEnv) { e.articles.articles[8] = article.Article{ID: 8} }, true}, + {"the article was deleted", audit.Target{Type: "article", ID: "8", Name: "Spring release"}, func(e *activityHTTPEnv) {}, false}, + {"the user was deleted", audit.Target{Type: "user", ID: "9", Name: "Marta Alves"}, func(e *activityHTTPEnv) {}, false}, + } + for _, c := range cases { + t.Run(c.name, func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + c.setup(e) + e.seedBy(t, userActor(1, "a"), time.Hour, func(ev *audit.Event) { ev.Target = c.target }) + + target := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityOwnerID))).Items[0]["target"].(map[string]any) + + if target["name"] != c.target.Name || target["exists"] != c.exists { + t.Errorf("unexpected target %v", target) + } + }) + } + }) + + t.Run("A body change carries a delta and never text", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.seedBy(t, userActor(1, "a"), time.Hour, func(ev *audit.Event) { + ev.Changes = []audit.Change{{Field: "body", Kind: audit.ChangeBody, Delta: activityPtr(312)}} + }) + + item := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityOwnerID))).Items[0] + + assertJSONValue(t, item["changes"], `[{"field": "body", "kind": "body", "delta": 312}]`) + }) + + t.Run("The filters are applied through the query", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + hour := time.Hour + spring := e.seedBy(t, userActor(1, "a"), hour, func(ev *audit.Event) { ev.Target = audit.Target{Type: "article", ID: "1", Name: "Spring release"} }) + user3 := e.seedBy(t, userActor(3, "c"), 14*hour) + key7 := e.seedBy(t, audit.APIKeyActor(7, "bot"), 15*hour) + system := e.seedBy(t, audit.SystemActor(), 16*hour, func(ev *audit.Event) { ev.Category = audit.CategorySystem }) + failedAuth := e.seedBy(t, audit.AnonymousActor("mallory"), 17*hour, func(ev *audit.Event) { + ev.Category = audit.CategoryAuth + ev.Outcome = audit.OutcomeFailed + ev.Security = true + }) + old := e.seedBy(t, userActor(1, "a"), 20*24*hour) + september := e.seedBy(t, userActor(1, "a"), 35*24*hour+12*hour) + everyRecent := []uint64{spring.ID, user3.ID, key7.ID, system.ID, failedAuth.ID} + cases := []struct { + query string + want []uint64 + }{ + {"q=spring", []uint64{spring.ID}}, + {"actor=user:3", []uint64{user3.ID}}, + {"actor=key:7", []uint64{key7.ID}}, + {"actor=system", []uint64{system.ID}}, + {"category=auth", []uint64{failedAuth.ID}}, + {"outcome=failed", []uint64{failedAuth.ID}}, + {"outcome=success", []uint64{spring.ID, user3.ID, key7.ID, system.ID}}, + {"outcome=all", everyRecent}, + {"security=true", []uint64{failedAuth.ID}}, + {"range=today", []uint64{spring.ID}}, + {"range=7d", everyRecent}, + {"range=30d", append(append([]uint64{}, everyRecent...), old.ID)}, + {"range=custom&from=2026-09-01&to=2026-09-01", []uint64{september.ID}}, + {"page=2&size=25", nil}, + } + for _, c := range cases { + t.Run(c.query, func(t *testing.T) { + got := decodeActivityList(t, e.get("/v1/activity?"+c.query, asUser(e, activityOwnerID))).ids() + if !sameIDs(got, c.want) { + t.Errorf("expected %v, got %v", c.want, got) + } + }) + } + page := decodeActivityList(t, e.get("/v1/activity?page=2&size=50", asUser(e, activityOwnerID))) + if page.Page != 2 || page.Size != 50 { + t.Errorf("unexpected paging %d/%d", page.Page, page.Size) + } + }) + + t.Run("Omitting range means 7 days", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + recent := e.seedBy(t, userActor(1, "a"), 2*24*time.Hour) + e.seedBy(t, userActor(1, "a"), 10*24*time.Hour) + + got := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityOwnerID))).ids() + + if !reflect.DeepEqual(got, []uint64{recent.ID}) { + t.Errorf("expected only the recent event, got %v", got) + } + }) + + t.Run("Invalid values answer 400", func(t *testing.T) { + queries := []string{ + "actor=user:abc", "actor=user:-1", "actor=group:3", "category=billing", "outcome=maybe", "security=false", + "range=year", "range=custom", "range=custom&from=2026-09-30&to=2026-09-01", "range=custom&from=yesterday&to=today", + "page=0", "page=abc", "size=10", "size=200", + } + for _, query := range queries { + e := newActivityHTTPEnv(t, 1000) + assertPlain(t, e.get("/v1/activity?"+query, asUser(e, activityOwnerID)), http.StatusBadRequest, activityMismatch) + if e.probe.reads != 0 { + t.Errorf("%s: the audit repository was read", query) + } + } + }) +} + +func sameIDs(got []uint64, want []uint64) bool { + if len(got) != len(want) { + return false + } + seen := map[uint64]bool{} + for _, id := range got { + seen[id] = true + } + for _, id := range want { + if !seen[id] { + return false + } + } + return true +} + +func assertJSONEqual(t *testing.T, want string, got string) { + t.Helper() + var a, b any + if err := json.Unmarshal([]byte(want), &a); err != nil { + t.Fatalf("bad expectation %q: %v", want, err) + } + if err := json.Unmarshal([]byte(got), &b); err != nil { + t.Fatalf("bad body %q: %v", got, err) + } + if !reflect.DeepEqual(a, b) { + t.Errorf("expected %s, got %s", want, got) + } +} + +func assertJSONValue(t *testing.T, value any, want string) { + t.Helper() + encoded, _ := json.Marshal(value) + assertJSONEqual(t, want, string(encoded)) +} + +func TestActivityLogBackendSummary(t *testing.T) { + t.Run("The summary of the last seven days", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + for i := 0; i < 12; i++ { + i := i + actor := userActor(uint32(1+i%2), "u") + if i == 11 { + actor = audit.APIKeyActor(7, "bot") + } + e.seedBy(t, actor, time.Duration(i)*12*time.Hour+time.Hour, func(ev *audit.Event) { + ev.Outcome = map[bool]audit.Outcome{true: audit.OutcomeFailed, false: audit.OutcomeSuccess}[i < 3] + ev.Security = i < 2 + }) + } + for i := 0; i < 10; i++ { + e.seedBy(t, userActor(1, "u"), 7*24*time.Hour+time.Duration(i+1)*time.Hour) + } + + rec := e.get("/v1/activity/summary?range=7d", asUser(e, activityOwnerID)) + + if rec.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String()) + } + var got map[string]any + _ = json.Unmarshal(rec.Body.Bytes(), &got) + if got["total"] != float64(12) || got["previous_total"] != float64(10) || got["failed"] != float64(3) || got["security"] != float64(2) { + t.Errorf("unexpected counts %v", got) + } + assertJSONValue(t, got["active_people"], `{"users": 2, "api_keys": 1}`) + series := got["series"].(map[string]any) + sum := 0.0 + for _, name := range []string{"total", "active", "failed", "security"} { + values := series[name].([]any) + if len(values) != 7 { + t.Errorf("%s: expected 7 entries, got %d", name, len(values)) + } + if name == "total" { + for _, v := range values { + sum += v.(float64) + } + } + } + if sum != 12 { + t.Errorf("expected the total series to sum to 12, got %v", sum) + } + }) + + t.Run("An empty log answers zeros", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.get("/v1/activity/summary", asUser(e, activityOwnerID)) + + assertJSONEqual(t, `{"total":0,"previous_total":0,"active_people":{"users":0,"api_keys":0},"failed":0,"security":0,"series":{"total":[0,0,0,0,0,0,0],"active":[0,0,0,0,0,0,0],"failed":[0,0,0,0,0,0,0],"security":[0,0,0,0,0,0,0]}}`, rec.Body.String()) + }) + + t.Run("The summary uses the same filters as the range", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + at := func(month time.Month, day int) { + e.seed(t, activityUserEvent(1, "a", time.Date(2026, month, day, 12, 0, 0, 0, time.UTC))) + } + at(time.September, 2) + at(time.September, 7) + at(time.September, 9) + at(time.August, 28) + + rec := e.get("/v1/activity/summary?range=custom&from=2026-09-01&to=2026-09-07", asUser(e, activityOwnerID)) + + var got map[string]any + _ = json.Unmarshal(rec.Body.Bytes(), &got) + if got["total"] != float64(2) || got["previous_total"] != float64(1) { + t.Errorf("unexpected counts %v", got) + } + }) + + t.Run("An invalid range answers 400", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + assertPlain(t, e.get("/v1/activity/summary?range=year", asUser(e, activityOwnerID)), http.StatusBadRequest, activityMismatch) + }) +} + +func TestActivityLogBackendExport(t *testing.T) { + t.Run("The response is a CSV attachment", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + for i := 1; i <= 3; i++ { + e.seedBy(t, userActor(1, "a"), time.Duration(i)*time.Hour) + } + + rec := e.get("/v1/activity/export", asUser(e, activityOwnerID)) + + if rec.Code != http.StatusOK || rec.Header().Get("Content-Type") != "text/csv; charset=utf-8" || !strings.HasPrefix(rec.Header().Get("Content-Disposition"), "attachment") { + t.Fatalf("unexpected response %d %v", rec.Code, rec.Header()) + } + rows, err := csv.NewReader(strings.NewReader(rec.Body.String())).ReadAll() + if err != nil || len(rows) != 4 || strings.Join(rows[0], ",") != "when,actor,action,target,outcome,source,ip" { + t.Errorf("unexpected file %q, %v", rec.Body.String(), err) + } + }) + + t.Run("A row holds the documented columns only", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.seed(t, func() audit.Event { + event := activityUserEvent(3, "Marta Alves", time.Date(2026, time.October, 6, 10, 42, 18, 0, time.UTC)) + event.Target = audit.Target{Type: "article", ID: "8", Name: "Spring release"} + event.IP = activityPtr("203.0.113.12") + event.UserAgent = activityPtr("Chrome 129 on Windows") + event.Changes = []audit.Change{{Field: "online", Kind: audit.ChangeText, Before: activityPtr("false"), After: activityPtr("true")}} + return event + }()) + + body := e.get("/v1/activity/export", asUser(e, activityOwnerID)).Body.String() + + if !strings.HasSuffix(body, "2026-10-06T10:42:18Z,Marta Alves,article.publish,Spring release,success,web,203.0.113.12\n") || strings.Contains(body, "Chrome") { + t.Errorf("unexpected file %q", body) + } + }) + + t.Run("The export uses the list filters without paging", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + for i := 0; i < 60; i++ { + failed := i < 8 + e.seedBy(t, userActor(1, "a"), time.Duration(i+1)*time.Minute, func(ev *audit.Event) { + if failed { + ev.Outcome = audit.OutcomeFailed + } + }) + } + + rows, _ := csv.NewReader(strings.NewReader(e.get("/v1/activity/export?outcome=failed&page=2&size=25", asUser(e, activityOwnerID)).Body.String())).ReadAll() + + if len(rows) != 9 { + t.Errorf("expected the header and 8 failed rows, got %d lines", len(rows)) + } + }) + + t.Run("An invalid filter answers 400 before any byte is streamed", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.get("/v1/activity/export?outcome=maybe", asUser(e, activityOwnerID)) + + assertPlain(t, rec, http.StatusBadRequest, activityMismatch) + if strings.Contains(rec.Header().Get("Content-Type"), "csv") || strings.Contains(rec.Body.String(), "when,actor") { + t.Errorf("no CSV header expected, got %v %q", rec.Header(), rec.Body.String()) + } + }) +} + +func TestActivityLogBackendRetentionSetting(t *testing.T) { + settingsBodyOf := func(rec *httptest.ResponseRecorder) map[string]any { + var body map[string]any + _ = json.Unmarshal(rec.Body.Bytes(), &body) + return body + } + + t.Run("The default is 90 days", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.get("/v1/settings", asUser(e, activityEditorID)) + + assertJSONEqual(t, `{"version":"v-test","activity_retention_days":90,"activity_last_cleanup_at":null,"activity_last_cleanup_removed":0}`, rec.Body.String()) + }) + + t.Run("The last cleanup is reported", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.settings.settings.LastCleanupAt = activityPtr(time.Date(2026, time.October, 6, 3, 0, 0, 0, time.UTC)) + e.settings.settings.LastCleanupRemoved = 142 + + body := settingsBodyOf(e.get("/v1/settings", asUser(e, activityEditorID))) + + if body["activity_last_cleanup_at"] != "2026-10-06T03:00:00Z" || body["activity_last_cleanup_removed"] != float64(142) { + t.Errorf("unexpected body %v", body) + } + }) + + t.Run("An API key can still read the settings", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + raw, _ := e.issueKey(t, activityOwnerID, "bot") + + if rec := e.get("/v1/settings", withBearer(raw)); rec.Code != http.StatusOK { + t.Errorf("expected 200, got %d", rec.Code) + } + }) + + t.Run("The owner sets a valid period", func(t *testing.T) { + for _, days := range []int{30, 90, 365, 0} { + e := newActivityHTTPEnv(t, 1000) + + rec := e.send(http.MethodPatch, "/v1/settings", fmt.Sprintf(`{"activity_retention_days": %d}`, days), asUser(e, activityOwnerID)) + + if rec.Code != http.StatusOK || settingsBodyOf(rec)["activity_retention_days"] != float64(days) { + t.Fatalf("%d: unexpected response %d %s", days, rec.Code, rec.Body.String()) + } + if settingsBodyOf(e.get("/v1/settings", asUser(e, activityOwnerID)))["activity_retention_days"] != float64(days) { + t.Errorf("%d: the following GET disagrees", days) + } + } + }) + + t.Run("Any other value answers 400 and changes nothing", func(t *testing.T) { + bodies := []string{ + `{"activity_retention_days": 7}`, `{"activity_retention_days": -1}`, `{"activity_retention_days": 366}`, + `{"activity_retention_days": 30.5}`, `{"activity_retention_days": "30"}`, `{"activity_retention_days": null}`, `{}`, `not json`, + } + for _, body := range bodies { + e := newActivityHTTPEnv(t, 1000) + + assertPlain(t, e.send(http.MethodPatch, "/v1/settings", body, asUser(e, activityOwnerID)), http.StatusBadRequest, activityMismatch) + + if e.settings.settings.RetentionDays != 90 { + t.Errorf("%s: the retention changed to %d", body, e.settings.settings.RetentionDays) + } + } + }) + + t.Run("An admin cannot change it", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 30}`, asUser(e, activityAdminID)) + + assertPlain(t, rec, http.StatusForbidden, apperr.OwnerRequiredErrorMessage) + if e.settings.settings.RetentionDays != 90 { + t.Error("the retention changed") + } + }) + + t.Run("The gate answers before the body is read", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + raw, _ := e.issueKey(t, activityOwnerID, "bot") + body := `{"activity_retention_days": 30}` + + assertPlain(t, e.send(http.MethodPatch, "/v1/settings", body), http.StatusUnauthorized, apperr.UnauthorizedErrorMessage) + assertPlain(t, e.send(http.MethodPatch, "/v1/settings", body, withBearer(raw)), http.StatusForbidden, apperr.SessionRequiredErrorMessage) + assertPlain(t, e.send(http.MethodPatch, "/v1/settings", body, asUser(e, activityUnverifiedID)), http.StatusForbidden, apperr.VerificationRequiredErrorMessage) + }) + + t.Run("A change is recorded as a system event by the owner", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 30}`, asUser(e, activityOwnerID)) + + events := e.all(t) + if len(events) != 1 { + t.Fatalf("expected one event, got %d", len(events)) + } + event := events[0] + if event.Action != "system.activity_retention_changed" || event.Category != audit.CategorySystem || event.Actor.Type != audit.ActorUser || *event.Actor.ID != activityOwnerID || event.Source != audit.SourceWeb || event.Outcome != audit.OutcomeSuccess || event.Security { + t.Errorf("unexpected event %+v", event) + } + if !reflect.DeepEqual(event.Params, map[string]any{"from": float64(90), "to": float64(30)}) { + t.Errorf("unexpected params %v", event.Params) + } + }) + + t.Run("Setting the same value records nothing", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 90}`, asUser(e, activityOwnerID)) + + if rec.Code != http.StatusOK || len(e.all(t)) != 0 { + t.Errorf("expected 200 and no event, got %d and %d events", rec.Code, len(e.all(t))) + } + }) +} + +func (e *activityHTTPEnv) events(t *testing.T, action string) []audit.Event { + t.Helper() + var matching []audit.Event + for _, event := range e.all(t) { + if event.Action == action { + matching = append(matching, event) + } + } + return matching +} + +func assertAuthEvent(t *testing.T, events []audit.Event, actorType audit.ActorType, name string, outcome audit.Outcome, security bool, reason *string) audit.Event { + t.Helper() + if len(events) != 1 { + t.Fatalf("expected exactly one event, got %d", len(events)) + } + event := events[0] + if event.Category != audit.CategoryAuth || event.Source != audit.SourceWeb || event.Actor.Type != actorType || event.Actor.Name != name || event.Outcome != outcome || event.Security != security { + t.Errorf("unexpected event %+v", event) + } + if (reason == nil) != (event.FailureReason == nil) || (reason != nil && *reason != *event.FailureReason) { + t.Errorf("unexpected failure reason %v", event.FailureReason) + } + if event.IP == nil || *event.IP != "203.0.113.12" || event.UserAgent == nil || *event.UserAgent != activityUserAgent { + t.Errorf("expected the request ip and user agent, got %v %v", event.IP, event.UserAgent) + } + return event +} + +func TestActivityLogBackendProducers(t *testing.T) { + login := func(e *activityHTTPEnv, username string, password string) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/login", fmt.Sprintf(`{"username":%q,"password":%q}`, username, password)) + } + + t.Run("Authentication events", func(t *testing.T) { + wrong := "Wrong username or password." + t.Run("login with the right username and password", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + login(e, "marta", activityPassword) + assertAuthEvent(t, e.events(t, "auth.login"), audit.ActorUser, "Marta Alves", audit.OutcomeSuccess, false, nil) + }) + t.Run("login with a wrong password", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + login(e, "marta", "wrongpassword1") + assertAuthEvent(t, e.events(t, "auth.login_failed"), audit.ActorAnonymous, "marta", audit.OutcomeFailed, true, &wrong) + }) + t.Run("login with an unknown username", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + login(e, "ghost", "wrongpassword1") + assertAuthEvent(t, e.events(t, "auth.login_failed"), audit.ActorAnonymous, "ghost", audit.OutcomeFailed, true, &wrong) + }) + t.Run("logout with a valid jwt cookie", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.send(http.MethodPost, "/v1/auth/logout", "", asUser(e, activityOwnerID)) + assertAuthEvent(t, e.events(t, "auth.logout"), audit.ActorUser, "Marta Alves", audit.OutcomeSuccess, false, nil) + }) + t.Run("password reset for an existing account", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"marta@example.com"}`) + assertAuthEvent(t, e.events(t, "auth.password_reset_requested"), audit.ActorUser, "Marta Alves", audit.OutcomeSuccess, true, nil) + }) + t.Run("password reset with a valid code", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"marta@example.com"}`) + code := e.mail.SentEmails[0].Data.(useCases.MailPasswordResetData).VerificationCode + rec := e.send(http.MethodPost, "/v1/auth/password-reset/confirm", fmt.Sprintf(`{"email":"marta@example.com","code":%q,"password":"brandnewpass1"}`, code)) + if rec.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String()) + } + assertAuthEvent(t, e.events(t, "auth.password_reset_completed"), audit.ActorUser, "Marta Alves", audit.OutcomeSuccess, true, nil) + }) + }) + + t.Run("A failed login reveals no more than the response does", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + login(e, "marta", "wrongpassword1") + login(e, "ghost", "wrongpassword1") + + events := e.events(t, "auth.login_failed") + + if len(events) != 2 || *events[0].FailureReason != *events[1].FailureReason || events[0].Actor.Type != audit.ActorAnonymous || events[1].Actor.Type != audit.ActorAnonymous || events[0].Target.Type != "" || events[1].Target.Type != "" { + t.Fatalf("unexpected events %+v", events) + } + stored, _ := json.Marshal(events) + if strings.Contains(string(stored), "wrongpassword1") || strings.Contains(e.logs.String(), "wrongpassword1") { + t.Error("the password reached the log") + } + }) + + t.Run("Nothing is recorded when nothing happened", func(t *testing.T) { + cases := map[string]func(*activityHTTPEnv) *httptest.ResponseRecorder{ + "POST /v1/auth/logout without a jwt cookie": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/logout", "") + }, + "POST /v1/auth/password-reset for an unknown email": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"nobody@example.com"}`) + }, + "POST /v1/auth/password-reset/confirm with an invalid code": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/password-reset/confirm", `{"email":"marta@example.com","code":"nope","password":"brandnewpass1"}`) + }, + "POST /v1/auth/login with a body that fails validation": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return login(e, "x", "short") + }, + } + for name, trigger := range cases { + t.Run(name, func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + trigger(e) + if got := e.all(t); len(got) != 0 { + t.Errorf("expected no event, got %+v", got) + } + }) + } + t.Run("POST /v1/auth/login answered 429 by the rate limiter", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1) + login(e, "marta", "wrongpassword1") + + rec := login(e, "marta", "wrongpassword1") + + if rec.Code != http.StatusTooManyRequests || len(e.all(t)) != 1 { + t.Errorf("expected 429 with only the first event, got %d and %d events", rec.Code, len(e.all(t))) + } + }) + }) + + t.Run("A reset event never holds the code", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"marta@example.com"}`) + code := e.mail.SentEmails[0].Data.(useCases.MailPasswordResetData).VerificationCode + e.send(http.MethodPost, "/v1/auth/password-reset/confirm", fmt.Sprintf(`{"email":"marta@example.com","code":%q,"password":"brandnewpass1"}`, code)) + + stored, _ := json.Marshal(e.all(t)) + everything := string(stored) + e.logs.String() + + for _, secret := range []string{code, "hashed:" + code, "brandnewpass1", "hashed:brandnewpass1"} { + if strings.Contains(everything, secret) { + t.Errorf("%q reached the log or an event", secret) + } + } + }) + + t.Run("Creating an API key is recorded", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.send(http.MethodPost, "/v1/api-key", `{"name":"Deploy bot"}`, asUser(e, activityOwnerID)) + + var created struct { + ID uint32 `json:"id"` + Key string `json:"key"` + } + _ = json.Unmarshal(rec.Body.Bytes(), &created) + events := e.events(t, "api_key.create") + if rec.Code != http.StatusCreated || len(events) != 1 { + t.Fatalf("unexpected result %d with %d events", rec.Code, len(events)) + } + event := events[0] + if event.Category != audit.CategoryAPIKeys || *event.Actor.ID != activityOwnerID || event.Source != audit.SourceWeb || event.Outcome != audit.OutcomeSuccess || event.Security { + t.Errorf("unexpected event %+v", event) + } + if event.Target != (audit.Target{Type: "api_key", ID: strconv.Itoa(int(created.ID)), Name: "Deploy bot"}) { + t.Errorf("unexpected target %+v", event.Target) + } + stored, _ := json.Marshal(e.all(t)) + listed := e.get("/v1/activity", asUser(e, activityOwnerID)).Body.String() + for _, secret := range []string{created.Key, e.generator.Hash(created.Key)} { + if strings.Contains(string(stored), secret) || strings.Contains(listed, secret) || strings.Contains(e.logs.String(), secret) { + t.Errorf("the key material %q reached the log or the activity API", secret) + } + } + }) + + t.Run("Revoking an API key is recorded", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + _, id := e.issueKey(t, activityOwnerID, "Deploy bot") + + rec := e.send(http.MethodDelete, "/v1/api-key/"+strconv.Itoa(int(id)), "", asUser(e, activityOwnerID)) + + events := e.events(t, "api_key.revoke") + if rec.Code != http.StatusNoContent || len(events) != 1 { + t.Fatalf("unexpected result %d with %d events", rec.Code, len(events)) + } + if events[0].Target != (audit.Target{Type: "api_key", ID: strconv.Itoa(int(id)), Name: "Deploy bot"}) || *events[0].Actor.ID != activityOwnerID || events[0].Outcome != audit.OutcomeSuccess { + t.Errorf("unexpected event %+v", events[0]) + } + }) + + t.Run("A revoke of an unknown key records nothing", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.send(http.MethodDelete, "/v1/api-key/99", "", asUser(e, activityOwnerID)) + + if rec.Code != http.StatusNotFound || len(e.all(t)) != 0 { + t.Errorf("expected 404 and no event, got %d and %d events", rec.Code, len(e.all(t))) + } + }) + + t.Run("The recorded events are readable through the API", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + login(e, "marta", "wrongpassword1") + e.send(http.MethodPost, "/v1/api-key", `{"name":"Deploy bot"}`, asUser(e, activityOwnerID)) + e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 30}`, asUser(e, activityOwnerID)) + + list := decodeActivityList(t, e.get("/v1/activity", asUser(e, activityOwnerID))) + + var actions []string + for _, item := range list.Items { + actions = append(actions, item["action"].(string)) + } + if !reflect.DeepEqual(actions, []string{"system.activity_retention_changed", "api_key.create", "auth.login_failed"}) { + t.Errorf("unexpected actions %v", actions) + } + secure := decodeActivityList(t, e.get("/v1/activity?security=true", asUser(e, activityOwnerID))) + if len(secure.Items) != 1 || secure.Items[0]["action"] != "auth.login_failed" { + t.Errorf("expected only the failed login, got %v", secure.Items) + } + }) +} + +func TestActivityLogBackendRecorderResilience(t *testing.T) { + t.Run("A failing repository does not change the caller's result", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.probe.appendErr = errDiskFull + + rec := e.send(http.MethodPost, "/v1/auth/login", fmt.Sprintf(`{"username":"marta","password":%q}`, activityPassword)) + + if rec.Code != http.StatusOK || !strings.Contains(strings.Join(rec.Header().Values("Set-Cookie"), ";"), "jwt=") { + t.Fatalf("expected 200 with a jwt cookie, got %d %v", rec.Code, rec.Header()) + } + if !strings.Contains(rec.Body.String(), "User logged in!") { + t.Errorf("unexpected body %q", rec.Body.String()) + } + if !strings.Contains(e.logs.String(), "auth.login") || !strings.Contains(e.logs.String(), "disk full") { + t.Errorf("expected a log line naming the failed write, got %q", e.logs.String()) + } + }) + + t.Run("A panicking repository does not crash the request", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + e.probe.appendPanic = true + + rec := e.send(http.MethodPost, "/v1/auth/logout", "", asUser(e, activityOwnerID)) + + if rec.Code != http.StatusOK { + t.Errorf("expected 200, got %d", rec.Code) + } + if again := e.get("/v1/activity", asUser(e, activityOwnerID)); again.Code != http.StatusOK { + t.Errorf("the process must keep serving, got %d", again.Code) + } + }) +} + +type auditOriginProbe struct { + origin audit.Origin + seen bool +} + +func TestActivityLogBackendAuditContext(t *testing.T) { + newProbeRouter := func(t *testing.T, e *activityHTTPEnv, trusted []string) (http.Handler, *auditOriginProbe) { + t.Helper() + probe := &auditOriginProbe{} + r := chi.NewRouter() + r.Use(jwtauth.Verifier(e.token)) + r.Use(middleware.APIKeyAuth(useCases.NewAuthenticateAPIKeyUseCase(e.keys, e.generator, e.users, e.clock), 100, time.Minute)) + r.Use(middleware.AuditContext(useCases.NewGetUserUseCase(e.users), trusted)) + r.Get("/probe", func(w http.ResponseWriter, req *http.Request) { + probe.origin, probe.seen = audit.OriginFrom(req.Context()) + }) + return r, probe + } + run := func(router http.Handler, mutate func(*http.Request)) { + req := httptest.NewRequest(http.MethodGet, "/probe", nil) + req.RemoteAddr = "198.51.100.9:443" + mutate(req) + router.ServeHTTP(httptest.NewRecorder(), req) + } + + t.Run("A session sets a user actor with source web", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + router, probe := newProbeRouter(t, e, nil) + + run(router, func(r *http.Request) { asUser(e, activityOwnerID)(r) }) + + if !probe.seen || probe.origin.Actor.Type != audit.ActorUser || *probe.origin.Actor.ID != activityOwnerID || probe.origin.Actor.Name != "Marta Alves" || probe.origin.Source != audit.SourceWeb { + t.Errorf("unexpected origin %+v", probe.origin) + } + }) + + t.Run("An API key sets an api_key actor with source api_key", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + raw, id := e.issueKey(t, activityOwnerID, "Deploy bot") + router, probe := newProbeRouter(t, e, nil) + + run(router, func(r *http.Request) { withBearer(raw)(r) }) + + if probe.origin.Actor.Type != audit.ActorAPIKey || *probe.origin.Actor.ID != id || probe.origin.Actor.Name != "Deploy bot" || probe.origin.Source != audit.SourceAPIKey { + t.Errorf("unexpected origin %+v", probe.origin) + } + }) + + t.Run("No credentials sets an anonymous actor", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + router, probe := newProbeRouter(t, e, nil) + + run(router, func(r *http.Request) {}) + + if probe.origin.Actor.Type != audit.ActorAnonymous || probe.origin.Source != audit.SourceWeb { + t.Errorf("unexpected origin %+v", probe.origin) + } + }) + + t.Run("A stale session sets an anonymous actor", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + u := e.users.users[activityOwnerID] + u.TokenVersion = 5 + e.users.users[activityOwnerID] = u + router, probe := newProbeRouter(t, e, nil) + + run(router, func(r *http.Request) { asUser(e, activityOwnerID)(r) }) + + if probe.origin.Actor.Type != audit.ActorAnonymous { + t.Errorf("unexpected origin %+v", probe.origin) + } + }) + + t.Run("The ip comes from the trusted-proxy real IP only", func(t *testing.T) { + cases := []struct{ peer, header, ip string }{ + {"10.0.0.5:443", "203.0.113.12", "203.0.113.12"}, + {"198.51.100.9:443", "203.0.113.12", "198.51.100.9"}, + {"198.51.100.9:443", "", "198.51.100.9"}, + } + for _, c := range cases { + e := newActivityHTTPEnv(t, 1000) + router, probe := newProbeRouter(t, e, []string{"10.0.0.5"}) + + run(router, func(r *http.Request) { + r.RemoteAddr = c.peer + if c.header != "" { + r.Header.Set("X-Real-IP", c.header) + } + }) + + if probe.origin.IP != c.ip { + t.Errorf("peer %s header %q: expected %s, got %s", c.peer, c.header, c.ip, probe.origin.IP) + } + } + }) + + t.Run("The user agent is stored as sent and bounded", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + router, probe := newProbeRouter(t, e, nil) + long := strings.Repeat("a", 400) + + run(router, func(r *http.Request) { r.Header.Set("User-Agent", long) }) + + if probe.origin.UserAgent != long[:255] { + t.Errorf("expected the first 255 characters, got %d", len(probe.origin.UserAgent)) + } + }) +} diff --git a/test/activity_log_backend_qa_test.go b/test/activity_log_backend_qa_test.go new file mode 100644 index 0000000..979a1c2 --- /dev/null +++ b/test/activity_log_backend_qa_test.go @@ -0,0 +1,173 @@ +package test + +import ( + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "regexp" + "strconv" + "strings" + "testing" +) + +func TestActivityLogBackendQAResetResponseIsIndistinguishable(t *testing.T) { + t.Run("unknown email answers the same bytes as an existing account", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + known := e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"marta@example.com"}`) + unknown := e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"nobody@example.com"}`) + + if known.Code != unknown.Code || known.Body.String() != unknown.Body.String() { + t.Errorf("responses differ: %d %q versus %d %q", known.Code, known.Body.String(), unknown.Code, unknown.Body.String()) + } + }) +} + +func TestActivityLogBackendQAProducersSurviveRecorderFailure(t *testing.T) { + type producer func(e *activityHTTPEnv) *httptest.ResponseRecorder + producers := map[string]producer{ + "login failure": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/login", `{"username":"marta","password":"wrongpassword1"}`) + }, + "logout": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/logout", "", asUser(e, activityOwnerID)) + }, + "password reset request": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/auth/password-reset", `{"email":"marta@example.com"}`) + }, + "api key creation": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPost, "/v1/api-key", `{"name":"Deploy bot"}`, asUser(e, activityOwnerID)) + }, + "api key revoke": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + _, id := e.issueKey(t, activityOwnerID, "Deploy bot") + return e.send(http.MethodDelete, "/v1/api-key/"+strconv.Itoa(int(id)), "", asUser(e, activityOwnerID)) + }, + "retention change": func(e *activityHTTPEnv) *httptest.ResponseRecorder { + return e.send(http.MethodPatch, "/v1/settings", `{"activity_retention_days": 30}`, asUser(e, activityOwnerID)) + }, + } + scrub := regexp.MustCompile(`"(id|key|prefix|created_at)":\s*("[^"]*"|[0-9]+)`) + for name, run := range producers { + t.Run(name, func(t *testing.T) { + healthy := run(newActivityHTTPEnv(t, 1000)) + broken := newActivityHTTPEnv(t, 1000) + broken.probe.appendErr = errDiskFull + + got := run(broken) + + if got.Code != healthy.Code || scrub.ReplaceAllString(got.Body.String(), "") != scrub.ReplaceAllString(healthy.Body.String(), "") { + t.Errorf("a failing recorder changed the answer: %d %q versus %d %q", got.Code, got.Body.String(), healthy.Code, healthy.Body.String()) + } + }) + } +} + +func TestActivityLogBackendQAGuards(t *testing.T) { + read := func(t *testing.T, root string, suffix string) map[string]string { + t.Helper() + files := map[string]string{} + err := filepath.Walk(filepath.Join("..", root), func(path string, info os.FileInfo, err error) error { + if err != nil || info.IsDir() || !strings.HasSuffix(path, suffix) { + return err + } + content, readErr := os.ReadFile(path) + files[path] = string(content) + return readErr + }) + if err != nil { + t.Fatal(err) + } + if len(files) == 0 { + t.Fatalf("no files under %s", root) + } + return files + } + + t.Run("The audit repository source uses no dialect specific SQL", func(t *testing.T) { + for path, source := range read(t, "internal/infrastructure/persistence/repositories", ".go") { + if !strings.Contains(filepath.Base(path), "audit") { + continue + } + for _, banned := range []string{"ILIKE", "strftime", "date_trunc"} { + if strings.Contains(source, banned) { + t.Errorf("%s contains %s", path, banned) + } + } + } + }) + + t.Run("The audit domain imports only the stdlib and domain packages", func(t *testing.T) { + importLine := regexp.MustCompile(`(?m)^\s*"([^"]+)"$`) + for path, source := range read(t, "internal/domain/audit", ".go") { + for _, match := range importLine.FindAllStringSubmatch(source, -1) { + if strings.Contains(match[1], ".") && !strings.HasPrefix(match[1], "RenewCMS/internal/domain/") { + t.Errorf("%s imports %s", path, match[1]) + } + if strings.HasPrefix(match[1], "RenewCMS/") && !strings.HasPrefix(match[1], "RenewCMS/internal/domain/") { + t.Errorf("%s imports %s", path, match[1]) + } + } + } + }) + + t.Run("The activity use cases and handlers keep their layering", func(t *testing.T) { + banned := []string{"gorm.io", "infrastructure/persistence", "infrastructure/mailer", "net/http", "go-chi", "RenewCMS/api"} + for path, source := range read(t, "internal/infrastructure/useCases", ".go") { + base := filepath.Base(path) + if !strings.Contains(base, "Activity") && !strings.Contains(base, "activity") { + continue + } + for _, word := range banned { + if strings.Contains(source, word+`"`) || strings.Contains(source, `"`+word) { + t.Errorf("%s imports %s", path, word) + } + } + } + for path, source := range read(t, "api/handlers/activity", ".go") { + for _, word := range []string{"gorm.io", "persistence", "infrastructure/mailer"} { + if strings.Contains(source, word) { + t.Errorf("%s references %s", path, word) + } + } + } + }) + + t.Run("The persistence repository asserts the audit contract", func(t *testing.T) { + for path, source := range read(t, "internal/infrastructure/persistence/repositories", "auditEventRepository.go") { + if !strings.Contains(source, "var _ audit.Repository = &") { + t.Errorf("%s lacks the interface assertion", path) + } + } + }) + + t.Run("The new Go files hold no comment", func(t *testing.T) { + line := regexp.MustCompile(`(?m)^\s*//`) + for _, root := range []string{"internal/domain/audit", "internal/infrastructure/auditing", "api/handlers/activity"} { + for path, source := range read(t, root, ".go") { + if line.MatchString(source) { + t.Errorf("%s holds a comment", path) + } + } + } + }) + + t.Run("The docs describe the activity surface", func(t *testing.T) { + wants := map[string][]string{ + "docs/api.md": {"/v1/activity", "/v1/activity/summary", "/v1/activity/export", "activity_retention_days"}, + "docs/architecture.md": {"audit"}, + "docs/configuration.md": {"retention"}, + } + for doc, needles := range wants { + content, err := os.ReadFile(filepath.Join("..", doc)) + if err != nil { + t.Fatal(err) + } + for _, needle := range needles { + if !strings.Contains(string(content), needle) { + t.Errorf("%s does not mention %s", doc, needle) + } + } + } + }) +} diff --git a/test/activity_persistence_test.go b/test/activity_persistence_test.go new file mode 100644 index 0000000..d08bf00 --- /dev/null +++ b/test/activity_persistence_test.go @@ -0,0 +1,400 @@ +package test + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/persistence/database" + persistence "RenewCMS/internal/infrastructure/persistence/repositories" + "encoding/json" + "fmt" + "reflect" + "sort" + "strings" + "sync/atomic" + "testing" + "time" + + "github.com/glebarez/sqlite" + "gorm.io/gorm" + "gorm.io/gorm/logger" +) + +var activityDatabaseCounter atomic.Int64 + +func openActivityDatabase(t *testing.T) *gorm.DB { + t.Helper() + name := fmt.Sprintf("file:activity%d?mode=memory&cache=shared", activityDatabaseCounter.Add(1)) + db, err := gorm.Open(sqlite.Open(name), &gorm.Config{Logger: logger.Discard}) + if err != nil { + t.Fatalf("failed to open the in-memory database: %v", err) + } + if err := database.Migrate(db); err != nil { + t.Fatalf("failed to migrate: %v", err) + } + t.Cleanup(func() { + if sqlDb, err := db.DB(); err == nil { + _ = sqlDb.Close() + } + }) + return db +} + +func activityPtr[T any](value T) *T { return &value } + +func activityUserEvent(userID uint32, name string, at time.Time) audit.Event { + event := audit.NewEvent("article.publish", audit.CategoryArticles) + event.CreatedAt = at + event.Actor = audit.Actor{Type: audit.ActorUser, ID: activityPtr(userID), Name: name} + event.Source = audit.SourceWeb + return event +} + +func activityMustAppend(t *testing.T, repo audit.Repository, event audit.Event) audit.Event { + t.Helper() + stored, err := repo.Append(event) + if err != nil { + t.Fatalf("append failed: %v", err) + } + return stored +} + +func activityIDs(events []audit.Event) []uint64 { + ids := make([]uint64, 0, len(events)) + for _, event := range events { + ids = append(ids, event.ID) + } + return ids +} + +func activityDay(day int, hour int) time.Time { + return time.Date(2026, time.October, day, hour, 0, 0, 0, time.UTC) +} + +func TestActivityPersistence(t *testing.T) { + t.Run("The model is migrated with its indexes", func(t *testing.T) { + db := openActivityDatabase(t) + + if !db.Migrator().HasTable("audit_events") { + t.Fatal("the audit events table does not exist") + } + var names []string + if err := db.Raw("SELECT name FROM sqlite_master WHERE type = 'index' AND tbl_name = 'audit_events'").Scan(&names).Error; err != nil { + t.Fatal(err) + } + found := map[string]bool{} + for _, name := range names { + var columns []struct { + Name string + } + if err := db.Raw("SELECT name FROM pragma_index_info(?) ORDER BY seqno", name).Scan(&columns).Error; err != nil { + t.Fatal(err) + } + parts := make([]string, 0, len(columns)) + for _, column := range columns { + parts = append(parts, column.Name) + } + found[strings.Join(parts, ",")] = true + } + for _, wanted := range []string{"created_at", "actor_type,actor_id,created_at", "category,created_at"} { + if !found[wanted] { + t.Errorf("missing index on (%s), have %v", wanted, found) + } + } + }) + + t.Run("The persistence implementation exposes no other exported method than the contract", func(t *testing.T) { + repoType := reflect.TypeOf(persistence.NewAuditEventRepository(nil)) + var names []string + for i := 0; i < repoType.NumMethod(); i++ { + names = append(names, repoType.Method(i).Name) + } + sort.Strings(names) + wanted := []string{"Append", "DeleteOlderThan", "List", "Summary"} + if !reflect.DeepEqual(names, wanted) { + t.Errorf("expected %v, got %v", wanted, names) + } + }) + + t.Run("An appended event round-trips", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + event := audit.NewEvent("media.purge", audit.CategoryMedia) + event.CreatedAt = time.Date(2026, time.October, 6, 10, 42, 18, 0, time.UTC) + event.Actor = audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(3)), Name: "Marta Alves"} + event.Target = audit.Target{Type: "article", ID: "8", Name: "Spring release"} + event.Source = audit.SourceWeb + event.IP = activityPtr("203.0.113.12") + event.UserAgent = activityPtr("Chrome 129 on Windows") + event.Security = true + event.Params = map[string]any{"merged": 3} + event.Changes = []audit.Change{ + {Field: "online", Kind: audit.ChangeText, Before: activityPtr("false"), After: activityPtr("true")}, + {Field: "body", Kind: audit.ChangeBody, Delta: activityPtr(312)}, + } + + stored := activityMustAppend(t, repo, event) + page, err := repo.List(audit.Filter{Page: 1, Size: 25}) + + if err != nil || page.Total != 1 || len(page.Items) != 1 { + t.Fatalf("unexpected list: %+v, %v", page, err) + } + event.ID = stored.ID + want, _ := json.Marshal(event) + got, _ := json.Marshal(page.Items[0]) + if string(want) != string(got) { + t.Errorf("round trip mismatch\nwant %s\ngot %s", want, got) + } + if page.Items[0].FailureReason != nil { + t.Errorf("failure_reason must stay null, got %v", *page.Items[0].FailureReason) + } + }) + + t.Run("A system event keeps its null actor id, ip and user agent", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + event := audit.NewEvent(audit.ActionCleanup, audit.CategorySystem) + event.CreatedAt = activityDay(6, 3) + event.Actor = audit.SystemActor() + event.Source = audit.SourceSystem + + activityMustAppend(t, repo, event) + page, _ := repo.List(audit.Filter{Page: 1, Size: 25}) + + item := page.Items[0] + if item.Actor.ID != nil || item.IP != nil || item.UserAgent != nil || item.Actor.Name != "System" { + t.Errorf("unexpected system event %+v", item) + } + }) + + t.Run("List sorts by created_at descending then id descending", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + older := activityMustAppend(t, repo, activityUserEvent(1, "a", activityDay(1, 9))) + var same []uint64 + for i := 0; i < 3; i++ { + same = append(same, activityMustAppend(t, repo, activityUserEvent(1, "a", activityDay(2, 9))).ID) + } + + page, err := repo.List(audit.Filter{Page: 1, Size: 25}) + + if err != nil { + t.Fatal(err) + } + want := []uint64{same[2], same[1], same[0], older.ID} + if !reflect.DeepEqual(activityIDs(page.Items), want) { + t.Errorf("expected %v, got %v", want, activityIDs(page.Items)) + } + }) + + t.Run("Filters narrow the list and the total", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + add := func(mutate func(*audit.Event)) uint64 { + event := activityUserEvent(1, "Someone", activityDay(2, 9)) + mutate(&event) + return activityMustAppend(t, repo, event).ID + } + user3 := add(func(e *audit.Event) { + e.Actor = audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(3)), Name: "Marta"} + }) + user3Id7 := add(func(e *audit.Event) { + e.Actor = audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(7)), Name: "Seven"} + }) + key7 := add(func(e *audit.Event) { + e.Actor = audit.Actor{Type: audit.ActorAPIKey, ID: activityPtr(uint32(7)), Name: "Deploy bot"} + e.Source = audit.SourceAPIKey + }) + system := add(func(e *audit.Event) { + e.Actor = audit.SystemActor() + e.Source = audit.SourceSystem + e.Category = audit.CategorySystem + }) + authFailed := add(func(e *audit.Event) { + e.Actor = audit.AnonymousActor("mallory") + e.Category = audit.CategoryAuth + e.Outcome = audit.OutcomeFailed + e.Security = true + }) + spring := add(func(e *audit.Event) { e.Target = audit.Target{Type: "article", ID: "8", Name: "Spring release"} }) + percent := add(func(e *audit.Event) { e.Target = audit.Target{Type: "article", ID: "9", Name: "Sale 50%_ off"} }) + plain := add(func(e *audit.Event) { e.Target = audit.Target{Type: "article", ID: "10", Name: "Sale 505 off"} }) + oct1 := add(func(e *audit.Event) { e.CreatedAt = time.Date(2026, time.October, 1, 0, 0, 0, 0, time.UTC) }) + oct3end := add(func(e *audit.Event) { e.CreatedAt = time.Date(2026, time.October, 3, 23, 59, 59, 0, time.UTC) }) + oct4 := add(func(e *audit.Event) { e.CreatedAt = time.Date(2026, time.October, 4, 0, 0, 0, 0, time.UTC) }) + sep30 := add(func(e *audit.Event) { e.CreatedAt = time.Date(2026, time.September, 30, 23, 59, 59, 0, time.UTC) }) + base := add(func(e *audit.Event) {}) + + everyone := []uint64{user3, user3Id7, key7, system, authFailed, spring, percent, plain, oct1, oct3end, oct4, sep30, base} + sort.Slice(everyone, func(i, j int) bool { return everyone[i] < everyone[j] }) + from := time.Date(2026, time.October, 1, 0, 0, 0, 0, time.UTC) + to := time.Date(2026, time.October, 4, 0, 0, 0, 0, time.UTC) + cases := []struct { + name string + filter audit.Filter + want []uint64 + }{ + {"actor user:3", audit.Filter{Actor: &audit.ActorRef{Type: audit.ActorUser, ID: activityPtr(uint32(3))}}, []uint64{user3}}, + {"actor key:7", audit.Filter{Actor: &audit.ActorRef{Type: audit.ActorAPIKey, ID: activityPtr(uint32(7))}}, []uint64{key7}}, + {"actor system", audit.Filter{Actor: &audit.ActorRef{Type: audit.ActorSystem}}, []uint64{system}}, + {"category auth", audit.Filter{Category: audit.CategoryAuth}, []uint64{authFailed}}, + {"outcome failed", audit.Filter{Outcome: audit.OutcomeFailed}, []uint64{authFailed}}, + {"outcome success", audit.Filter{Outcome: audit.OutcomeSuccess}, withoutIDs(everyone, authFailed)}, + {"security true", audit.Filter{Security: true}, []uint64{authFailed}}, + {"q SPRING", audit.Filter{Query: "SPRING"}, []uint64{spring}}, + {"q actor name", audit.Filter{Query: "marta"}, []uint64{user3}}, + {"q 50%_", audit.Filter{Query: "50%_"}, []uint64{percent}}, + {"date range", audit.Filter{From: &from, To: &to}, []uint64{user3, user3Id7, key7, system, authFailed, spring, percent, plain, oct1, oct3end, base}}, + } + for _, c := range cases { + t.Run(c.name, func(t *testing.T) { + filter := c.filter + filter.Page, filter.Size = 1, 100 + page, err := repo.List(filter) + if err != nil { + t.Fatal(err) + } + got := activityIDs(page.Items) + sort.Slice(got, func(i, j int) bool { return got[i] < got[j] }) + want := append([]uint64(nil), c.want...) + sort.Slice(want, func(i, j int) bool { return want[i] < want[j] }) + if !reflect.DeepEqual(got, want) || page.Total != len(want) { + t.Errorf("expected %v (total %d), got %v (total %d)", want, len(want), got, page.Total) + } + }) + } + }) + + t.Run("Paging slices the sorted list and total is the unpaged count", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + var ids []uint64 + for i := 0; i < 60; i++ { + ids = append(ids, activityMustAppend(t, repo, activityUserEvent(1, "a", activityDay(2, 9).Add(time.Duration(i)*time.Minute))).ID) + } + + page, err := repo.List(audit.Filter{Page: 2, Size: 25}) + + if err != nil || len(page.Items) != 25 || page.Total != 60 { + t.Fatalf("unexpected page: %d items, total %d, %v", len(page.Items), page.Total, err) + } + if page.Items[0].ID != ids[34] || page.Items[24].ID != ids[10] { + t.Errorf("expected the 26th to 50th of the sorted list, got %d..%d", page.Items[0].ID, page.Items[24].ID) + } + past, _ := repo.List(audit.Filter{Page: 9, Size: 25}) + if len(past.Items) != 0 || past.Total != 60 { + t.Errorf("expected an empty page with total 60, got %d items, total %d", len(past.Items), past.Total) + } + }) + + t.Run("The summary counts the range and the previous period", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + now := activityDay(8, 12) + at := func(daysAgo int, extra time.Duration) time.Time { + return now.Add(-time.Duration(daysAgo)*24*time.Hour + extra) + } + add := func(when time.Time, mutate func(*audit.Event)) { + event := activityUserEvent(1, "one", when) + mutate(&event) + activityMustAppend(t, repo, event) + } + none := func(*audit.Event) {} + add(at(0, -time.Hour), none) + add(at(0, -2*time.Hour), func(e *audit.Event) { e.Outcome = audit.OutcomeFailed }) + add(at(1, -time.Hour), func(e *audit.Event) { + e.Actor = audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(2)), Name: "two"} + e.Security = true + }) + add(at(3, -time.Hour), func(e *audit.Event) { + e.Actor = audit.Actor{Type: audit.ActorAPIKey, ID: activityPtr(uint32(9)), Name: "bot"} + }) + add(at(6, -time.Hour), func(e *audit.Event) { + e.Actor = audit.AnonymousActor("x") + e.Outcome = audit.OutcomeFailed + e.Security = true + }) + add(at(6, -2*time.Hour), func(e *audit.Event) { e.Actor = audit.SystemActor() }) + for i := 0; i < 4; i++ { + add(at(8+i, 0), none) + } + + summary, err := repo.Summary(audit.SummaryQuery{From: now.Add(-7 * 24 * time.Hour), To: now}) + + if err != nil { + t.Fatal(err) + } + if summary.Total != 6 || summary.PreviousTotal != 4 || summary.Failed != 2 || summary.Security != 2 { + t.Errorf("unexpected counts %+v", summary) + } + if summary.ActivePeople.Users != 2 || summary.ActivePeople.APIKeys != 1 { + t.Errorf("unexpected active people %+v", summary.ActivePeople) + } + wantTotal := []int{2, 0, 0, 1, 0, 1, 2} + if !reflect.DeepEqual(summary.Series.Total, wantTotal) { + t.Errorf("expected total series %v, got %v", wantTotal, summary.Series.Total) + } + if !reflect.DeepEqual(summary.Series.Failed, []int{1, 0, 0, 0, 0, 0, 1}) || !reflect.DeepEqual(summary.Series.Security, []int{1, 0, 0, 0, 0, 1, 0}) { + t.Errorf("unexpected failed %v or security %v series", summary.Series.Failed, summary.Series.Security) + } + if !reflect.DeepEqual(summary.Series.Active, []int{0, 0, 0, 1, 0, 1, 1}) { + t.Errorf("unexpected active series %v", summary.Series.Active) + } + }) + + t.Run("DeleteOlderThan removes only events before the cutoff", func(t *testing.T) { + repo := persistence.NewAuditEventRepository(openActivityDatabase(t)) + now := activityDay(20, 12) + for _, days := range []int{100, 40, 31, 29, 1} { + activityMustAppend(t, repo, activityUserEvent(1, "a", now.Add(-time.Duration(days)*24*time.Hour))) + } + + removed, err := repo.DeleteOlderThan(now.Add(-30 * 24 * time.Hour)) + + if err != nil || removed != 3 { + t.Fatalf("expected 3 removed, got %d, %v", removed, err) + } + page, _ := repo.List(audit.Filter{Page: 1, Size: 25}) + if page.Total != 2 { + t.Errorf("expected 2 events left, got %d", page.Total) + } + }) +} + +func TestActivitySettingsPersistence(t *testing.T) { + t.Run("No row means the default", func(t *testing.T) { + repo := persistence.NewAuditSettingsRepository(openActivityDatabase(t)) + + settings, err := repo.Get() + + if err != nil || settings.RetentionDays != 90 || settings.LastCleanupAt != nil || settings.LastCleanupRemoved != 0 { + t.Errorf("unexpected default %+v, %v", settings, err) + } + }) + + t.Run("The retention and the last cleanup are stored independently", func(t *testing.T) { + repo := persistence.NewAuditSettingsRepository(openActivityDatabase(t)) + at := time.Date(2026, time.October, 6, 3, 0, 0, 0, time.UTC) + + if err := repo.SaveLastCleanup(at, 142); err != nil { + t.Fatal(err) + } + settings, _ := repo.Get() + if settings.RetentionDays != 90 || settings.LastCleanupAt == nil || !settings.LastCleanupAt.Equal(at) || settings.LastCleanupRemoved != 142 { + t.Fatalf("unexpected settings %+v", settings) + } + if err := repo.SaveRetention(0); err != nil { + t.Fatal(err) + } + settings, _ = repo.Get() + if settings.RetentionDays != 0 || settings.LastCleanupRemoved != 142 { + t.Errorf("forever must be stored as 0 and keep the last cleanup, got %+v", settings) + } + }) +} + +func withoutIDs(ids []uint64, excluded ...uint64) []uint64 { + var kept []uint64 + for _, id := range ids { + skip := false + for _, other := range excluded { + skip = skip || id == other + } + if !skip { + kept = append(kept, id) + } + } + return kept +} diff --git a/test/activity_recorder_test.go b/test/activity_recorder_test.go new file mode 100644 index 0000000..1bdba1c --- /dev/null +++ b/test/activity_recorder_test.go @@ -0,0 +1,108 @@ +package test + +import ( + "RenewCMS/internal/domain/audit" + "strings" + "testing" + "time" +) + +func TestActivityRecorder(t *testing.T) { + t.Run("A failing repository does not fail the caller and the failure is logged", func(t *testing.T) { + h := newActivityHarness(t) + h.probe.appendErr = errDiskFull + + h.recorder.Record(testCtx, activityValidEvent()) + + logs := h.logs.String() + if !strings.Contains(logs, "audit.test") || !strings.Contains(logs, "disk full") { + t.Errorf("expected a log line naming the write and the error, got %q", logs) + } + }) + + t.Run("A panicking repository does not crash the caller", func(t *testing.T) { + h := newActivityHarness(t) + h.probe.appendPanic = true + + h.recorder.Record(testCtx, activityValidEvent()) + + if !strings.Contains(h.logs.String(), "panicked") { + t.Errorf("expected the panic to be logged, got %q", h.logs.String()) + } + }) + + t.Run("The recorder fills the event from the audit context", func(t *testing.T) { + h := newActivityHarness(t) + h.now = time.Date(2026, time.October, 6, 14, 0, 0, 0, time.FixedZone("CEST", 2*3600)) + ctx := audit.WithOrigin(testCtx, audit.Origin{ + Actor: audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(3)), Name: "marta"}, + Source: audit.SourceWeb, + IP: "203.0.113.12", + UserAgent: "Mozilla/5.0 test", + }) + event := audit.NewEvent("audit.test", audit.CategorySystem) + + h.recorder.Record(ctx, event) + + stored := h.all(t) + if len(stored) != 1 { + t.Fatalf("expected one event, got %d", len(stored)) + } + got := stored[0] + if got.Actor.Type != audit.ActorUser || *got.Actor.ID != 3 || got.Actor.Name != "marta" || got.Source != audit.SourceWeb { + t.Errorf("unexpected actor or source %+v", got) + } + if got.IP == nil || *got.IP != "203.0.113.12" || got.UserAgent == nil || *got.UserAgent != "Mozilla/5.0 test" { + t.Errorf("unexpected ip or user agent %v %v", got.IP, got.UserAgent) + } + if !got.CreatedAt.Equal(h.now) || got.CreatedAt.Location() != time.UTC { + t.Errorf("expected created_at %v in UTC, got %v", h.now.UTC(), got.CreatedAt) + } + }) + + t.Run("Values already on the event are kept", func(t *testing.T) { + h := newActivityHarness(t) + ctx := audit.WithOrigin(testCtx, audit.Origin{Actor: audit.AnonymousActor("x"), Source: audit.SourceWeb, IP: "203.0.113.12", UserAgent: "ua"}) + event := audit.NewEvent(audit.ActionCleanup, audit.CategorySystem) + event.Actor = audit.SystemActor() + event.Source = audit.SourceSystem + + h.recorder.Record(ctx, event) + + got := h.all(t)[0] + if got.Actor.Type != audit.ActorSystem || got.Source != audit.SourceSystem { + t.Errorf("the explicit actor and source must win, got %+v", got) + } + }) + + t.Run("An event outside the vocabulary is dropped and logged", func(t *testing.T) { + h := newActivityHarness(t) + event := activityValidEvent() + event.Category = "billing" + + h.recorder.Record(testCtx, event) + + if len(h.all(t)) != 0 || !strings.Contains(h.logs.String(), "dropped") { + t.Errorf("expected nothing stored and a log line, got %q", h.logs.String()) + } + }) + + t.Run("Long names are bounded", func(t *testing.T) { + h := newActivityHarness(t) + event := activityValidEvent() + event.Target = audit.Target{Type: "article", ID: "1", Name: strings.Repeat("é", 400)} + + h.recorder.Record(testCtx, event) + + if got := h.all(t); len(got) != 1 || len([]rune(got[0].Target.Name)) != 255 { + t.Errorf("expected one event with a 255 character target name, got %+v", got) + } + }) +} + +func activityValidEvent() audit.Event { + event := audit.NewEvent("audit.test", audit.CategorySystem) + event.Actor = audit.SystemActor() + event.Source = audit.SourceSystem + return event +} diff --git a/test/activity_retention_test.go b/test/activity_retention_test.go new file mode 100644 index 0000000..d17f4c7 --- /dev/null +++ b/test/activity_retention_test.go @@ -0,0 +1,343 @@ +package test + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/scheduler" + "RenewCMS/internal/infrastructure/useCases" + "context" + "errors" + "log" + "strings" + "testing" + "time" +) + +func TestActivityRetentionUseCases(t *testing.T) { + ownerCtx := activityOwnerCtx + + t.Run("The default is 90 days with no cleanup yet", func(t *testing.T) { + h := newActivityHarness(t) + + settings, err := useCases.NewGetActivityRetentionUseCase(h.settings).GetActivityRetention() + + if err != nil || settings.RetentionDays != 90 || settings.LastCleanupAt != nil || settings.LastCleanupRemoved != 0 { + t.Errorf("unexpected default %+v, %v", settings, err) + } + }) + + t.Run("The owner sets a valid period", func(t *testing.T) { + for _, days := range []int{30, 90, 365, 0} { + h := newActivityHarness(t) + + settings, err := useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder).UpdateActivityRetention(ownerCtx(), days) + + if err != nil || settings.RetentionDays != days || h.settings.settings.RetentionDays != days { + t.Errorf("%d: unexpected result %+v, %v", days, settings, err) + } + } + }) + + t.Run("Any other value is refused and changes nothing", func(t *testing.T) { + for _, days := range []int{7, -1, 366} { + h := newActivityHarness(t) + + _, err := useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder).UpdateActivityRetention(ownerCtx(), days) + + if !errors.Is(err, audit.ErrInvalidRetention) || h.settings.settings.RetentionDays != 90 || len(h.all(t)) != 0 { + t.Errorf("%d: expected a refusal, got %v", days, err) + } + } + }) + + t.Run("A change is recorded as a system event by the owner", func(t *testing.T) { + h := newActivityHarness(t) + + _, err := useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder).UpdateActivityRetention(ownerCtx(), 30) + + events := h.all(t) + if err != nil || len(events) != 1 { + t.Fatalf("expected one event, got %d, %v", len(events), err) + } + event := events[0] + if event.Action != "system.activity_retention_changed" || event.Category != audit.CategorySystem || event.Actor.Name != "owner" || event.Source != audit.SourceWeb || event.Outcome != audit.OutcomeSuccess || event.Security { + t.Errorf("unexpected event %+v", event) + } + if event.Params["from"] != float64(90) || event.Params["to"] != float64(30) { + t.Errorf("unexpected params %v", event.Params) + } + }) + + t.Run("Setting the same value records nothing", func(t *testing.T) { + h := newActivityHarness(t) + + settings, err := useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder).UpdateActivityRetention(ownerCtx(), 90) + + if err != nil || settings.RetentionDays != 90 || len(h.all(t)) != 0 || h.settings.retentionOK != 0 { + t.Errorf("expected no event and no write, got %v", err) + } + }) + + t.Run("A failing save is returned and records nothing", func(t *testing.T) { + h := newActivityHarness(t) + h.settings.saveErr = errRepositoryFailure + + _, err := useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder).UpdateActivityRetention(ownerCtx(), 30) + + if !errors.Is(err, errRepositoryFailure) || len(h.all(t)) != 0 { + t.Errorf("expected the failure and no event, got %v", err) + } + }) +} + +func cleanupAt(day int, hour int, minute int) time.Time { + return time.Date(2026, time.October, day, hour, minute, 0, 0, time.UTC) +} + +func activityOwnerCtx() context.Context { + return audit.WithOrigin(testCtx, audit.Origin{ + Actor: audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(1)), Name: "owner"}, + Source: audit.SourceWeb, + }) +} + +func newCleanup(h *activityHarness) *useCases.CleanupActivityUseCase { + return useCases.NewCleanupActivityUseCase(h.probe, h.settings, h.recorder) +} + +func TestActivityCleanupUseCase(t *testing.T) { + t.Run("The cleanup is due once a day at or after 03:00", func(t *testing.T) { + cases := []struct { + name string + last *time.Time + now time.Time + ran bool + }{ + {"never at 02:59", nil, cleanupAt(6, 2, 59), false}, + {"never at 03:00", nil, cleanupAt(6, 3, 0), true}, + {"never at 14:00", nil, cleanupAt(6, 14, 0), true}, + {"yesterday at 02:59", ptrTime(cleanupAt(5, 3, 0)), cleanupAt(6, 2, 59), false}, + {"yesterday at 03:00", ptrTime(cleanupAt(5, 3, 0)), cleanupAt(6, 3, 0), true}, + {"today at 04:00", ptrTime(cleanupAt(6, 3, 0)), cleanupAt(6, 4, 0), false}, + {"tomorrow at 03:00", ptrTime(cleanupAt(6, 3, 0)), cleanupAt(7, 3, 0), true}, + } + for _, c := range cases { + t.Run(c.name, func(t *testing.T) { + h := newActivityHarness(t) + h.settings.settings.LastCleanupAt = c.last + h.now = c.now + + _, ran, err := newCleanup(h).Tick(c.now) + + if err != nil || ran != c.ran { + t.Errorf("expected ran=%v, got %v, %v", c.ran, ran, err) + } + }) + } + }) + + t.Run("Forever never runs", func(t *testing.T) { + h := newActivityHarness(t) + h.settings.settings.RetentionDays = 0 + + _, ran, err := newCleanup(h).Tick(cleanupAt(6, 3, 0)) + + if err != nil || ran || h.probe.deleteCalls != 0 { + t.Errorf("expected nothing to run, got ran=%v, %v, %d deletes", ran, err, h.probe.deleteCalls) + } + }) + + t.Run("The cutoff is now minus the retention days", func(t *testing.T) { + h := newActivityHarness(t) + h.settings.settings.RetentionDays = 30 + now := cleanupAt(6, 3, 0) + h.now = now + var kept []uint64 + for _, days := range []int{40, 31, 29, 1} { + id := h.seed(t, activityUserEvent(1, "a", now.Add(-time.Duration(days)*24*time.Hour))).ID + if days < 30 { + kept = append(kept, id) + } + } + + result, ran, err := newCleanup(h).Tick(now) + + if err != nil || !ran || result.Removed != 2 { + t.Fatalf("expected 2 removed, got %+v ran=%v %v", result, ran, err) + } + remaining := map[uint64]bool{} + for _, event := range h.all(t) { + remaining[event.ID] = true + } + for _, id := range kept { + if !remaining[id] { + t.Errorf("event %d should remain", id) + } + } + last := h.settings.settings + if last.LastCleanupAt == nil || !last.LastCleanupAt.Equal(now) || last.LastCleanupRemoved != 2 { + t.Errorf("unexpected last cleanup %+v", last) + } + }) + + t.Run("A cleanup that removes nothing still records the run and no event", func(t *testing.T) { + h := newActivityHarness(t) + now := cleanupAt(6, 3, 0) + h.now = now + h.seed(t, activityUserEvent(1, "a", now.Add(-24*time.Hour))) + + result, ran, err := newCleanup(h).Tick(now) + + if err != nil || !ran || result.Removed != 0 { + t.Fatalf("unexpected result %+v ran=%v %v", result, ran, err) + } + if h.settings.cleanupOK != 1 || h.settings.settings.LastCleanupAt == nil || !h.settings.settings.LastCleanupAt.Equal(now) || len(h.all(t)) != 1 { + t.Errorf("expected the run recorded without event, got %+v with %d events", h.settings.settings, len(h.all(t))) + } + }) + + t.Run("A cleanup that removes events records a system event after deleting", func(t *testing.T) { + h := newActivityHarness(t) + now := cleanupAt(6, 3, 0) + h.now = now + for i := 0; i < 142; i++ { + h.seed(t, activityUserEvent(1, "a", now.Add(-100*24*time.Hour))) + } + + result, _, err := newCleanup(h).Tick(now) + + events := h.all(t) + if err != nil || result.Removed != 142 || len(events) != 1 { + t.Fatalf("expected 142 removed and one event, got %+v, %d events, %v", result, len(events), err) + } + event := events[0] + if event.Action != "system.activity_cleanup" || event.Category != audit.CategorySystem || event.Actor.Type != audit.ActorSystem || event.Source != audit.SourceSystem || event.IP != nil || event.UserAgent != nil || event.Outcome != audit.OutcomeSuccess { + t.Errorf("unexpected event %+v", event) + } + if event.Params["removed"] != float64(142) { + t.Errorf("unexpected params %v", event.Params) + } + }) + + t.Run("A failing delete is retried at the next tick", func(t *testing.T) { + h := newActivityHarness(t) + now := cleanupAt(6, 3, 0) + h.now = now + h.probe.deleteErr = errRepositoryFailure + cleanup := newCleanup(h) + + _, ran, err := cleanup.Tick(now) + + if !errors.Is(err, errRepositoryFailure) || ran || h.settings.settings.LastCleanupAt != nil { + t.Fatalf("expected the failure without a recorded run, got ran=%v %v", ran, err) + } + h.probe.deleteErr = nil + _, ran, err = cleanup.Tick(now.Add(time.Hour)) + if err != nil || !ran { + t.Errorf("expected the next tick to run, got ran=%v %v", ran, err) + } + }) + + t.Run("A failing save of the run is returned", func(t *testing.T) { + h := newActivityHarness(t) + h.settings.saveErr = errRepositoryFailure + + _, ran, err := newCleanup(h).Tick(cleanupAt(6, 3, 0)) + + if !errors.Is(err, errRepositoryFailure) || ran { + t.Errorf("expected the failure, got ran=%v %v", ran, err) + } + }) + + t.Run("A shortened period applies at the next cleanup, not at the change", func(t *testing.T) { + h := newActivityHarness(t) + now := cleanupAt(6, 3, 0) + h.now = now + h.seed(t, activityUserEvent(1, "a", now.Add(-40*24*time.Hour))) + + _, err := useCases.NewUpdateActivityRetentionUseCase(h.settings, h.recorder).UpdateActivityRetention(activityOwnerCtx(), 30) + if err != nil || len(h.all(t)) != 2 { + t.Fatalf("the change itself must remove nothing, got %d events, %v", len(h.all(t)), err) + } + + result, _, _ := newCleanup(h).Tick(now) + + if result.Removed != 1 { + t.Errorf("expected the old event removed at the next cleanup, got %+v", result) + } + }) +} + +type cleanupJobFake struct { + calls chan time.Time + removed int + err error +} + +func (c *cleanupJobFake) Tick(now time.Time) (audit.CleanupResult, bool, error) { + c.calls <- now + return audit.CleanupResult{Removed: c.removed}, c.err == nil, c.err +} + +func TestActivityCleanupScheduler(t *testing.T) { + start := func(job *cleanupJobFake) (chan time.Time, chan time.Time, *strings.Builder, context.CancelFunc, chan struct{}) { + ticks := make(chan time.Time, 4) + startup := make(chan time.Time, 1) + logs := &strings.Builder{} + runner := scheduler.NewCleanupRunner(job, func() time.Time { return cleanupAt(6, 3, 0) }, ticks, startup, log.New(logs, "", 0)) + ctx, cancel := context.WithCancel(context.Background()) + done := make(chan struct{}) + go func() { + defer close(done) + runner.Run(ctx) + }() + return ticks, startup, logs, cancel, done + } + + t.Run("The runner ticks the cleanup with the injected clock and logs the count", func(t *testing.T) { + job := &cleanupJobFake{calls: make(chan time.Time, 4), removed: 142} + ticks, _, logs, cancel, done := start(job) + defer func() { cancel(); <-done }() + + ticks <- time.Time{} + select { + case got := <-job.calls: + if !got.Equal(cleanupAt(6, 3, 0)) { + t.Errorf("expected the injected clock, got %v", got) + } + case <-time.After(2 * time.Second): + t.Fatal("the job was never ticked") + } + cancel() + <-done + if !strings.Contains(logs.String(), "activity cleanup completed: removed=142") { + t.Errorf("unexpected log %q", logs.String()) + } + }) + + t.Run("A failing tick is logged", func(t *testing.T) { + job := &cleanupJobFake{calls: make(chan time.Time, 4), err: errRepositoryFailure} + _, startup, logs, cancel, done := start(job) + + startup <- time.Time{} + <-job.calls + cancel() + <-done + + if !strings.Contains(logs.String(), "activity cleanup failed") || !strings.Contains(logs.String(), errRepositoryFailure.Error()) { + t.Errorf("unexpected log %q", logs.String()) + } + }) + + t.Run("The scheduler stops with the process", func(t *testing.T) { + job := &cleanupJobFake{calls: make(chan time.Time, 4)} + _, _, _, cancel, done := start(job) + + cancel() + + select { + case <-done: + case <-time.After(2 * time.Second): + t.Fatal("the runner did not return after the context was cancelled") + } + }) +} diff --git a/test/activity_support_test.go b/test/activity_support_test.go new file mode 100644 index 0000000..c4ca862 --- /dev/null +++ b/test/activity_support_test.go @@ -0,0 +1,140 @@ +package test + +import ( + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/infrastructure/auditing" + persistence "RenewCMS/internal/infrastructure/persistence/repositories" + "bytes" + "context" + "errors" + "log" + "testing" + "time" +) + +var testCtx = context.Background() + +var discardRecorder audit.Recorder = audit.Discard + +type activityProbeRepo struct { + inner audit.Repository + appendErr error + appendPanic bool + reads int + listCalls []audit.Filter + deleteErr error + deleteCalls int + readErr error +} + +var _ audit.Repository = &activityProbeRepo{} + +func (p *activityProbeRepo) Append(event audit.Event) (audit.Event, error) { + if p.appendPanic { + panic("audit repository exploded") + } + if p.appendErr != nil { + return audit.Event{}, p.appendErr + } + return p.inner.Append(event) +} + +func (p *activityProbeRepo) List(filter audit.Filter) (audit.Page, error) { + p.reads++ + p.listCalls = append(p.listCalls, filter) + if p.readErr != nil { + return audit.Page{}, p.readErr + } + return p.inner.List(filter) +} + +func (p *activityProbeRepo) Summary(query audit.SummaryQuery) (audit.Summary, error) { + p.reads++ + if p.readErr != nil { + return audit.Summary{}, p.readErr + } + return p.inner.Summary(query) +} + +func (p *activityProbeRepo) DeleteOlderThan(cutoff time.Time) (int, error) { + p.deleteCalls++ + if p.deleteErr != nil { + return 0, p.deleteErr + } + return p.inner.DeleteOlderThan(cutoff) +} + +type activitySettingsFake struct { + settings audit.Settings + saveErr error + retentionOK int + cleanupOK int +} + +var _ audit.SettingsRepository = &activitySettingsFake{} + +func newActivitySettingsFake() *activitySettingsFake { + return &activitySettingsFake{settings: audit.DefaultSettings()} +} + +func (f *activitySettingsFake) Get() (audit.Settings, error) { return f.settings, nil } + +func (f *activitySettingsFake) SaveRetention(days int) error { + if f.saveErr != nil { + return f.saveErr + } + f.retentionOK++ + f.settings.RetentionDays = days + return nil +} + +func (f *activitySettingsFake) SaveLastCleanup(at time.Time, removed int) error { + if f.saveErr != nil { + return f.saveErr + } + f.cleanupOK++ + f.settings.LastCleanupAt = &at + f.settings.LastCleanupRemoved = removed + return nil +} + +type activityHarness struct { + probe *activityProbeRepo + store *persistence.AuditEventRepository + settings *activitySettingsFake + logs *bytes.Buffer + now time.Time + recorder *auditing.Recorder +} + +func newActivityHarness(t *testing.T) *activityHarness { + t.Helper() + store := persistence.NewAuditEventRepository(openActivityDatabase(t)) + h := &activityHarness{ + probe: &activityProbeRepo{inner: store}, + store: store, + settings: newActivitySettingsFake(), + logs: &bytes.Buffer{}, + now: time.Date(2026, time.October, 6, 12, 0, 0, 0, time.UTC), + } + h.recorder = auditing.NewRecorder(h.probe, func() time.Time { return h.now }, log.New(h.logs, "", 0)) + return h +} + +func (h *activityHarness) clock() time.Time { return h.now } + +func (h *activityHarness) all(t *testing.T) []audit.Event { + t.Helper() + page, err := h.store.List(audit.Filter{Page: 1, Size: 1000}) + if err != nil { + t.Fatalf("listing stored events failed: %v", err) + } + return page.Items +} + +func (h *activityHarness) seed(t *testing.T, event audit.Event) audit.Event { + t.Helper() + return activityMustAppend(t, h.store, event) +} + +var errDiskFull = errors.New("disk full") diff --git a/test/activity_usecases_test.go b/test/activity_usecases_test.go new file mode 100644 index 0000000..b536afc --- /dev/null +++ b/test/activity_usecases_test.go @@ -0,0 +1,491 @@ +package test + +import ( + "RenewCMS/internal/domain/apikey" + "RenewCMS/internal/domain/article" + "RenewCMS/internal/domain/audit" + "RenewCMS/internal/domain/user" + "RenewCMS/internal/infrastructure/useCases" + "bytes" + "encoding/csv" + "errors" + "fmt" + "strings" + "testing" + "time" +) + +type activityWorld struct { + *activityHarness + users *mockUserRepo + articles *mockArticleRepo + images *mockImageRepo + keys *mockAPIKeyRepo + list *useCases.ListActivityUseCase + summary *useCases.GetActivitySummaryUseCase + export *useCases.ExportActivityUseCase +} + +func newActivityWorld(t *testing.T) *activityWorld { + t.Helper() + h := newActivityHarness(t) + w := &activityWorld{ + activityHarness: h, + users: newMockUserRepo(), + articles: newMockArticleRepo(), + images: newMockImageRepo(), + keys: newMockAPIKeyRepo(), + } + w.users.users[1] = user.User{ID: 1, Username: "owner", IsVerified: true, Role: user.RoleOwner} + w.users.users[2] = user.User{ID: 2, Username: "admin", IsVerified: true, Role: user.RoleAdmin} + w.users.users[3] = user.User{ID: 3, Username: "marta", DisplayName: "Marta Alves", IsVerified: true, Role: "editor"} + w.list = useCases.NewListActivityUseCase(h.probe, w.users, w.articles, w.images, w.keys, h.clock) + w.summary = useCases.NewGetActivitySummaryUseCase(h.probe, h.clock) + w.export = useCases.NewExportActivityUseCase(h.probe, h.clock) + return w +} + +func (w *activityWorld) seedAt(t *testing.T, ago time.Duration, mutate func(*audit.Event)) audit.Event { + t.Helper() + event := activityUserEvent(3, "Marta Alves", w.now.Add(-ago)) + if mutate != nil { + mutate(&event) + } + return w.seed(t, event) +} + +func TestActivityListUseCase(t *testing.T) { + const day = 24 * time.Hour + + t.Run("Omitting the range means seven days", func(t *testing.T) { + w := newActivityWorld(t) + recent := w.seedAt(t, 2*day, nil) + w.seedAt(t, 10*day, nil) + + page, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 1}) + + if err != nil || len(page.Items) != 1 || page.Items[0].Event.ID != recent.ID { + t.Fatalf("expected only the recent event, got %+v, %v", page, err) + } + if page.Page != 1 || page.Size != 25 || page.Total != 1 { + t.Errorf("unexpected paging %d/%d/%d", page.Page, page.Size, page.Total) + } + }) + + t.Run("The ranges map to the documented windows", func(t *testing.T) { + cases := []struct { + name string + query useCases.ActivityQuery + ago time.Duration + found bool + }{ + {"today keeps this morning", useCases.ActivityQuery{Range: "today"}, 11 * time.Hour, true}, + {"today drops yesterday", useCases.ActivityQuery{Range: "today"}, 13 * time.Hour, false}, + {"7d keeps six days", useCases.ActivityQuery{Range: "7d"}, 6 * day, true}, + {"7d drops eight days", useCases.ActivityQuery{Range: "7d"}, 8 * day, false}, + {"30d keeps twenty nine days", useCases.ActivityQuery{Range: "30d"}, 29 * day, true}, + {"30d drops thirty one days", useCases.ActivityQuery{Range: "30d"}, 31 * day, false}, + {"custom keeps the first day", useCases.ActivityQuery{Range: "custom", From: "2026-09-01", To: "2026-09-30"}, 35*day + 12*time.Hour, true}, + {"custom keeps the end of the last day", useCases.ActivityQuery{Range: "custom", From: "2026-09-01", To: "2026-09-30"}, 5*day + 12*time.Hour + time.Second, true}, + {"custom drops after the last day", useCases.ActivityQuery{Range: "custom", From: "2026-09-01", To: "2026-09-30"}, 5 * day, false}, + } + for _, c := range cases { + t.Run(c.name, func(t *testing.T) { + w := newActivityWorld(t) + w.seedAt(t, c.ago, nil) + + page, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 1, Query: c.query}) + + if err != nil || (page.Total == 1) != c.found { + t.Errorf("expected found=%v, got total %d, %v", c.found, page.Total, err) + } + }) + } + }) + + t.Run("Invalid values are refused before the repository is read", func(t *testing.T) { + queries := []useCases.ActivityQuery{ + {Actor: "user:abc"}, {Actor: "user:-1"}, {Actor: "group:3"}, + {Category: "billing"}, {Outcome: "maybe"}, {Security: "false"}, + {Range: "year"}, {Range: "custom"}, + {Range: "custom", From: "2026-09-30", To: "2026-09-01"}, + {Range: "custom", From: "yesterday", To: "today"}, + {Page: -1}, {Size: 10}, {Size: 200}, + } + for i, query := range queries { + w := newActivityWorld(t) + + _, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 1, Query: query}) + + if !errors.Is(err, audit.ErrInvalidFilter) || w.probe.reads != 0 { + t.Errorf("query %d (%+v): expected ErrInvalidFilter without reading, got %v after %d reads", i, query, err, w.probe.reads) + } + } + }) + + t.Run("The outcome all lists both outcomes", func(t *testing.T) { + w := newActivityWorld(t) + w.seedAt(t, day, nil) + w.seedAt(t, day, func(e *audit.Event) { e.Outcome = audit.OutcomeFailed }) + + page, _ := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 1, Query: useCases.ActivityQuery{Outcome: "all"}}) + + if page.Total != 2 { + t.Errorf("expected both outcomes, got %d", page.Total) + } + }) + + t.Run("A caller who is not owner or admin is scoped to its own events", func(t *testing.T) { + w := newActivityWorld(t) + w.seedAt(t, day, nil) + w.seedAt(t, day, func(e *audit.Event) { + e.Actor = audit.Actor{Type: audit.ActorUser, ID: activityPtr(uint32(2)), Name: "admin"} + }) + w.seedAt(t, day, func(e *audit.Event) { e.Actor = audit.SystemActor() }) + + page, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 3}) + + if err != nil || page.Total != 1 || *page.Items[0].Event.Actor.ID != 3 { + t.Fatalf("expected only user 3's events, got %+v, %v", page, err) + } + }) + + t.Run("A scoped caller cannot ask for another actor", func(t *testing.T) { + cases := map[string]bool{"user:3": true, "user:2": false, "key:7": false, "system": false} + for actor, allowed := range cases { + w := newActivityWorld(t) + + _, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 3, Query: useCases.ActivityQuery{Actor: actor}}) + + if allowed && err != nil { + t.Errorf("%s: expected success, got %v", actor, err) + } + if !allowed && !errors.Is(err, audit.ErrActorNotAllowed) { + t.Errorf("%s: expected ErrActorNotAllowed, got %v", actor, err) + } + } + }) + + t.Run("An unknown viewer is reported", func(t *testing.T) { + w := newActivityWorld(t) + + _, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 99}) + + if !errors.Is(err, user.ErrUserNotFound) { + t.Errorf("expected ErrUserNotFound, got %v", err) + } + }) + + t.Run("target.exists is resolved when the list is read", func(t *testing.T) { + cases := []struct { + name string + target audit.Target + seed func(*activityWorld) + exists bool + }{ + {"the article still exists", audit.Target{Type: "article", ID: "8", Name: "Spring release"}, func(w *activityWorld) { w.articles.articles[8] = article.Article{ID: 8} }, true}, + {"the article was deleted", audit.Target{Type: "article", ID: "8", Name: "Spring release"}, func(w *activityWorld) {}, false}, + {"the user was deleted", audit.Target{Type: "user", ID: "3", Name: "Marta Alves"}, func(w *activityWorld) { delete(w.users.users, 3) }, false}, + {"the api key still exists", audit.Target{Type: "api_key", ID: "7", Name: "Deploy bot"}, func(w *activityWorld) { w.keys.keys[7] = apikey.APIKey{ID: 7} }, true}, + {"the api key is unknown", audit.Target{Type: "api_key", ID: "7", Name: "Deploy bot"}, func(w *activityWorld) {}, false}, + } + for _, c := range cases { + t.Run(c.name, func(t *testing.T) { + w := newActivityWorld(t) + c.seed(w) + w.seedAt(t, day, func(e *audit.Event) { e.Target = c.target }) + + page, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 1}) + + if err != nil || len(page.Items) != 1 { + t.Fatalf("unexpected result %+v, %v", page, err) + } + if page.Items[0].TargetExists != c.exists || page.Items[0].Event.Target.Name != c.target.Name { + t.Errorf("expected exists=%v with the name kept, got %+v", c.exists, page.Items[0]) + } + }) + } + }) + + t.Run("A repository failure is returned", func(t *testing.T) { + w := newActivityWorld(t) + w.users.fail.failNext("Get") + + _, err := w.list.ListActivity(useCases.ListActivityCommand{ViewerID: 1}) + + if !errors.Is(err, errRepositoryFailure) { + t.Errorf("expected the repository failure, got %v", err) + } + }) +} + +func TestActivitySummaryUseCase(t *testing.T) { + const day = 24 * time.Hour + + t.Run("The summary of the last seven days compares with the previous period", func(t *testing.T) { + w := newActivityWorld(t) + for i := 0; i < 12; i++ { + i := i + w.seedAt(t, time.Duration(i)*12*time.Hour+time.Hour, func(e *audit.Event) { + if i < 3 { + e.Outcome = audit.OutcomeFailed + } + e.Security = i < 2 + if i%2 == 1 { + e.Actor = audit.Actor{Type: audit.ActorAPIKey, ID: activityPtr(uint32(7)), Name: "bot"} + } + }) + } + for i := 0; i < 10; i++ { + w.seedAt(t, 7*day+time.Duration(i)*time.Hour+time.Hour, nil) + } + + summary, err := w.summary.GetActivitySummary(useCases.ActivityQuery{Range: "7d"}) + + if err != nil { + t.Fatal(err) + } + if summary.Total != 12 || summary.PreviousTotal != 10 || summary.Failed != 3 || summary.Security != 2 { + t.Errorf("unexpected counts %+v", summary) + } + if summary.ActivePeople.Users != 1 || summary.ActivePeople.APIKeys != 1 { + t.Errorf("unexpected people %+v", summary.ActivePeople) + } + sum := 0 + for _, n := range summary.Series.Total { + sum += n + } + if len(summary.Series.Total) != 7 || len(summary.Series.Active) != 7 || len(summary.Series.Failed) != 7 || len(summary.Series.Security) != 7 || sum != 12 { + t.Errorf("unexpected series %+v", summary.Series) + } + }) + + t.Run("An empty log answers zeros", func(t *testing.T) { + w := newActivityWorld(t) + + summary, err := w.summary.GetActivitySummary(useCases.ActivityQuery{}) + + if err != nil || summary.Total != 0 || summary.PreviousTotal != 0 || len(summary.Series.Total) != 7 { + t.Errorf("unexpected summary %+v, %v", summary, err) + } + for _, n := range append(append(summary.Series.Total, summary.Series.Active...), append(summary.Series.Failed, summary.Series.Security...)...) { + if n != 0 { + t.Errorf("expected only zeros, got %+v", summary.Series) + } + } + }) + + t.Run("A custom range compares with the seven days immediately before it", func(t *testing.T) { + w := newActivityWorld(t) + at := func(day int, month time.Month) { + w.seed(t, activityUserEvent(3, "a", time.Date(2026, month, day, 12, 0, 0, 0, time.UTC))) + } + at(1, time.September) + at(7, time.September) + at(8, time.September) + at(25, time.August) + at(31, time.August) + at(24, time.August) + + summary, err := w.summary.GetActivitySummary(useCases.ActivityQuery{Range: "custom", From: "2026-09-01", To: "2026-09-07"}) + + if err != nil || summary.Total != 2 || summary.PreviousTotal != 2 { + t.Errorf("expected 2 and 2, got %+v, %v", summary, err) + } + }) + + t.Run("An invalid range is refused", func(t *testing.T) { + w := newActivityWorld(t) + + _, err := w.summary.GetActivitySummary(useCases.ActivityQuery{Range: "year"}) + + if !errors.Is(err, audit.ErrInvalidFilter) || w.probe.reads != 0 { + t.Errorf("expected ErrInvalidFilter without reading, got %v", err) + } + }) +} + +func exportToString(t *testing.T, w *activityWorld, query useCases.ActivityQuery) string { + t.Helper() + prepared, err := w.export.Prepare(query) + if err != nil { + t.Fatalf("prepare failed: %v", err) + } + var out bytes.Buffer + if err := prepared.WriteCSV(&out); err != nil { + t.Fatalf("write failed: %v", err) + } + return out.String() +} + +func TestActivityExportUseCase(t *testing.T) { + t.Run("The file has the header and one row per event, newest first", func(t *testing.T) { + w := newActivityWorld(t) + for i := 1; i <= 3; i++ { + w.seedAt(t, time.Duration(i)*time.Hour, func(e *audit.Event) { e.Action = fmt.Sprintf("article.edit%d", i) }) + } + + rows, err := csv.NewReader(strings.NewReader(exportToString(t, w, useCases.ActivityQuery{}))).ReadAll() + + if err != nil || len(rows) != 4 { + t.Fatalf("unexpected rows %v, %v", rows, err) + } + if strings.Join(rows[0], ",") != "when,actor,action,target,outcome,source,ip" { + t.Errorf("unexpected header %v", rows[0]) + } + if rows[1][2] != "article.edit1" || rows[3][2] != "article.edit3" { + t.Errorf("expected newest first, got %v", rows) + } + }) + + t.Run("A row holds the documented columns only", func(t *testing.T) { + w := newActivityWorld(t) + w.seed(t, func() audit.Event { + event := activityUserEvent(3, "Marta Alves", time.Date(2026, time.October, 6, 10, 42, 18, 0, time.UTC)) + event.Target = audit.Target{Type: "article", ID: "8", Name: "Spring release"} + event.IP = activityPtr("203.0.113.12") + event.UserAgent = activityPtr("Chrome 129 on Windows") + event.Changes = []audit.Change{{Field: "online", Kind: audit.ChangeText, Before: activityPtr("false"), After: activityPtr("true")}} + return event + }()) + + file := exportToString(t, w, useCases.ActivityQuery{}) + + want := "2026-10-06T10:42:18Z,Marta Alves,article.publish,Spring release,success,web,203.0.113.12\n" + if !strings.HasSuffix(file, want) { + t.Errorf("expected the row %q, got %q", want, file) + } + if strings.Contains(file, "Chrome") || strings.Contains(file, "false") { + t.Errorf("the file must hold no user agent and no changes: %q", file) + } + }) + + t.Run("Cells that a spreadsheet would evaluate are neutralised", func(t *testing.T) { + cases := []struct { + column string + value string + cell string + }{ + {"actor", "=cmd", "'=cmd"}, + {"target", "+1+1", "'+1+1"}, + {"target", "-2", "'-2"}, + {"actor", "@SUM(A1)", "'@SUM(A1)"}, + {"target", "Spring release", "Spring release"}, + {"target", "a=b", "a=b"}, + } + for _, c := range cases { + w := newActivityWorld(t) + w.seedAt(t, time.Hour, func(e *audit.Event) { + if c.column == "actor" { + e.Actor.Name = c.value + } else { + e.Target = audit.Target{Type: "article", ID: "1", Name: c.value} + } + }) + + rows, _ := csv.NewReader(strings.NewReader(exportToString(t, w, useCases.ActivityQuery{}))).ReadAll() + + index := 1 + if c.column == "target" { + index = 3 + } + if rows[1][index] != c.cell { + t.Errorf("%s %q: expected %q, got %q", c.column, c.value, c.cell, rows[1][index]) + } + } + }) + + t.Run("Commas, quotes and newlines are quoted and keep one row", func(t *testing.T) { + w := newActivityWorld(t) + name := "Hello, \"world\"\nsecond line" + w.seedAt(t, time.Hour, func(e *audit.Event) { e.Target = audit.Target{Type: "article", ID: "1", Name: name} }) + + file := exportToString(t, w, useCases.ActivityQuery{}) + + if !strings.Contains(file, "\"Hello, \"\"world\"\"\nsecond line\"") { + t.Errorf("the cell is not quoted with doubled quotes: %q", file) + } + rows, err := csv.NewReader(strings.NewReader(file)).ReadAll() + if err != nil || len(rows) != 2 || rows[1][3] != name { + t.Errorf("expected one data row holding the name, got %v, %v", rows, err) + } + }) + + t.Run("The filters apply and paging is ignored", func(t *testing.T) { + w := newActivityWorld(t) + for i := 0; i < 60; i++ { + failed := i < 8 + w.seedAt(t, time.Duration(i+1)*time.Minute, func(e *audit.Event) { + if failed { + e.Outcome = audit.OutcomeFailed + } + }) + } + + rows, _ := csv.NewReader(strings.NewReader(exportToString(t, w, useCases.ActivityQuery{Outcome: "failed", Page: 2, Size: 25}))).ReadAll() + + if len(rows) != 9 { + t.Errorf("expected the header and 8 failed rows, got %d lines", len(rows)) + } + }) + + t.Run("A system event has an empty ip cell", func(t *testing.T) { + w := newActivityWorld(t) + w.seedAt(t, time.Hour, func(e *audit.Event) { e.Actor = audit.SystemActor(); e.Source = audit.SourceSystem }) + + rows, _ := csv.NewReader(strings.NewReader(exportToString(t, w, useCases.ActivityQuery{}))).ReadAll() + + if rows[1][6] != "" || rows[1][1] != "System" { + t.Errorf("unexpected row %v", rows[1]) + } + }) + + t.Run("An invalid filter is refused before anything is prepared", func(t *testing.T) { + w := newActivityWorld(t) + + _, err := w.export.Prepare(useCases.ActivityQuery{Outcome: "maybe"}) + + if !errors.Is(err, audit.ErrInvalidFilter) || w.probe.reads != 0 { + t.Errorf("expected ErrInvalidFilter without reading, got %v", err) + } + }) + + t.Run("A large export is read in batches", func(t *testing.T) { + w := newActivityWorld(t) + for i := 0; i < 1200; i++ { + w.seedAt(t, time.Duration(i+1)*time.Second, nil) + } + + rows, err := csv.NewReader(strings.NewReader(exportToString(t, w, useCases.ActivityQuery{}))).ReadAll() + + if err != nil || len(rows) != 1201 { + t.Fatalf("expected 1200 rows plus the header, got %d, %v", len(rows), err) + } + if len(w.probe.listCalls) < 2 { + t.Errorf("expected several paged reads, got %d", len(w.probe.listCalls)) + } + for _, call := range w.probe.listCalls { + if call.Size == 0 || call.Size >= 1200 { + t.Errorf("every read must be a bounded page, got size %d", call.Size) + } + } + }) + + t.Run("An export that fills whole batches stops without an extra read", func(t *testing.T) { + for _, c := range []struct{ events, reads int }{{500, 1}, {1000, 2}} { + w := newActivityWorld(t) + for i := 0; i < c.events; i++ { + w.seedAt(t, time.Duration(i+1)*time.Second, nil) + } + + rows, err := csv.NewReader(strings.NewReader(exportToString(t, w, useCases.ActivityQuery{}))).ReadAll() + + if err != nil || len(rows) != c.events+1 { + t.Fatalf("%d events: expected %d rows, got %d, %v", c.events, c.events+1, len(rows), err) + } + if len(w.probe.listCalls) != c.reads { + t.Errorf("%d events: expected %d reads, got %d", c.events, c.reads, len(w.probe.listCalls)) + } + } + }) +} diff --git a/test/activity_validation_test.go b/test/activity_validation_test.go new file mode 100644 index 0000000..f39feaf --- /dev/null +++ b/test/activity_validation_test.go @@ -0,0 +1,92 @@ +package test + +import ( + "RenewCMS/internal/domain/audit" + "errors" + "net/http" + "strings" + "testing" +) + +func validActivityEvent() audit.Event { + event := audit.NewEvent("article.publish", audit.CategoryArticles) + event.Source = audit.SourceWeb + event.Actor = audit.Actor{Type: audit.ActorUser, Name: "marta"} + return event +} + +func TestActivityEventValidation(t *testing.T) { + long := func(n int) *string { value := strings.Repeat("x", n); return &value } + cases := []struct { + name string + mutate func(*audit.Event) + valid bool + }{ + {"complete event", func(e *audit.Event) {}, true}, + {"empty action", func(e *audit.Event) { e.Action = "" }, false}, + {"action at the limit", func(e *audit.Event) { e.Action = strings.Repeat("a", 64) }, true}, + {"action over the limit", func(e *audit.Event) { e.Action = strings.Repeat("a", 65) }, false}, + {"unknown category", func(e *audit.Event) { e.Category = "nope" }, false}, + {"unknown outcome", func(e *audit.Event) { e.Outcome = "nope" }, false}, + {"unknown source", func(e *audit.Event) { e.Source = "nope" }, false}, + {"unknown actor type", func(e *audit.Event) { e.Actor.Type = "nope" }, false}, + {"failure reason at the limit", func(e *audit.Event) { e.FailureReason = long(255) }, true}, + {"failure reason over the limit", func(e *audit.Event) { e.FailureReason = long(256) }, false}, + {"unknown change kind", func(e *audit.Event) { e.Changes = []audit.Change{{Field: "a", Kind: "nope"}} }, false}, + {"body change", func(e *audit.Event) { e.Changes = []audit.Change{{Field: "a", Kind: audit.ChangeBody}} }, true}, + } + for _, c := range cases { + event := validActivityEvent() + c.mutate(&event) + + err := event.Validate() + + if c.valid && err != nil { + t.Errorf("%s: expected valid, got %v", c.name, err) + } + if !c.valid && !errors.Is(err, audit.ErrInvalidEvent) { + t.Errorf("%s: expected ErrInvalidEvent, got %v", c.name, err) + } + } + + t.Run("Names are cut to 255 characters", func(t *testing.T) { + event := validActivityEvent() + event.Actor.Name = strings.Repeat("é", 256) + event.Target.Name = strings.Repeat("é", 255) + + cut := event.Truncated() + + if len([]rune(cut.Actor.Name)) != 255 || len([]rune(cut.Target.Name)) != 255 { + t.Errorf("unexpected lengths %d and %d", len([]rune(cut.Actor.Name)), len([]rune(cut.Target.Name))) + } + }) + + t.Run("The discard recorder accepts events silently", func(t *testing.T) { + audit.Discard.Record(testCtx, validActivityEvent()) + }) +} + +func TestActivityHandlerErrorMapping(t *testing.T) { + t.Run("A signed-in user who no longer exists is unauthorised", func(t *testing.T) { + e := newActivityHTTPEnv(t, 1000) + + rec := e.get("/v1/activity", asUser(e, 99)) + + if rec.Code != http.StatusUnauthorized { + t.Errorf("expected 401, got %d", rec.Code) + } + }) + + t.Run("A storage failure is a plain 500", func(t *testing.T) { + for _, path := range []string{"/v1/activity", "/v1/activity/summary", "/v1/activity/export"} { + e := newActivityHTTPEnv(t, 1000) + e.probe.readErr = errors.New("storage down") + + rec := e.get(path, asUser(e, activityOwnerID)) + + if path != "/v1/activity/export" && rec.Code != http.StatusInternalServerError { + t.Errorf("%s: expected 500, got %d", path, rec.Code) + } + } + }) +} diff --git a/test/api_keys_http_test.go b/test/api_keys_http_test.go index c2dfbc8..9db34fd 100644 --- a/test/api_keys_http_test.go +++ b/test/api_keys_http_test.go @@ -99,11 +99,11 @@ func newAPIKeyEnv(t *testing.T) *apiKeyEnv { DeleteArticleUseCase: useCases.NewDeleteArticleUseCase(env.articles), GetUserUseCase: useCases.NewGetUserUseCase(env.users), CreateUserUseCase: useCases.NewCreateUserUseCase(env.users, hasher, mail, "https://cms.example.com"), - AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(env.users, hasher), + AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(env.users, hasher, discardRecorder), VerifyUserUseCase: useCases.NewVerifyUserUseCase(env.users, hasher), CancelRegistrationUseCase: useCases.NewCancelRegistrationUseCase(env.users), - RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(env.users, hasher, mail, "https://cms.example.com"), - ResetPasswordUseCase: useCases.NewResetPasswordUseCase(env.users, hasher, env.keys, clock), + RequestPasswordResetUseCase: useCases.NewRequestPasswordResetUseCase(env.users, hasher, mail, "https://cms.example.com", discardRecorder), + ResetPasswordUseCase: useCases.NewResetPasswordUseCase(env.users, hasher, env.keys, clock, discardRecorder), UpdateUserProfileUseCase: useCases.NewUpdateUserProfileUseCase(env.users), CreateInviteUseCase: useCases.NewCreateInviteUseCase(env.users, env.invites, hasher, mail, "https://cms.example.com"), CancelInviteUseCase: useCases.NewCancelInviteUseCase(env.invites), @@ -118,11 +118,12 @@ func newAPIKeyEnv(t *testing.T) *apiKeyEnv { MergeMediaUseCase: useCases.NewMergeMediaUseCase(env.images, env.articles, newMockImageStorage()), GetMediaUsageUseCase: useCases.NewGetMediaUsageUseCase(env.images, env.articles), GetSettingsUseCase: useCases.NewGetSettingsUseCase(apiKeyRunningVersion), + GetActivityRetentionUseCase: useCases.NewGetActivityRetentionUseCase(newActivitySettingsFake()), GetUpdateStatusUseCase: newUpdateStatusUseCase(env.updates, &fakeJobStore{}, &fakeHelperDetector{}, apiKeyRunningVersion), CheckForUpdateUseCase: useCases.NewCheckForUpdateUseCase(env.feed, env.updates, apiKeyRunningVersion, clock), - CreateAPIKeyUseCase: useCases.NewCreateAPIKeyUseCase(env.keys, env.generator, clock), + CreateAPIKeyUseCase: useCases.NewCreateAPIKeyUseCase(env.keys, env.generator, clock, discardRecorder), ListAPIKeysUseCase: useCases.NewListAPIKeysUseCase(env.keys, env.users, clock), - RevokeAPIKeyUseCase: useCases.NewRevokeAPIKeyUseCase(env.keys, env.users, clock), + RevokeAPIKeyUseCase: useCases.NewRevokeAPIKeyUseCase(env.keys, env.users, clock, discardRecorder), AuthenticateAPIKeyUseCase: useCases.NewAuthenticateAPIKeyUseCase(env.keys, env.generator, env.users, clock), } router := chi.NewRouter() diff --git a/test/api_keys_test.go b/test/api_keys_test.go index b633740..4242bba 100644 --- a/test/api_keys_test.go +++ b/test/api_keys_test.go @@ -221,9 +221,9 @@ func TestSHA256KeyGenerator(t *testing.T) { func TestCreateAPIKeyUseCase(t *testing.T) { t.Run("Use case: creating a key hashes it and stores no plaintext", func(t *testing.T) { repo := newMockAPIKeyRepo() - uc := useCases.NewCreateAPIKeyUseCase(repo, &stubKeyGenerator{raw: "rcms_fake", prefix: "rcms_fake"}, apiKeyUnitClock) + uc := useCases.NewCreateAPIKeyUseCase(repo, &stubKeyGenerator{raw: "rcms_fake", prefix: "rcms_fake"}, apiKeyUnitClock, discardRecorder) - created, err := uc.CreateAPIKey(useCases.CreateAPIKeyCommand{UserID: 2, Name: "ci"}) + created, err := uc.CreateAPIKey(testCtx, useCases.CreateAPIKeyCommand{UserID: 2, Name: "ci"}) if err != nil { t.Fatalf("unexpected error: %v", err) } @@ -248,9 +248,9 @@ func TestCreateAPIKeyUseCase(t *testing.T) { t.Run("An expiry that is not in the future is refused and nothing is stored", func(t *testing.T) { for name, expiry := range map[string]time.Time{"in the past": apiKeyUnitNow.Add(-time.Hour), "exactly now": apiKeyUnitNow} { repo := newMockAPIKeyRepo() - uc := useCases.NewCreateAPIKeyUseCase(repo, &stubKeyGenerator{raw: "rcms_fake", prefix: "rcms_fake"}, apiKeyUnitClock) + uc := useCases.NewCreateAPIKeyUseCase(repo, &stubKeyGenerator{raw: "rcms_fake", prefix: "rcms_fake"}, apiKeyUnitClock, discardRecorder) - _, err := uc.CreateAPIKey(useCases.CreateAPIKeyCommand{UserID: 2, Name: "ci", ExpiresAt: &expiry}) + _, err := uc.CreateAPIKey(testCtx, useCases.CreateAPIKeyCommand{UserID: 2, Name: "ci", ExpiresAt: &expiry}) if !errors.Is(err, apikey.ErrExpiryNotInFuture) { t.Errorf("%s: expected ErrExpiryNotInFuture, got %v", name, err) } @@ -263,9 +263,9 @@ func TestCreateAPIKeyUseCase(t *testing.T) { t.Run("A repository failure is returned", func(t *testing.T) { repo := newMockAPIKeyRepo() repo.fail.failNext("Create") - uc := useCases.NewCreateAPIKeyUseCase(repo, &stubKeyGenerator{raw: "rcms_fake", prefix: "rcms_fake"}, apiKeyUnitClock) + uc := useCases.NewCreateAPIKeyUseCase(repo, &stubKeyGenerator{raw: "rcms_fake", prefix: "rcms_fake"}, apiKeyUnitClock, discardRecorder) - if _, err := uc.CreateAPIKey(useCases.CreateAPIKeyCommand{UserID: 2, Name: "ci"}); !errors.Is(err, errRepositoryFailure) { + if _, err := uc.CreateAPIKey(testCtx, useCases.CreateAPIKeyCommand{UserID: 2, Name: "ci"}); !errors.Is(err, errRepositoryFailure) { t.Errorf("expected the repository failure, got %v", err) } }) @@ -486,9 +486,9 @@ func TestRevokeAPIKeyUseCase(t *testing.T) { t.Run("A creator revokes their own key at the clock's now", func(t *testing.T) { repo := newMockAPIKeyRepo() stored := seedStubKey(repo, "rcms_a", nil) - uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock) + uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock, discardRecorder) - if err := uc.RevokeAPIKey(2, stored.ID); err != nil { + if err := uc.RevokeAPIKey(testCtx, 2, stored.ID); err != nil { t.Fatalf("unexpected error: %v", err) } if got := repo.keys[stored.ID].RevokedAt; got == nil || !got.Equal(apiKeyUnitNow) { @@ -499,9 +499,9 @@ func TestRevokeAPIKeyUseCase(t *testing.T) { t.Run("Another admin gets not found and the key stays active", func(t *testing.T) { repo := newMockAPIKeyRepo() stored := seedStubKey(repo, "rcms_a", nil) - uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock) + uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock, discardRecorder) - if err := uc.RevokeAPIKey(3, stored.ID); !errors.Is(err, apikey.ErrAPIKeyNotFound) { + if err := uc.RevokeAPIKey(testCtx, 3, stored.ID); !errors.Is(err, apikey.ErrAPIKeyNotFound) { t.Errorf("expected ErrAPIKeyNotFound, got %v", err) } if repo.keys[stored.ID].RevokedAt != nil || repo.revokeCalls != 0 { @@ -512,9 +512,9 @@ func TestRevokeAPIKeyUseCase(t *testing.T) { t.Run("The owner revokes any key", func(t *testing.T) { repo := newMockAPIKeyRepo() stored := seedStubKey(repo, "rcms_a", func(k *apikey.APIKey) { k.UserID = 3 }) - uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock) + uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock, discardRecorder) - if err := uc.RevokeAPIKey(1, stored.ID); err != nil { + if err := uc.RevokeAPIKey(testCtx, 1, stored.ID); err != nil { t.Fatalf("unexpected error: %v", err) } if repo.keys[stored.ID].RevokedAt == nil { @@ -526,9 +526,9 @@ func TestRevokeAPIKeyUseCase(t *testing.T) { repo := newMockAPIKeyRepo() original := apiKeyUnitNow.Add(-time.Hour) stored := seedStubKey(repo, "rcms_a", func(k *apikey.APIKey) { k.RevokedAt = &original }) - uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock) + uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock, discardRecorder) - if err := uc.RevokeAPIKey(2, stored.ID); err != nil { + if err := uc.RevokeAPIKey(testCtx, 2, stored.ID); err != nil { t.Fatalf("unexpected error: %v", err) } if got := repo.keys[stored.ID].RevokedAt; got == nil || !got.Equal(original) { @@ -539,16 +539,16 @@ func TestRevokeAPIKeyUseCase(t *testing.T) { t.Run("An unknown key, an unknown requester and repository failures are returned", func(t *testing.T) { repo := newMockAPIKeyRepo() stored := seedStubKey(repo, "rcms_a", nil) - uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock) + uc := useCases.NewRevokeAPIKeyUseCase(repo, apiKeyUnitUsers(), apiKeyUnitClock, discardRecorder) - if err := uc.RevokeAPIKey(2, 999); !errors.Is(err, apikey.ErrAPIKeyNotFound) { + if err := uc.RevokeAPIKey(testCtx, 2, 999); !errors.Is(err, apikey.ErrAPIKeyNotFound) { t.Errorf("expected ErrAPIKeyNotFound, got %v", err) } - if err := uc.RevokeAPIKey(99, stored.ID); !errors.Is(err, user.ErrUserNotFound) { + if err := uc.RevokeAPIKey(testCtx, 99, stored.ID); !errors.Is(err, user.ErrUserNotFound) { t.Errorf("expected ErrUserNotFound, got %v", err) } repo.fail.failNext("Revoke") - if err := uc.RevokeAPIKey(2, stored.ID); !errors.Is(err, errRepositoryFailure) { + if err := uc.RevokeAPIKey(testCtx, 2, stored.ID); !errors.Is(err, errRepositoryFailure) { t.Errorf("expected the repository failure, got %v", err) } }) @@ -566,9 +566,9 @@ func TestResetPasswordRevokesAPIKeys(t *testing.T) { keys := newMockAPIKeyRepo() seedStubKey(keys, "rcms_a", func(k *apikey.APIKey) { k.UserID = 2 }) other := seedStubKey(keys, "rcms_c", func(k *apikey.APIKey) { k.UserID = 3 }) - uc := useCases.NewResetPasswordUseCase(resetUser(apiKeyUnitNow.Add(time.Hour)), &stubHasher{}, keys, apiKeyUnitClock) + uc := useCases.NewResetPasswordUseCase(resetUser(apiKeyUnitNow.Add(time.Hour)), &stubHasher{}, keys, apiKeyUnitClock, discardRecorder) - if err := uc.ResetPassword("dev@example.com", "reset-code-1", "newpassword1"); err != nil { + if err := uc.ResetPassword(testCtx, "dev@example.com", "reset-code-1", "newpassword1"); err != nil { t.Fatalf("unexpected error: %v", err) } if len(keys.revokeAllCalls) != 1 || keys.revokeAllCalls[0].userId != 2 || !keys.revokeAllCalls[0].at.Equal(apiKeyUnitNow) { @@ -594,9 +594,9 @@ func TestResetPasswordRevokesAPIKeys(t *testing.T) { for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { keys := newMockAPIKeyRepo() - uc := useCases.NewResetPasswordUseCase(resetUser(tc.expiration), &stubHasher{}, keys, apiKeyUnitClock) + uc := useCases.NewResetPasswordUseCase(resetUser(tc.expiration), &stubHasher{}, keys, apiKeyUnitClock, discardRecorder) - if err := uc.ResetPassword(tc.email, tc.code, "newpassword1"); !errors.Is(err, tc.want) { + if err := uc.ResetPassword(testCtx, tc.email, tc.code, "newpassword1"); !errors.Is(err, tc.want) { t.Errorf("expected %v, got %v", tc.want, err) } if len(keys.revokeAllCalls) != 0 { @@ -610,14 +610,14 @@ func TestResetPasswordRevokesAPIKeys(t *testing.T) { keys := newMockAPIKeyRepo() users := resetUser(apiKeyUnitNow.Add(time.Hour)) users.fail.failNext("ResetPassword") - uc := useCases.NewResetPasswordUseCase(users, &stubHasher{}, keys, apiKeyUnitClock) - if err := uc.ResetPassword("dev@example.com", "reset-code-1", "newpassword1"); !errors.Is(err, errRepositoryFailure) { + uc := useCases.NewResetPasswordUseCase(users, &stubHasher{}, keys, apiKeyUnitClock, discardRecorder) + if err := uc.ResetPassword(testCtx, "dev@example.com", "reset-code-1", "newpassword1"); !errors.Is(err, errRepositoryFailure) { t.Errorf("expected the repository failure, got %v", err) } hashErr := errors.New("hash failed") - uc = useCases.NewResetPasswordUseCase(resetUser(apiKeyUnitNow.Add(time.Hour)), &stubHasher{hashErr: hashErr}, keys, apiKeyUnitClock) - if err := uc.ResetPassword("dev@example.com", "reset-code-1", "newpassword1"); !errors.Is(err, hashErr) { + uc = useCases.NewResetPasswordUseCase(resetUser(apiKeyUnitNow.Add(time.Hour)), &stubHasher{hashErr: hashErr}, keys, apiKeyUnitClock, discardRecorder) + if err := uc.ResetPassword(testCtx, "dev@example.com", "reset-code-1", "newpassword1"); !errors.Is(err, hashErr) { t.Errorf("expected the hash error, got %v", err) } if len(keys.revokeAllCalls) != 0 { @@ -629,9 +629,9 @@ func TestResetPasswordRevokesAPIKeys(t *testing.T) { keys := newMockAPIKeyRepo() keys.fail.failNext("RevokeAllByUser") users := resetUser(apiKeyUnitNow.Add(time.Hour)) - uc := useCases.NewResetPasswordUseCase(users, &stubHasher{}, keys, apiKeyUnitClock) + uc := useCases.NewResetPasswordUseCase(users, &stubHasher{}, keys, apiKeyUnitClock, discardRecorder) - err := uc.ResetPassword("dev@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "dev@example.com", "reset-code-1", "newpassword1") if !errors.Is(err, errRepositoryFailure) { t.Errorf("expected the revoke failure, got %v", err) } diff --git a/test/cancel_pending_registration_http_test.go b/test/cancel_pending_registration_http_test.go index 4858e90..706e916 100644 --- a/test/cancel_pending_registration_http_test.go +++ b/test/cancel_pending_registration_http_test.go @@ -20,7 +20,7 @@ func newCancelRegistrationRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) verificationHandler := auth.NewVerificationHandler( diff --git a/test/hasher_test.go b/test/hasher_test.go index a502beb..9890686 100644 --- a/test/hasher_test.go +++ b/test/hasher_test.go @@ -85,9 +85,9 @@ func TestAuthenticateUserUseCase(t *testing.T) { t.Run("correct password returns the user with no error", func(t *testing.T) { repo := newRepo() - uc := useCases.NewAuthenticateUserUseCase(repo, &stubHasher{}) + uc := useCases.NewAuthenticateUserUseCase(repo, &stubHasher{}, discardRecorder) - result, err := uc.Authenticate("alice", "hunter2example") + result, err := uc.Authenticate(testCtx, "alice", "hunter2example") if err != nil { t.Fatalf("expected no error, got %v", err) } @@ -98,9 +98,9 @@ func TestAuthenticateUserUseCase(t *testing.T) { t.Run("wrong password returns user.ErrInvalidCredentials", func(t *testing.T) { repo := newRepo() - uc := useCases.NewAuthenticateUserUseCase(repo, &stubHasher{}) + uc := useCases.NewAuthenticateUserUseCase(repo, &stubHasher{}, discardRecorder) - _, err := uc.Authenticate("alice", "wrongpassword12") + _, err := uc.Authenticate(testCtx, "alice", "wrongpassword12") if !errors.Is(err, user.ErrInvalidCredentials) { t.Errorf("expected user.ErrInvalidCredentials, got %v", err) } @@ -109,9 +109,9 @@ func TestAuthenticateUserUseCase(t *testing.T) { t.Run("unknown username never calls the hasher", func(t *testing.T) { repo := newMockUserRepo() hasher := &spyHasher{} - uc := useCases.NewAuthenticateUserUseCase(repo, hasher) + uc := useCases.NewAuthenticateUserUseCase(repo, hasher, discardRecorder) - _, err := uc.Authenticate("bob", "hunter2example") + _, err := uc.Authenticate(testCtx, "bob", "hunter2example") if !errors.Is(err, user.ErrUserNotFound) { t.Errorf("expected user.ErrUserNotFound, got %v", err) } @@ -157,7 +157,7 @@ func newHasherRouter(userRepo *mockUserRepo, hasher *stubHasher) *chi.Mux { loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) @@ -175,7 +175,7 @@ func newRealHasherRouter(userRepo *mockUserRepo) *chi.Mux { loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) diff --git a/test/invitations_test.go b/test/invitations_test.go index a6d6fa2..f589412 100644 --- a/test/invitations_test.go +++ b/test/invitations_test.go @@ -537,7 +537,7 @@ func TestInvitationsDoNotChangeRegistration(t *testing.T) { handler := auth.NewLoginHandler( jwtauth.New("HS256", []byte("test-secret"), nil), useCases.NewCreateUserUseCase(users, hasher, mail, invitePublicURL), - useCases.NewAuthenticateUserUseCase(users, hasher), + useCases.NewAuthenticateUserUseCase(users, hasher, discardRecorder), true, ) r := chi.NewRouter() diff --git a/test/login_and_password_reset_rate_limiting_http_test.go b/test/login_and_password_reset_rate_limiting_http_test.go index 6eb4178..51178ea 100644 --- a/test/login_and_password_reset_rate_limiting_http_test.go +++ b/test/login_and_password_reset_rate_limiting_http_test.go @@ -37,12 +37,12 @@ func newRateLimitedAuthRouter(t *testing.T, userRepo user.Repository, mailRepo * loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) passwordResetHandler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) r := chi.NewRouter() diff --git a/test/login_logout_cookie_test.go b/test/login_logout_cookie_test.go index 95ffd4d..3453233 100644 --- a/test/login_logout_cookie_test.go +++ b/test/login_logout_cookie_test.go @@ -20,7 +20,7 @@ func newLoginLogoutCookieRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) diff --git a/test/not_found_errors_test.go b/test/not_found_errors_test.go index b8dd25c..9e48b43 100644 --- a/test/not_found_errors_test.go +++ b/test/not_found_errors_test.go @@ -137,7 +137,7 @@ func newNotFoundErrorsRouter(articleRepo *mockArticleRepo, userRepo *mockUserRep loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) diff --git a/test/registration_gate_and_verification_email_test.go b/test/registration_gate_and_verification_email_test.go index 409085e..e8dc0a5 100644 --- a/test/registration_gate_and_verification_email_test.go +++ b/test/registration_gate_and_verification_email_test.go @@ -43,7 +43,7 @@ func newRegistrationGateRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, p loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, publicURL), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) diff --git a/test/registration_status_endpoint_http_test.go b/test/registration_status_endpoint_http_test.go index e43c2ee..70e2d03 100644 --- a/test/registration_status_endpoint_http_test.go +++ b/test/registration_status_endpoint_http_test.go @@ -19,7 +19,7 @@ func newRegistrationStatusRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo) token := jwtauth.New("HS256", []byte("test-secret"), nil) hasher := &stubHasher{} createUseCase := useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com") - loginHandler := auth.NewLoginHandler(token, createUseCase, useCases.NewAuthenticateUserUseCase(userRepo, hasher), true) + loginHandler := auth.NewLoginHandler(token, createUseCase, useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true) r := chi.NewRouter() r.Route("/v1/auth", func(r chi.Router) { diff --git a/test/request_password_reset_http_test.go b/test/request_password_reset_http_test.go index 3459d2c..2b291d4 100644 --- a/test/request_password_reset_http_test.go +++ b/test/request_password_reset_http_test.go @@ -18,8 +18,8 @@ import ( func newRequestPasswordResetRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, publicURL string) *chi.Mux { hasher := &stubHasher{} passwordResetHandler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, publicURL), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, publicURL, discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) r := chi.NewRouter() diff --git a/test/request_password_reset_mail_failure_test.go b/test/request_password_reset_mail_failure_test.go index 90cbabe..e4db036 100644 --- a/test/request_password_reset_mail_failure_test.go +++ b/test/request_password_reset_mail_failure_test.go @@ -46,8 +46,8 @@ func resetRequestWith(mailRepo *mockMailRepo, email string) (*httptest.ResponseR userRepo.nextID = 1 hasher := resetMailFailureHasher{} handler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) router := chi.NewRouter() router.Post("/v1/auth/password-reset", handler.RequestPasswordReset) diff --git a/test/request_password_reset_test.go b/test/request_password_reset_test.go index e81f636..a0b0549 100644 --- a/test/request_password_reset_test.go +++ b/test/request_password_reset_test.go @@ -30,9 +30,9 @@ func TestRequestPasswordResetUseCase(t *testing.T) { t.Run("The use case itself hashes the code, stores it with a one-hour expiration, and sends the email", func(t *testing.T) { repo := newRequestPasswordResetTestUserRepo() mailRepo := newMockMailRepo() - uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com") + uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder) - err := uc.RequestPasswordReset("alice@example.com") + err := uc.RequestPasswordReset(testCtx, "alice@example.com") if err != nil { t.Fatalf("expected nil error, got %v", err) } @@ -72,9 +72,9 @@ func TestRequestPasswordResetUseCase(t *testing.T) { t.Run("The use case swallows an unknown email and returns nil without touching the repository or mailer", func(t *testing.T) { repo := newMockUserRepo() mailRepo := newMockMailRepo() - uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com") + uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder) - err := uc.RequestPasswordReset("nobody@example.com") + err := uc.RequestPasswordReset(testCtx, "nobody@example.com") if err != nil { t.Fatalf("expected nil error, got %v", err) } @@ -90,10 +90,10 @@ func TestRequestPasswordResetUseCase(t *testing.T) { repo := newRequestPasswordResetTestUserRepo() mailRepo := newMockMailRepo() mailRepo.fail.failNext("Send") - uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com") + uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder) logBuf := captureRequestPasswordResetLog(t) - err := uc.RequestPasswordReset("alice@example.com") + err := uc.RequestPasswordReset(testCtx, "alice@example.com") if err != nil { t.Fatalf("expected nil error, got %v", err) } @@ -111,10 +111,10 @@ func TestRequestPasswordResetUseCase(t *testing.T) { t.Run("The use case logs and swallows a hashing failure", func(t *testing.T) { repo := newRequestPasswordResetTestUserRepo() mailRepo := newMockMailRepo() - uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{hashErr: errStubHashFailure}, mailRepo, "https://cms.example.com") + uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{hashErr: errStubHashFailure}, mailRepo, "https://cms.example.com", discardRecorder) logBuf := captureRequestPasswordResetLog(t) - err := uc.RequestPasswordReset("alice@example.com") + err := uc.RequestPasswordReset(testCtx, "alice@example.com") if err != nil { t.Fatalf("expected nil error, got %v", err) } @@ -136,10 +136,10 @@ func TestRequestPasswordResetUseCase(t *testing.T) { repo := newRequestPasswordResetTestUserRepo() repo.fail.failNext("UpdatePasswordResetCode") mailRepo := newMockMailRepo() - uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com") + uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder) logBuf := captureRequestPasswordResetLog(t) - err := uc.RequestPasswordReset("alice@example.com") + err := uc.RequestPasswordReset(testCtx, "alice@example.com") if err != nil { t.Fatalf("expected nil error, got %v", err) } @@ -160,9 +160,9 @@ func TestRequestPasswordResetUseCase(t *testing.T) { repo.users[2] = user.User{ID: 2, Email: "bob@example.com", IsVerified: false} repo.nextID = 2 mailRepo := newMockMailRepo() - uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com") + uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com", discardRecorder) - err := uc.RequestPasswordReset("alice@example.com") + err := uc.RequestPasswordReset(testCtx, "alice@example.com") if err != nil { t.Fatalf("expected nil error, got %v", err) } diff --git a/test/reset_password_http_test.go b/test/reset_password_http_test.go index 85933b4..6b9ab5d 100644 --- a/test/reset_password_http_test.go +++ b/test/reset_password_http_test.go @@ -18,8 +18,8 @@ import ( func newResetPasswordRouter(userRepo *mockUserRepo, hasher *stubHasher) *chi.Mux { mailRepo := newMockMailRepo() passwordResetHandler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) r := chi.NewRouter() diff --git a/test/reset_password_test.go b/test/reset_password_test.go index 29342fd..82752e9 100644 --- a/test/reset_password_test.go +++ b/test/reset_password_test.go @@ -22,9 +22,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("The use case itself sets the password and clears the code in one write, independently of any handler", func(t *testing.T) { repo := newRepo(time.Now().Add(time.Hour)) - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "reset-code-1", "newpassword1") if err != nil { t.Fatalf("expected no error, got %v", err) @@ -49,9 +49,9 @@ func TestResetPasswordUseCase(t *testing.T) { PasswordResetCode: "hashed:reset-code-1", PasswordResetExpiration: time.Now().Add(time.Hour), } - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "reset-code-1", "newpassword1") if err != nil { t.Fatalf("expected no error, got %v", err) @@ -63,9 +63,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("The use case rejects a wrong code without touching the repository's ResetPassword method", func(t *testing.T) { repo := newRepo(time.Now().Add(time.Hour)) - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "wrong-code", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "wrong-code", "newpassword1") if !errors.Is(err, user.ErrInvalidPasswordResetCode) { t.Errorf("expected user.ErrInvalidPasswordResetCode, got %v", err) @@ -77,9 +77,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("The use case rejects an expired code without touching the repository's ResetPassword method", func(t *testing.T) { repo := newRepo(time.Now().Add(-time.Hour)) - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "reset-code-1", "newpassword1") if !errors.Is(err, user.ErrPasswordResetCodeExpired) { t.Errorf("expected user.ErrPasswordResetCodeExpired, got %v", err) @@ -91,9 +91,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("The use case treats an unknown email the same as a wrong code", func(t *testing.T) { repo := newMockUserRepo() - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("nobody@example.com", "any-code", "newpassword1") + err := uc.ResetPassword(testCtx, "nobody@example.com", "any-code", "newpassword1") if !errors.Is(err, user.ErrInvalidPasswordResetCode) { t.Errorf("expected user.ErrInvalidPasswordResetCode, got %v", err) @@ -107,9 +107,9 @@ func TestResetPasswordUseCase(t *testing.T) { repo := newMockUserRepo() repo.users[3] = user.User{ID: 3, Email: "alice@example.com", PasswordResetCode: ""} hasher := &stubHasher{} - uc := useCases.NewResetPasswordUseCase(repo, hasher, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "anything", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "anything", "newpassword1") if !errors.Is(err, user.ErrInvalidPasswordResetCode) { t.Errorf("expected user.ErrInvalidPasswordResetCode, got %v", err) @@ -125,9 +125,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("The use case treats any GetByEmail failure, not just not-found, as an invalid code", func(t *testing.T) { repo := newRepo(time.Now().Add(time.Hour)) repo.fail.failNextWith("GetByEmail", errors.New("db is down")) - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "reset-code-1", "newpassword1") if !errors.Is(err, user.ErrInvalidPasswordResetCode) { t.Errorf("expected user.ErrInvalidPasswordResetCode, got %v", err) @@ -140,9 +140,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("A hashing failure propagates and the repository's ResetPassword method is never called", func(t *testing.T) { repo := newRepo(time.Now().Add(time.Hour)) hashErr := errors.New("hash blew up") - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{hashErr: hashErr}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{hashErr: hashErr}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "reset-code-1", "newpassword1") if !errors.Is(err, hashErr) { t.Errorf("expected %v, got %v", hashErr, err) @@ -155,9 +155,9 @@ func TestResetPasswordUseCase(t *testing.T) { t.Run("A failure in the repository's ResetPassword method propagates", func(t *testing.T) { repo := newRepo(time.Now().Add(time.Hour)) repo.fail.failNext("ResetPassword") - uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now) + uc := useCases.NewResetPasswordUseCase(repo, &stubHasher{}, newMockAPIKeyRepo(), time.Now, discardRecorder) - err := uc.ResetPassword("alice@example.com", "reset-code-1", "newpassword1") + err := uc.ResetPassword(testCtx, "alice@example.com", "reset-code-1", "newpassword1") if !errors.Is(err, errRepositoryFailure) { t.Errorf("expected %v, got %v", errRepositoryFailure, err) diff --git a/test/runtime_settings_injection_http_test.go b/test/runtime_settings_injection_http_test.go index 290907c..4bf72d1 100644 --- a/test/runtime_settings_injection_http_test.go +++ b/test/runtime_settings_injection_http_test.go @@ -36,7 +36,7 @@ func newSecureCookieAuthRouter(t *testing.T, isProduction bool) (*chi.Mux, *mock loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), isProduction, ) @@ -136,7 +136,7 @@ func newRuntimeSettingsContainer(t *testing.T) *api.UseCases { DeleteArticleUseCase: useCases.NewDeleteArticleUseCase(articleRepo), GetUserUseCase: useCases.NewGetUserUseCase(userRepo), CreateUserUseCase: useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(userRepo, hasher), + AuthenticateUserUseCase: useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), CancelRegistrationUseCase: useCases.NewCancelRegistrationUseCase(userRepo), ListUsersUseCase: useCases.NewListUsersUseCase(userRepo), SendMailUseCase: useCases.NewSendMailUseCase(mailRepo), diff --git a/test/settings_http_test.go b/test/settings_http_test.go index 4a4c5aa..386b6c7 100644 --- a/test/settings_http_test.go +++ b/test/settings_http_test.go @@ -17,7 +17,11 @@ import ( func newSettingsRouter(userRepo *mockUserRepo, token *jwtauth.JWTAuth, version string) *chi.Mux { getUserUseCase := useCases.NewGetUserUseCase(userRepo) - settingsHandler := settings.NewHandler(useCases.NewGetSettingsUseCase(version)) + settingsHandler := settings.NewHandler( + useCases.NewGetSettingsUseCase(version), + useCases.NewGetActivityRetentionUseCase(newActivitySettingsFake()), + useCases.NewUpdateActivityRetentionUseCase(newActivitySettingsFake(), discardRecorder), + ) r := chi.NewRouter() r.Route("/v1/settings", func(r chi.Router) { @@ -30,6 +34,10 @@ func newSettingsRouter(userRepo *mockUserRepo, token *jwtauth.JWTAuth, version s return r } +func settingsBody(version string) string { + return `{"version":"` + version + `","activity_retention_days":90,"activity_last_cleanup_at":null,"activity_last_cleanup_removed":0}` +} + func TestSettingsHttp(t *testing.T) { validator.InitValidator() @@ -46,7 +54,7 @@ func TestSettingsHttp(t *testing.T) { if rec.Code != http.StatusOK { t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String()) } - if rec.Body.String() != `{"version":"`+version+`"}` { + if rec.Body.String() != settingsBody(version) { t.Errorf("unexpected body: %q", rec.Body.String()) } }) @@ -65,7 +73,7 @@ func TestSettingsHttp(t *testing.T) { if rec.Code != http.StatusOK { t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String()) } - if rec.Body.String() != `{"version":"v2.2.0-beta"}` { + if rec.Body.String() != settingsBody("v2.2.0-beta") { t.Errorf("unexpected body: %q", rec.Body.String()) } }) diff --git a/test/sqlite_schema_unchanged_test.go b/test/sqlite_schema_unchanged_test.go index 7f75a97..d34fb33 100644 --- a/test/sqlite_schema_unchanged_test.go +++ b/test/sqlite_schema_unchanged_test.go @@ -5,6 +5,7 @@ import ( "fmt" "path/filepath" "reflect" + "strings" "testing" "time" @@ -167,6 +168,11 @@ func TestSQLiteSchemaIsUntouchedByTheModelChanges(t *testing.T) { } after := takeSqliteSnapshot(t, db) + for name := range after.schema { + if strings.HasPrefix(name, "audit_") || strings.HasPrefix(name, "idx_audit_") { + delete(after.schema, name) + } + } if !reflect.DeepEqual(before.schema, after.schema) { t.Errorf("schema changed:\nbefore %v\nafter %v", before.schema, after.schema) } diff --git a/test/stale_token_invalidation_http_test.go b/test/stale_token_invalidation_http_test.go index 1f404f7..ad6515d 100644 --- a/test/stale_token_invalidation_http_test.go +++ b/test/stale_token_invalidation_http_test.go @@ -33,7 +33,7 @@ func newStaleTokenInvalidationRouter(userRepo *mockUserRepo, articleRepo *mockAr loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) verificationHandler := auth.NewVerificationHandler( @@ -42,8 +42,8 @@ func newStaleTokenInvalidationRouter(userRepo *mockUserRepo, articleRepo *mockAr true, ) passwordResetHandler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) r := chi.NewRouter() diff --git a/test/trusted_proxy_client_ip_for_rate_limiting_http_test.go b/test/trusted_proxy_client_ip_for_rate_limiting_http_test.go index ca07dff..2d494d6 100644 --- a/test/trusted_proxy_client_ip_for_rate_limiting_http_test.go +++ b/test/trusted_proxy_client_ip_for_rate_limiting_http_test.go @@ -24,12 +24,12 @@ func newTrustedProxyAuthRouter(t *testing.T, userRepo user.Repository, mailRepo loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) passwordResetHandler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) r := chi.NewRouter() diff --git a/test/unverified_users_and_reregistration_test.go b/test/unverified_users_and_reregistration_test.go index 8fe52ba..bf0142a 100644 --- a/test/unverified_users_and_reregistration_test.go +++ b/test/unverified_users_and_reregistration_test.go @@ -156,7 +156,7 @@ func newUnverifiedRegistrationRouter(userRepo *mockUserRepo, token *jwtauth.JWTA loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) diff --git a/test/user_display_name_test.go b/test/user_display_name_test.go index 8829e9b..ac51b38 100644 --- a/test/user_display_name_test.go +++ b/test/user_display_name_test.go @@ -31,7 +31,7 @@ func newDisplayNameRouter(userRepo *mockUserRepo, token *jwtauth.JWTAuth) *chi.M loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, newMockMailRepo(), "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) diff --git a/test/user_response_field_hygiene_test.go b/test/user_response_field_hygiene_test.go index cfab092..eb2a7c2 100644 --- a/test/user_response_field_hygiene_test.go +++ b/test/user_response_field_hygiene_test.go @@ -22,7 +22,7 @@ func newUserFieldHygieneRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, t loginHandler := auth.NewLoginHandler( token, useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewAuthenticateUserUseCase(userRepo, hasher), + useCases.NewAuthenticateUserUseCase(userRepo, hasher, discardRecorder), true, ) verificationHandler := auth.NewVerificationHandler( @@ -31,8 +31,8 @@ func newUserFieldHygieneRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, t true, ) passwordResetHandler := auth.NewPasswordResetHandler( - useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"), - useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now), + useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com", discardRecorder), + useCases.NewResetPasswordUseCase(userRepo, hasher, newMockAPIKeyRepo(), time.Now, discardRecorder), ) r := chi.NewRouter() diff --git a/test/user_roles_test.go b/test/user_roles_test.go index 072f5fd..be1ef59 100644 --- a/test/user_roles_test.go +++ b/test/user_roles_test.go @@ -51,7 +51,7 @@ func newUserRolesFixture(t *testing.T, maxAttempts int) *userRolesFixture { loginHandler := auth.NewLoginHandler( f.token, useCases.NewCreateUserUseCase(f.users, hasher, f.mail, invitePublicURL), - useCases.NewAuthenticateUserUseCase(f.users, hasher), + useCases.NewAuthenticateUserUseCase(f.users, hasher, discardRecorder), true, ) acceptHandler := auth.NewAcceptInviteHandler(