Changeset 0.28.0.4 (#176)
This commit is contained in:
@@ -1,21 +1,21 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/google/uuid"
|
||||
|
||||
"git.gobha.me/xcaliber/chat-switchboard/database"
|
||||
"git.gobha.me/xcaliber/chat-switchboard/models"
|
||||
"git.gobha.me/xcaliber/chat-switchboard/store"
|
||||
)
|
||||
|
||||
// AuditLog inserts an audit entry. Called from mutating handlers.
|
||||
// AuditLog writes an audit entry via the store interface.
|
||||
// Non-blocking: errors are logged but don't break the caller.
|
||||
func AuditLog(c *gin.Context, action, resourceType, resourceID string, metadata map[string]interface{}) {
|
||||
if database.DB == nil {
|
||||
func AuditLog(auditStore store.AuditStore, c *gin.Context, action, resourceType, resourceID string, metadata map[string]interface{}) {
|
||||
if auditStore == nil {
|
||||
return
|
||||
}
|
||||
|
||||
@@ -24,165 +24,51 @@ func AuditLog(c *gin.Context, action, resourceType, resourceID string, metadata
|
||||
return
|
||||
}
|
||||
|
||||
ip := c.ClientIP()
|
||||
ua := c.GetHeader("User-Agent")
|
||||
|
||||
metaJSON := "{}"
|
||||
var meta models.JSONMap
|
||||
if metadata != nil {
|
||||
if b, err := json.Marshal(metadata); err == nil {
|
||||
metaJSON = string(b)
|
||||
}
|
||||
b, _ := json.Marshal(metadata)
|
||||
json.Unmarshal(b, &meta)
|
||||
}
|
||||
|
||||
if database.IsSQLite() {
|
||||
_, _ = database.DB.Exec(`
|
||||
INSERT INTO audit_log (id, actor_id, action, resource_type, resource_id, metadata, ip_address, user_agent)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
|
||||
`, uuid.New().String(), actorID, action, resourceType, resourceID, metaJSON, ip, ua)
|
||||
} else {
|
||||
_, _ = database.DB.Exec(`
|
||||
INSERT INTO audit_log (actor_id, action, resource_type, resource_id, metadata, ip_address, user_agent)
|
||||
VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7)
|
||||
`, actorID, action, resourceType, resourceID, metaJSON, ip, ua)
|
||||
}
|
||||
}
|
||||
|
||||
// AuditLogAnon inserts an audit entry without a gin context (e.g. system actions).
|
||||
func AuditLogAnon(action, resourceType, resourceID string, metadata map[string]interface{}) {
|
||||
if database.DB == nil {
|
||||
return
|
||||
}
|
||||
metaJSON := "{}"
|
||||
if metadata != nil {
|
||||
if b, err := json.Marshal(metadata); err == nil {
|
||||
metaJSON = string(b)
|
||||
}
|
||||
entry := &models.AuditEntry{
|
||||
ActorID: &actorID,
|
||||
Action: action,
|
||||
ResourceType: resourceType,
|
||||
ResourceID: resourceID,
|
||||
Metadata: meta,
|
||||
IPAddress: c.ClientIP(),
|
||||
UserAgent: c.GetHeader("User-Agent"),
|
||||
}
|
||||
|
||||
if database.IsSQLite() {
|
||||
_, _ = database.DB.Exec(`
|
||||
INSERT INTO audit_log (id, action, resource_type, resource_id, metadata)
|
||||
VALUES (?, ?, ?, ?, ?)
|
||||
`, uuid.New().String(), action, resourceType, resourceID, metaJSON)
|
||||
} else {
|
||||
_, _ = database.DB.Exec(`
|
||||
INSERT INTO audit_log (action, resource_type, resource_id, metadata)
|
||||
VALUES ($1, $2, $3, $4::jsonb)
|
||||
`, action, resourceType, resourceID, metaJSON)
|
||||
}
|
||||
}
|
||||
|
||||
// AuditLogWithActor inserts an audit entry with an explicit actor ID (e.g. pre-auth flows).
|
||||
func AuditLogWithActor(actorID string, c *gin.Context, action, resourceType, resourceID string, metadata map[string]interface{}) {
|
||||
if database.DB == nil || actorID == "" {
|
||||
return
|
||||
}
|
||||
ip := c.ClientIP()
|
||||
ua := c.GetHeader("User-Agent")
|
||||
metaJSON := "{}"
|
||||
if metadata != nil {
|
||||
if b, err := json.Marshal(metadata); err == nil {
|
||||
metaJSON = string(b)
|
||||
}
|
||||
}
|
||||
|
||||
if database.IsSQLite() {
|
||||
_, _ = database.DB.Exec(`
|
||||
INSERT INTO audit_log (id, actor_id, action, resource_type, resource_id, metadata, ip_address, user_agent)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
|
||||
`, uuid.New().String(), actorID, action, resourceType, resourceID, metaJSON, ip, ua)
|
||||
} else {
|
||||
_, _ = database.DB.Exec(`
|
||||
INSERT INTO audit_log (actor_id, action, resource_type, resource_id, metadata, ip_address, user_agent)
|
||||
VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7)
|
||||
`, actorID, action, resourceType, resourceID, metaJSON, ip, ua)
|
||||
if err := auditStore.Log(context.Background(), entry); err != nil {
|
||||
log.Printf("audit log error: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// ── Admin Audit Viewer ──────────────────────
|
||||
|
||||
type auditEntry struct {
|
||||
ID string `json:"id"`
|
||||
ActorID *string `json:"actor_id"`
|
||||
ActorName *string `json:"actor_name"`
|
||||
Action string `json:"action"`
|
||||
ResourceType string `json:"resource_type"`
|
||||
ResourceID *string `json:"resource_id"`
|
||||
Metadata string `json:"metadata"`
|
||||
IPAddress *string `json:"ip_address"`
|
||||
CreatedAt string `json:"created_at"`
|
||||
}
|
||||
|
||||
// ListAuditLog returns paginated audit entries with optional filters.
|
||||
// GET /api/v1/admin/audit?page=1&per_page=50&action=user.create&actor_id=...&resource_type=...
|
||||
func (h *AdminHandler) ListAuditLog(c *gin.Context) {
|
||||
page, perPage, offset := parsePagination(c)
|
||||
|
||||
// Build filter clauses with ? placeholders, convert for Postgres later
|
||||
where := "WHERE 1=1"
|
||||
args := []interface{}{}
|
||||
|
||||
if action := c.Query("action"); action != "" {
|
||||
where += " AND al.action = ?"
|
||||
args = append(args, action)
|
||||
}
|
||||
if actorID := c.Query("actor_id"); actorID != "" {
|
||||
where += " AND al.actor_id = ?"
|
||||
args = append(args, actorID)
|
||||
}
|
||||
if rt := c.Query("resource_type"); rt != "" {
|
||||
where += " AND al.resource_type = ?"
|
||||
args = append(args, rt)
|
||||
opts := store.AuditListOptions{
|
||||
ListOptions: store.ListOptions{
|
||||
Limit: perPage,
|
||||
Offset: offset,
|
||||
},
|
||||
Action: c.Query("action"),
|
||||
ActorID: c.Query("actor_id"),
|
||||
ResourceType: c.Query("resource_type"),
|
||||
}
|
||||
|
||||
// Count
|
||||
var total int
|
||||
countArgs := make([]interface{}, len(args))
|
||||
copy(countArgs, args)
|
||||
countQ := convertPlaceholders(`SELECT COUNT(*) FROM audit_log al ` + where)
|
||||
err := database.DB.QueryRow(countQ, countArgs...).Scan(&total)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": "count failed"})
|
||||
return
|
||||
}
|
||||
|
||||
// Query — metadata column needs ::text on Postgres only
|
||||
metadataCol := "COALESCE(al.metadata::text, '{}')"
|
||||
if database.IsSQLite() {
|
||||
metadataCol = "COALESCE(al.metadata, '{}')"
|
||||
}
|
||||
|
||||
query := fmt.Sprintf(`
|
||||
SELECT al.id, al.actor_id, COALESCE(u.username, '') as actor_name,
|
||||
al.action, al.resource_type, al.resource_id,
|
||||
%s, al.ip_address, al.created_at
|
||||
FROM audit_log al
|
||||
LEFT JOIN users u ON al.actor_id = u.id
|
||||
%s
|
||||
ORDER BY al.created_at DESC
|
||||
LIMIT ? OFFSET ?`, metadataCol, where)
|
||||
args = append(args, perPage, offset)
|
||||
|
||||
query = convertPlaceholders(query)
|
||||
rows, err := database.DB.Query(query, args...)
|
||||
entries, total, err := h.stores.Audit.List(c.Request.Context(), opts)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
|
||||
return
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
entries := make([]auditEntry, 0)
|
||||
for rows.Next() {
|
||||
var e auditEntry
|
||||
var actorName sql.NullString
|
||||
if err := rows.Scan(&e.ID, &e.ActorID, &actorName, &e.Action,
|
||||
&e.ResourceType, &e.ResourceID, &e.Metadata, &e.IPAddress, &e.CreatedAt); err != nil {
|
||||
continue
|
||||
}
|
||||
if actorName.Valid {
|
||||
e.ActorName = &actorName.String
|
||||
}
|
||||
entries = append(entries, e)
|
||||
if entries == nil {
|
||||
entries = []models.AuditEntry{}
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
@@ -196,24 +82,10 @@ func (h *AdminHandler) ListAuditLog(c *gin.Context) {
|
||||
// ListAuditActions returns distinct action names for filter dropdowns.
|
||||
// GET /api/v1/admin/audit/actions
|
||||
func (h *AdminHandler) ListAuditActions(c *gin.Context) {
|
||||
rows, err := database.DB.Query(`
|
||||
SELECT DISTINCT action FROM audit_log ORDER BY action ASC
|
||||
`)
|
||||
actions, err := h.stores.Audit.ListActions(c.Request.Context())
|
||||
if err != nil {
|
||||
c.JSON(http.StatusOK, gin.H{"actions": []string{}})
|
||||
return
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var actions []string
|
||||
for rows.Next() {
|
||||
var a string
|
||||
if rows.Scan(&a) == nil {
|
||||
actions = append(actions, a)
|
||||
}
|
||||
}
|
||||
if actions == nil {
|
||||
actions = []string{}
|
||||
}
|
||||
c.JSON(http.StatusOK, gin.H{"actions": actions})
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user