Changeset 0.9.2 (#52)

server/handlers/teams.go

@@ -631,3 +631,125 @@ func enforcePrivateProviderPolicy(userID, configID string) error {
 	}
 	return nil
 }
+
+// ── Team Audit Log (scoped to team members) ─
+
+// ListTeamAuditLog returns paginated audit entries where the actor is a member
+// of the specified team. Team admins see only their team's activity; system
+// admins see everything (but the scoping still applies via the same query).
+// GET /api/v1/teams/:teamId/audit?page=1&per_page=50&action=...&actor_id=...&resource_type=...
+func (h *TeamHandler) ListTeamAuditLog(c *gin.Context) {
+	teamID := c.Param("teamId")
+	page, perPage, offset := parsePagination(c)
+
+	// Build filter clauses — always scoped to team members
+	where := "WHERE al.actor_id IN (SELECT user_id FROM team_members WHERE team_id = $1)"
+	args := []interface{}{teamID}
+	argN := 2
+
+	if action := c.Query("action"); action != "" {
+		where += " AND al.action = $" + strconv.Itoa(argN)
+		args = append(args, action)
+		argN++
+	}
+	if actorID := c.Query("actor_id"); actorID != "" {
+		where += " AND al.actor_id = $" + strconv.Itoa(argN)
+		args = append(args, actorID)
+		argN++
+	}
+	if rt := c.Query("resource_type"); rt != "" {
+		where += " AND al.resource_type = $" + strconv.Itoa(argN)
+		args = append(args, rt)
+		argN++
+	}
+
+	// Count
+	var total int
+	countArgs := make([]interface{}, len(args))
+	copy(countArgs, args)
+	err := database.DB.QueryRow(`SELECT COUNT(*) FROM audit_log al `+where, countArgs...).Scan(&total)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "count failed"})
+		return
+	}
+
+	// Query with actor name join
+	query := `
+		SELECT al.id, al.actor_id, COALESCE(u.username, '') as actor_name,
+		       al.action, al.resource_type, al.resource_id,
+		       COALESCE(al.metadata::text, '{}'), al.ip_address, al.created_at
+		FROM audit_log al
+		LEFT JOIN users u ON al.actor_id = u.id
+		` + where + `
+		ORDER BY al.created_at DESC
+		LIMIT $` + strconv.Itoa(argN) + ` OFFSET $` + strconv.Itoa(argN+1)
+	args = append(args, perPage, offset)
+
+	rows, err := database.DB.Query(query, args...)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
+		return
+	}
+	defer rows.Close()
+
+	type entry struct {
+		ID           string  `json:"id"`
+		ActorID      *string `json:"actor_id"`
+		ActorName    *string `json:"actor_name"`
+		Action       string  `json:"action"`
+		ResourceType string  `json:"resource_type"`
+		ResourceID   *string `json:"resource_id"`
+		Metadata     string  `json:"metadata"`
+		IPAddress    *string `json:"ip_address"`
+		CreatedAt    string  `json:"created_at"`
+	}
+
+	entries := make([]entry, 0)
+	for rows.Next() {
+		var e entry
+		var actorName sql.NullString
+		if err := rows.Scan(&e.ID, &e.ActorID, &actorName, &e.Action,
+			&e.ResourceType, &e.ResourceID, &e.Metadata, &e.IPAddress, &e.CreatedAt); err != nil {
+			continue
+		}
+		if actorName.Valid {
+			e.ActorName = &actorName.String
+		}
+		entries = append(entries, e)
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"data":     entries,
+		"total":    total,
+		"page":     page,
+		"per_page": perPage,
+	})
+}
+
+// ListTeamAuditActions returns distinct action names for audit entries within
+// the team scope, for filter dropdowns.
+// GET /api/v1/teams/:teamId/audit/actions
+func (h *TeamHandler) ListTeamAuditActions(c *gin.Context) {
+	teamID := c.Param("teamId")
+
+	rows, err := database.DB.Query(`
+		SELECT DISTINCT al.action
+		FROM audit_log al
+		WHERE al.actor_id IN (SELECT user_id FROM team_members WHERE team_id = $1)
+		ORDER BY al.action ASC
+	`, teamID)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{"actions": []string{}})
+		return
+	}
+	defer rows.Close()
+
+	actions := make([]string, 0)
+	for rows.Next() {
+		var a string
+		if rows.Scan(&a) == nil {
+			actions = append(actions, a)
+		}
+	}
+	c.JSON(http.StatusOK, gin.H{"actions": actions})
+}