@anteros/core 0.0.39 → 0.0.41

package/tests/audit-file.test.ts

@@ -0,0 +1,296 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import fs from "node:fs";
+import path from "node:path";
+import { useRest } from "../database/rest";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants, getTenant } from "../database/tenant";
+import { resolveAuditFile, writeAuditFile, flushAuditFile, pruneAuditFiles } from "../lib/audit";
+import type { AuditFileOptions } from "../lib/audit";
+
+const DIR = path.join(import.meta.dir, ".tmp-audit-file");
+const TODAY = new Date().toISOString().slice(0, 10);
+
+/** Minimal activity document (same shape as `ActivityInput`). */
+function activity(action: string, collection = "items") {
+    return {
+        internal: true,
+        trace: { id: crypto.randomUUID() },
+        meta: {},
+        operation: {
+            tenant: "test",
+            action,
+            collection,
+            status: "success",
+            input: null,
+            result: null,
+            error: null,
+            duration: 0,
+            transaction: false,
+        },
+        ts: new Date(),
+    } as any;
+}
+
+function readLines(file: string): any[] {
+    return fs.readFileSync(file, "utf-8").trim().split("\n").filter(Boolean).map((l) => JSON.parse(l));
+}
+
+function filesOf(dir: string, tenantId: string): string[] {
+    try {
+        return fs.readdirSync(dir).filter((f) => f.startsWith(`audit-${tenantId}-`)).sort();
+    } catch {
+        return [];
+    }
+}
+
+beforeAll(() => {
+    try { fs.rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+afterAll(() => {
+    // `cfg.server` is shared by every test file in the same process: never leak
+    // the audit sink into the other suites (they would write files too)
+    delete (cfg.server as any).audit;
+    try { fs.rmSync(DIR, { recursive: true, force: true }); } catch {};
+});
+
+// ─── Disabled by default ────────────────────────────────────────────────
+
+describe("audit file — disabled by default", () => {
+    const TENANT = "af-off";
+    let rest: InstanceType<typeof useRest>;
+
+    beforeAll(async () => {
+        formatConfig({
+            server: { port: 4000 },
+            tenants: [{ id: TENANT, dir: "src", database: { uri: "mongodb://localhost:27017/_AUDIT_FILE_OFF" } }],
+        });
+        await syncTenants();
+        rest = new useRest({ internal: true, tenant_id: TENANT });
+    });
+
+    it("writes nothing when no config is set anywhere", async () => {
+        await rest.audit.addActivities([activity("off")]);
+        await flushAuditFile();
+
+        expect(filesOf(DIR, TENANT)).toEqual([]);
+        expect(fs.existsSync(path.join(DIR, TENANT))).toBe(false);
+    });
+
+    it("resolves to null", () => {
+        expect(resolveAuditFile({ id: TENANT, dir: "src", database: { uri: "" } } as any)).toBeNull();
+    });
+});
+
+// ─── Configured (tenant level and server default) ───────────────────────
+
+describe("audit file — writes and rotation", () => {
+    const TENANT = "af-tenant";
+    const ROT = "af-rot";
+    const OPTOUT = "af-optout";
+    const DIR_TENANT = path.join(DIR, "tenant");
+    const DIR_ROT = path.join(DIR, "rot");
+    const DIR_SERVER = path.join(DIR, "server");
+
+    let rest: InstanceType<typeof useRest>;
+    let rot: InstanceType<typeof useRest>;
+    let optout: InstanceType<typeof useRest>;
+
+    beforeAll(async () => {
+        formatConfig({
+            server: {
+                port: 4000,
+                // Server-wide default: everything goes to <DIR>/server unless a tenant says otherwise
+                audit: { file: { dir: DIR_SERVER } },
+            },
+            tenants: [
+                {
+                    id: TENANT,
+                    dir: "src",
+                    database: { uri: "mongodb://localhost:27017/_AUDIT_FILE_TENANT" },
+                    // Tenant wins: own dir + 7d retention (default size cap)
+                    audit: { file: { dir: DIR_TENANT, retention: "7d" } },
+                },
+                {
+                    id: ROT,
+                    dir: "src",
+                    database: { uri: "mongodb://localhost:27017/_AUDIT_FILE_ROT" },
+                    // Cap is set by the rotation test itself, once the real line size is known
+                    audit: { file: { dir: DIR_ROT } },
+                },
+                {
+                    id: OPTOUT,
+                    dir: "src",
+                    database: { uri: "mongodb://localhost:27017/_AUDIT_FILE_OPTOUT" },
+                    audit: { file: false }, // opt out of the server default
+                },
+            ],
+        });
+        await syncTenants();
+        rest = new useRest({ internal: true, tenant_id: TENANT });
+        rot = new useRest({ internal: true, tenant_id: ROT });
+        optout = new useRest({ internal: true, tenant_id: OPTOUT });
+    });
+
+    it("appends one JSONL line per activity, in a dated file", async () => {
+        await rest.audit.addActivities([activity("first"), activity("second")]);
+        await flushAuditFile();
+
+        const files = filesOf(DIR_TENANT, TENANT);
+        expect(files).toEqual([`audit-${TENANT}-${TODAY}.jsonl`]);
+
+        const lines = readLines(path.join(DIR_TENANT, files[0]!));
+        expect(lines.length).toBe(2);
+        expect(lines.map((l) => l.operation.action)).toEqual(["first", "second"]);
+        expect(typeof lines[0]!.ts).toBe("string"); // Date serialized as ISO
+    });
+
+    it("appends (never truncates) on the next call", async () => {
+        await rest.audit.addActivities([activity("third")]);
+        await flushAuditFile();
+
+        const lines = readLines(path.join(DIR_TENANT, `audit-${TENANT}-${TODAY}.jsonl`));
+        expect(lines.map((l) => l.operation.action)).toEqual(["first", "second", "third"]);
+    });
+
+    it("rotates when the size cap is reached", async () => {
+        // First activity reserves the plain file of the day
+        await rot.audit.addActivities([activity("rot-0")]);
+        await flushAuditFile();
+
+        const plain = path.join(DIR_ROT, `audit-${ROT}-${TODAY}.jsonl`);
+        const lineBytes = fs.statSync(plain).size;
+        // Cap sized so exactly two lines fit per file (line size is known now)
+        const cap = lineBytes * 2 + 5;
+        ((getTenant(ROT)!.audit!.file) as AuditFileOptions).maxSize = cap;
+
+        for (let i = 1; i < 4; i++) {
+            await rot.audit.addActivities([activity(`rot-${i}`)]);
+            await flushAuditFile();
+        }
+
+        // Chronological split: the plain file holds the two first lines,
+        // the `-1` rotation the next two
+        const files = filesOf(DIR_ROT, ROT);
+        const rotated = `audit-${ROT}-${TODAY}-1.jsonl`;
+        const name = `audit-${ROT}-${TODAY}.jsonl`;
+
+        expect(files.length).toBe(2);
+        expect(files).toContain(name);
+        expect(files).toContain(rotated);
+
+        const actions = (file: string) =>
+            readLines(path.join(DIR_ROT, file)).map((l) => l.operation.action);
+        expect(actions(name)).toEqual(["rot-0", "rot-1"]);
+        expect(actions(rotated)).toEqual(["rot-2", "rot-3"]);
+
+        // every file holds valid JSONL, stays under the cap, and no line is lost
+        for (const file of files) {
+            const raw = fs.readFileSync(path.join(DIR_ROT, file), "utf-8");
+            expect(raw.endsWith("\n")).toBe(true);
+            expect(raw.length).toBeLessThanOrEqual(cap);
+        }
+        expect([...actions(name), ...actions(rotated)])
+            .toEqual(["rot-0", "rot-1", "rot-2", "rot-3"]);
+    });
+
+    it("carries the `_id` assigned by MongoDB", async () => {
+        const files = filesOf(DIR_TENANT, TENANT);
+        const line = readLines(path.join(DIR_TENANT, files[0]!))[0]!;
+        expect(line._id).toBeString();
+        expect(line._id.length).toBe(24);
+    });
+
+    it("uses the server default when the tenant declares nothing", async () => {
+        const inherited = "af-inherit";
+        // Same server config, another tenant — resolved from `server.audit.file`
+        await rest.audit.addActivities([activity("own")]);
+        writeAuditFile({ id: inherited, dir: "src", database: { uri: "" } } as any, [activity("srv")]);
+        await flushAuditFile();
+
+        const files = filesOf(DIR_SERVER, inherited);
+        expect(files.length).toBe(1);
+        expect(readLines(path.join(DIR_SERVER, files[0]!))[0].operation.action).toBe("srv");
+    });
+
+    it("lets a tenant opt out of the server default with `false`", async () => {
+        await optout.audit.addActivities([activity("blocked")]);
+        await flushAuditFile();
+
+        expect(filesOf(DIR_SERVER, OPTOUT)).toEqual([]);
+        expect(filesOf(DIR_TENANT, OPTOUT)).toEqual([]);
+    });
+
+    it("prunes files older than the retention", async () => {
+        const stale = path.join(DIR_TENANT, `audit-${TENANT}-2020-01-01.jsonl`);
+        fs.writeFileSync(stale, "{}\n");
+        const old = new Date(Date.now() - 60 * 86400_000);
+        fs.utimesSync(stale, old, old);
+
+        const fresh = path.join(DIR_TENANT, `audit-${TENANT}-${TODAY}.jsonl`);
+        const before = filesOf(DIR_TENANT, TENANT);
+
+        const removed = await pruneAuditFiles(DIR_TENANT, TENANT, 7 * 86400_000);
+
+        expect(removed).toContain(`audit-${TENANT}-2020-01-01.jsonl`);
+        expect(fs.existsSync(stale)).toBe(false);
+        expect(fs.existsSync(fresh)).toBe(true);
+        expect(filesOf(DIR_TENANT, TENANT).length).toBe(before.length - 1);
+    });
+
+    it("only touches its own tenant's files", async () => {
+        const stale = path.join(DIR_TENANT, `audit-${OPTOUT}-2020-01-01.jsonl`);
+        fs.writeFileSync(stale, "{}\n");
+        const old = new Date(Date.now() - 60 * 86400_000);
+        fs.utimesSync(stale, old, old);
+
+        await pruneAuditFiles(DIR_TENANT, TENANT, 7 * 86400_000);
+
+        expect(fs.existsSync(stale)).toBe(true);
+        fs.rmSync(stale, { force: true });
+    });
+
+    it("mirrors the database retention when no file retention is set", () => {
+        const inherited = resolveAuditFile({
+            id: "x", dir: "src", database: { uri: "" }, audit: { retention: "30d", file: true },
+        } as any);
+        expect(inherited!.retentionMs).toBe(30 * 86400_000);
+        expect(inherited!.dir).toBe(path.join(".logs", "audit"));
+    });
+});
+
+// ─── Automatic pruning on first write ───────────────────────────────────
+
+describe("audit file — automatic pruning", () => {
+    const TENANT = "af-prune";
+    const DIR_PRUNE = path.join(DIR, "prune");
+    let rest: InstanceType<typeof useRest>;
+
+    beforeAll(async () => {
+        formatConfig({
+            server: { port: 4000 },
+            tenants: [{
+                id: TENANT,
+                dir: "src",
+                database: { uri: "mongodb://localhost:27017/_AUDIT_FILE_PRUNE" },
+                audit: { file: { dir: DIR_PRUNE, retention: "1d" } },
+            }],
+        });
+        await syncTenants();
+        rest = new useRest({ internal: true, tenant_id: TENANT });
+    });
+
+    it("deletes stale files on the first write, without waiting", async () => {
+        fs.mkdirSync(DIR_PRUNE, { recursive: true });
+        const stale = path.join(DIR_PRUNE, `audit-${TENANT}-2019-12-31.jsonl`);
+        fs.writeFileSync(stale, "{}\n");
+        const old = new Date(Date.now() - 30 * 86400_000);
+        fs.utimesSync(stale, old, old);
+
+        await rest.audit.addActivities([activity("trigger-prune")]);
+        await flushAuditFile();
+
+        expect(fs.existsSync(stale)).toBe(false);
+        expect(filesOf(DIR_PRUNE, TENANT).some((f) => f.includes(TODAY))).toBe(true);
+    });
+});

package/tests/audit-operations.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+
+const TENANT = "ops-test";
+const DB = "mongodb://localhost:27017/_AUDIT_OPS_TEST";
+const SLUG = "orders";
+const SERVICE = "billing";
+
+let internalRest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+/** Latest audited entry for an action, written *after* `since` (fire-and-forget logging) */
+async function lastActivity(action: string, since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await internalRest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": action, ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [{ name: "ref", type: "string" }],
+        api: { access: { "*": true } },
+    }];
+    (cfg as any).services = [{
+        _tenant_: TENANT,
+        name: SERVICE,
+        enabled: true,
+        actions: {
+            charge: async ({ data }: any) => ({ charged: data?.amount }),
+            boom: async () => { throw new Error("service-kaboom") },
+        },
+        api: { access: { "*": true } },
+    }];
+
+    internalRest = new useRest({ internal: true, tenant_id: TENANT });
+
+    await internalRest.insertMany(SLUG, [{ ref: "A-1" }, { ref: "A-2" }]);
+
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await internalRest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await internalRest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    try { server.stop(true); } catch {}
+});
+
+describe("audit — streams", () => {
+    it("audits `findStream` with its parameters and no result", async () => {
+        const since = new Date();
+        const docs: any[] = [];
+        for await (const doc of internalRest.findStream(SLUG, { $match: { ref: "A-1" } }, { batchSize: 10 })) {
+            docs.push(doc);
+        }
+        expect(docs.length).toBe(1); // the consumer really got the documents
+
+        const logged = await lastActivity("findStream", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.params).toEqual({ $match: { ref: "A-1" } });
+        expect(logged.operation.input.options).toEqual({ batchSize: 10 });
+        expect(logged.operation.result).toBeNull();
+        expect(logged.operation.status).toBe("success");
+        expect(typeof logged.operation.duration).toBe("number");
+    });
+
+    it("audits `aggregateStream` with its pipeline and no result", async () => {
+        const since = new Date();
+        const pipeline = [{ $match: { ref: "A-2" } }];
+        const rows: any[] = [];
+        for await (const doc of internalRest.aggregateStream(SLUG, pipeline, { batchSize: 10 })) {
+            rows.push(doc);
+        }
+        expect(rows.length).toBe(1);
+
+        const logged = await lastActivity("aggregateStream", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.pipeline).toEqual(pipeline);
+        expect(logged.operation.result).toBeNull();
+    });
+
+    it("audits a stream that breaks early (the entry is written on `finally`)", async () => {
+        const since = new Date();
+        for await (const _doc of internalRest.findStream(SLUG, {}, { batchSize: 1 })) {
+            break; // consumer stops after the first document
+        }
+
+        const logged = await lastActivity("findStream", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.status).toBe("success");
+    });
+
+    it("audits `watch` with its parameters and no result", async () => {
+        const since = new Date();
+        const pipeline = [{ $match: { "fullDocument.ref": "A-1" } }];
+        const stream = await internalRest.watch(SLUG, pipeline, {});
+        expect(stream).toBeDefined();
+
+        const logged = await lastActivity("watch", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.pipeline).toEqual(pipeline);
+        expect(logged.operation.result).toBeNull();
+
+        await stream.close().catch(() => {});
+    });
+});
+
+describe("audit — services", () => {
+    it("audits an internal `rest.runService` call and marks it as internal", async () => {
+        const since = new Date();
+        const result: any = await internalRest.runService(SERVICE, "charge", { amount: 42 });
+        expect(result).toEqual({ charged: 42 }); // the caller still gets the payload
+
+        const logged = await lastActivity("runService", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.collection).toBe(SERVICE);
+        expect(logged.operation.input.action).toBe("charge");
+        expect(logged.operation.input.data).toEqual({ amount: 42 });
+        expect(logged.operation.result).toBeNull();
+        expect(logged.internal).toBe(true);
+    });
+
+    it("audits the HTTP route once — not twice — and marks it as not internal", async () => {
+        const since = new Date();
+        const before = await internalRest.db.collection(AUDIT_COLLECTION)
+            .countDocuments({ "operation.action": "runService" });
+
+        const res = await fetch(`${url}/services/${TENANT}/${SERVICE}/charge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ data: { amount: 7 } }),
+        });
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({ charged: 7 });
+
+        await lastActivity("runService", since);
+        const after = await internalRest.db.collection(AUDIT_COLLECTION)
+            .countDocuments({ "operation.action": "runService" });
+
+        expect(after - before).toBe(1); // exactly one entry — the route no longer logs its own
+        const logged = await lastActivity("runService", since);
+        expect(logged.internal).toBe(false);
+        expect(logged.operation.input.data).toEqual({ amount: 7 });
+    });
+
+    it("records a failing service action with its error, and rethrows it unchanged", async () => {
+        const since = new Date();
+        await expect(internalRest.runService(SERVICE, "boom")).rejects.toThrow("service-kaboom");
+
+        const logged = await lastActivity("runService", since);
+        expect(logged.operation.status).toBe("error");
+        expect(logged.operation.error.message).toBe("service-kaboom");
+        expect(logged.operation.result).toBeNull();
+    });
+
+    it("records an unknown service", async () => {
+        const since = new Date();
+        await expect(internalRest.runService("nope", "charge")).rejects.toThrow();
+
+        const logged = await lastActivity("runService", since);
+        expect(logged.operation.status).toBe("error");
+        expect(logged.operation.error.code).toBe("SERVICE_NOT_FOUND");
+    });
+});