@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/core/audit/handler.go

@@ -0,0 +1,568 @@
+package audit
+
+import (
+	"context"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+
+	"{{module}}/internal/common/iamscope"
+	commonmw "{{module}}/internal/common/middleware"
+	"{{module}}/internal/common/response"
+	"{{module}}/pkg/apierror"
+)
+
+// ---------------------------------------------------------------------------
+// AuditHandler — 审计日志（合规审计记录）
+// ---------------------------------------------------------------------------
+
+// AuditHandler 审计日志 Admin HTTP 处理器
+type AuditHandler struct {
+	svc      AuditQueryService
+	resolver ActorResolver
+	logger   *zap.Logger
+}
+
+// NewAuditHandler 创建审计日志处理器
+func NewAuditHandler(svc AuditQueryService, resolver ActorResolver, logger *zap.Logger) *AuditHandler {
+	return &AuditHandler{
+		svc:      svc,
+		resolver: resolver,
+		logger:   logger.Named("AuditHandler"),
+	}
+}
+
+// ListAuditLogs 查询审计日志列表
+func (h *AuditHandler) ListAuditLogs(c *gin.Context) {
+	var req AdminListAuditLogsRequest
+	if err := c.ShouldBindQuery(&req); err != nil {
+		response.ValidationError(c, err)
+		return
+	}
+	req.Normalize()
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	logs, total, err := h.svc.ListAuditLogs(c.Request.Context(), &req, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	items := make([]*AdminAuditLogResponse, len(logs))
+	for i := range logs {
+		items[i] = ToAdminAuditLogResponse(logs[i])
+	}
+
+	h.enrichAuditReferences(c.Request.Context(), items)
+
+	response.OK(c, response.NewPaginated(items, req.Page, req.PageSize, total))
+}
+
+// GetAuditLog 查询审计日志详情
+func (h *AuditHandler) GetAuditLog(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, apierror.BadRequest(apierror.CodeValidationFailed, "Invalid audit log ID"))
+		return
+	}
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	log, err := h.svc.GetAuditLog(c.Request.Context(), id, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	resp := ToAdminAuditLogDetailResponse(log)
+	h.enrichAuditReferences(c.Request.Context(), []*AdminAuditLogResponse{resp})
+
+	response.OK(c, resp)
+}
+
+// GetStats 审计统计
+func (h *AuditHandler) GetStats(c *gin.Context) {
+	var req StatsRequest
+	if err := c.ShouldBindQuery(&req); err != nil {
+		response.ValidationError(c, err)
+		return
+	}
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	stats, err := h.svc.GetAuditStats(c.Request.Context(), req.DateFrom, req.DateTo, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	response.OK(c, stats)
+}
+
+// ListOperationLogs 查询操作日志列表
+func (h *AuditHandler) ListOperationLogs(c *gin.Context) {
+	var req AdminListOperationLogsRequest
+	if err := c.ShouldBindQuery(&req); err != nil {
+		response.ValidationError(c, err)
+		return
+	}
+	req.Normalize()
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	logs, total, err := h.svc.ListOperationLogs(c.Request.Context(), &req, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	items := make([]*AdminOperationLogResponse, len(logs))
+	for i := range logs {
+		items[i] = ToAdminOperationLogResponse(logs[i])
+	}
+	h.enrichOperationReferences(c.Request.Context(), items)
+
+	response.OK(c, response.NewPaginated(items, req.Page, req.PageSize, total))
+}
+
+// GetOperationLog 查询操作日志详情
+func (h *AuditHandler) GetOperationLog(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, apierror.BadRequest(apierror.CodeValidationFailed, "Invalid operation log ID"))
+		return
+	}
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	log, err := h.svc.GetOperationLog(c.Request.Context(), id, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	resp := ToAdminOperationLogDetailResponse(log)
+	h.enrichOperationReferences(c.Request.Context(), []*AdminOperationLogResponse{resp})
+
+	response.OK(c, resp)
+}
+
+// ---------------------------------------------------------------------------
+// AccessLogHandler — 访问日志（HTTP 请求级记录）
+// ---------------------------------------------------------------------------
+
+// AccessLogHandler 访问日志 Admin HTTP 处理器
+type AccessLogHandler struct {
+	svc      AuditQueryService
+	resolver ActorResolver
+	logger   *zap.Logger
+}
+
+// NewAccessLogHandler 创建访问日志处理器
+func NewAccessLogHandler(svc AuditQueryService, resolver ActorResolver, logger *zap.Logger) *AccessLogHandler {
+	return &AccessLogHandler{
+		svc:      svc,
+		resolver: resolver,
+		logger:   logger.Named("AccessLogHandler"),
+	}
+}
+
+// ListAccessLogs 查询访问日志列表
+func (h *AccessLogHandler) ListAccessLogs(c *gin.Context) {
+	var req AdminListAccessLogsRequest
+	if err := c.ShouldBindQuery(&req); err != nil {
+		response.ValidationError(c, err)
+		return
+	}
+	req.Normalize()
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	logs, total, err := h.svc.ListAccessLogs(c.Request.Context(), &req, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	items := make([]*AdminAccessLogResponse, len(logs))
+	for i := range logs {
+		items[i] = ToAdminAccessLogResponse(logs[i])
+	}
+
+	h.enrichAccessReferences(c.Request.Context(), items)
+
+	response.OK(c, response.NewPaginated(items, req.Page, req.PageSize, total))
+}
+
+// GetAccessLog 查询访问日志详情
+func (h *AccessLogHandler) GetAccessLog(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, apierror.BadRequest(apierror.CodeValidationFailed, "Invalid access log ID"))
+		return
+	}
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	log, err := h.svc.GetAccessLog(c.Request.Context(), id, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	resp := ToAdminAccessLogDetailResponse(log)
+	h.enrichAccessReferences(c.Request.Context(), []*AdminAccessLogResponse{resp})
+
+	response.OK(c, resp)
+}
+
+// ---------------------------------------------------------------------------
+// LoginLogHandler — 登录日志（认证安全事件）
+// ---------------------------------------------------------------------------
+
+// LoginLogHandler 登录日志 Admin HTTP 处理器
+type LoginLogHandler struct {
+	svc      AuditQueryService
+	resolver ActorResolver
+	logger   *zap.Logger
+}
+
+// NewLoginLogHandler 创建登录日志处理器
+func NewLoginLogHandler(svc AuditQueryService, resolver ActorResolver, logger *zap.Logger) *LoginLogHandler {
+	return &LoginLogHandler{
+		svc:      svc,
+		resolver: resolver,
+		logger:   logger.Named("LoginLogHandler"),
+	}
+}
+
+// ListLoginLogs 查询登录日志列表
+func (h *LoginLogHandler) ListLoginLogs(c *gin.Context) {
+	var req AdminListLoginLogsRequest
+	if err := c.ShouldBindQuery(&req); err != nil {
+		response.ValidationError(c, err)
+		return
+	}
+	req.Normalize()
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	logs, total, err := h.svc.ListLoginLogs(c.Request.Context(), &req, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	items := make([]*AdminLoginLogResponse, len(logs))
+	for i := range logs {
+		items[i] = ToAdminLoginLogResponse(logs[i])
+	}
+
+	h.enrichLoginReferences(c.Request.Context(), items)
+
+	response.OK(c, response.NewPaginated(items, req.Page, req.PageSize, total))
+}
+
+// GetLoginLog 查询登录日志详情
+func (h *LoginLogHandler) GetLoginLog(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, apierror.BadRequest(apierror.CodeValidationFailed, "Invalid login log ID"))
+		return
+	}
+	scope, principalID, err := scopeFromRequest(c)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	log, err := h.svc.GetLoginLog(c.Request.Context(), id, scope, principalID)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+
+	resp := ToAdminLoginLogDetailResponse(log)
+	h.enrichLoginReferences(c.Request.Context(), []*AdminLoginLogResponse{resp})
+
+	response.OK(c, resp)
+}
+
+// enrichAuditReferences 为审计日志填充可读主体与资源引用。
+func (h *AuditHandler) enrichAuditReferences(ctx context.Context, items []*AdminAuditLogResponse) {
+	ids := make(map[int64]struct{}, len(items))
+	for _, item := range items {
+		if item.ActorID.Valid() {
+			ids[item.ActorID.Int64()] = struct{}{}
+		}
+	}
+	if len(ids) > 0 {
+		nameMap, err := h.resolver.ResolveActorNames(ctx, idSetToSlice(ids))
+		if err != nil {
+			h.logger.Warn("failed to resolve audit actor names", zap.Error(err))
+		} else {
+			for _, item := range items {
+				item.ActorName = nameMap[item.ActorID.Int64()]
+			}
+		}
+	}
+
+	principalRefs, ok := h.resolveAuditPrincipalReferences(ctx, items)
+	if !ok {
+		return
+	}
+	for _, item := range items {
+		applyAuditPrincipalReference(item, principalRefs)
+	}
+}
+
+// enrichAccessReferences 为访问日志填充可读主体与资源引用。
+func (h *AccessLogHandler) enrichAccessReferences(ctx context.Context, items []*AdminAccessLogResponse) {
+	ids := make(map[int64]struct{}, len(items))
+	for _, item := range items {
+		if item.ActorID.Valid() {
+			ids[item.ActorID.Int64()] = struct{}{}
+		}
+	}
+	if len(ids) > 0 {
+		nameMap, err := h.resolver.ResolveActorNames(ctx, idSetToSlice(ids))
+		if err != nil {
+			h.logger.Warn("failed to resolve access actor names", zap.Error(err))
+		} else {
+			for _, item := range items {
+				item.ActorName = nameMap[item.ActorID.Int64()]
+			}
+		}
+	}
+
+	principalRefs, ok := h.resolveAccessPrincipalReferences(ctx, items)
+	if !ok {
+		return
+	}
+	for _, item := range items {
+		applyAccessPrincipalReference(item, principalRefs)
+	}
+}
+
+// enrichOperationReferences 为操作日志填充可读主体与资源引用。
+func (h *AuditHandler) enrichOperationReferences(ctx context.Context, items []*AdminOperationLogResponse) {
+	ids := make(map[int64]struct{}, len(items))
+	for _, item := range items {
+		if item.ActorID.Valid() {
+			ids[item.ActorID.Int64()] = struct{}{}
+		}
+	}
+	if len(ids) > 0 {
+		nameMap, err := h.resolver.ResolveActorNames(ctx, idSetToSlice(ids))
+		if err != nil {
+			h.logger.Warn("failed to resolve operation actor names", zap.Error(err))
+		} else {
+			for _, item := range items {
+				item.ActorName = nameMap[item.ActorID.Int64()]
+			}
+		}
+	}
+
+	principalRefs, ok := h.resolveOperationPrincipalReferences(ctx, items)
+	if !ok {
+		return
+	}
+	for _, item := range items {
+		applyOperationPrincipalReference(item, principalRefs)
+	}
+}
+
+// enrichLoginReferences 为登录日志填充 identity_id 的可读联系信息。
+func (h *LoginLogHandler) enrichLoginReferences(ctx context.Context, items []*AdminLoginLogResponse) {
+	ids := make(map[int64]struct{}, len(items))
+	for _, item := range items {
+		if item.IdentityID.Valid() {
+			ids[item.IdentityID.Int64()] = struct{}{}
+		}
+	}
+	if len(ids) == 0 {
+		return
+	}
+
+	identityRefs, err := h.resolver.ResolveIdentityContacts(ctx, idSetToSlice(ids))
+	if err != nil {
+		h.logger.Warn("failed to resolve login identity contacts", zap.Error(err))
+		return
+	}
+	for _, item := range items {
+		if ref, ok := identityRefs[item.IdentityID.Int64()]; ok {
+			item.IdentityEmail = ref.Email
+			item.IdentityDisplayName = ref.DisplayName
+			item.ActorName = preferredIdentityActorName(ref)
+		}
+	}
+}
+
+func (h *AuditHandler) resolveAuditPrincipalReferences(ctx context.Context, items []*AdminAuditLogResponse) (map[int64]ResolvedPrincipalReference, bool) {
+	ids := make(map[int64]struct{}, len(items)*2)
+	for _, item := range items {
+		addPositiveID(ids, item.IAMPrincipalID)
+		if resourceID, ok := iamPrincipalResourceID(item.ResourceType, item.ResourceID); ok {
+			addPositiveID(ids, resourceID)
+		}
+	}
+	if len(ids) == 0 {
+		return nil, true
+	}
+	refs, err := h.resolver.ResolvePrincipalIdentities(ctx, idSetToSlice(ids))
+	if err != nil {
+		h.logger.Warn("failed to resolve audit principal references", zap.Error(err))
+		return nil, false
+	}
+	return refs, true
+}
+
+func (h *AccessLogHandler) resolveAccessPrincipalReferences(ctx context.Context, items []*AdminAccessLogResponse) (map[int64]ResolvedPrincipalReference, bool) {
+	ids := make(map[int64]struct{}, len(items)*2)
+	for _, item := range items {
+		addPositiveID(ids, item.IAMPrincipalID)
+		if resourceID, ok := iamPrincipalResourceID(item.ResourceType, item.ResourceID); ok {
+			addPositiveID(ids, resourceID)
+		}
+	}
+	if len(ids) == 0 {
+		return nil, true
+	}
+	refs, err := h.resolver.ResolvePrincipalIdentities(ctx, idSetToSlice(ids))
+	if err != nil {
+		h.logger.Warn("failed to resolve access principal references", zap.Error(err))
+		return nil, false
+	}
+	return refs, true
+}
+
+func (h *AuditHandler) resolveOperationPrincipalReferences(ctx context.Context, items []*AdminOperationLogResponse) (map[int64]ResolvedPrincipalReference, bool) {
+	ids := make(map[int64]struct{}, len(items)*2)
+	for _, item := range items {
+		addPositiveID(ids, item.IAMPrincipalID)
+		if resourceID, ok := iamPrincipalResourceID(item.ResourceType, item.ResourceID); ok {
+			addPositiveID(ids, resourceID)
+		}
+	}
+	if len(ids) == 0 {
+		return nil, true
+	}
+	refs, err := h.resolver.ResolvePrincipalIdentities(ctx, idSetToSlice(ids))
+	if err != nil {
+		h.logger.Warn("failed to resolve operation principal references", zap.Error(err))
+		return nil, false
+	}
+	return refs, true
+}
+
+func applyAuditPrincipalReference(item *AdminAuditLogResponse, refs map[int64]ResolvedPrincipalReference) {
+	if ref, ok := refs[item.IAMPrincipalID]; ok {
+		item.PrincipalDisplayName = ref.DisplayName
+		item.PrincipalEmail = ref.Email
+	}
+	if resourceID, ok := iamPrincipalResourceID(item.ResourceType, item.ResourceID); ok {
+		if ref, exists := refs[resourceID]; exists {
+			item.ResourceDisplayName = ref.DisplayName
+			item.ResourceEmail = ref.Email
+		}
+	}
+}
+
+func applyAccessPrincipalReference(item *AdminAccessLogResponse, refs map[int64]ResolvedPrincipalReference) {
+	if ref, ok := refs[item.IAMPrincipalID]; ok {
+		item.PrincipalDisplayName = ref.DisplayName
+		item.PrincipalEmail = ref.Email
+	}
+	if resourceID, ok := iamPrincipalResourceID(item.ResourceType, item.ResourceID); ok {
+		if ref, exists := refs[resourceID]; exists {
+			item.ResourceDisplayName = ref.DisplayName
+			item.ResourceEmail = ref.Email
+		}
+	}
+}
+
+func applyOperationPrincipalReference(item *AdminOperationLogResponse, refs map[int64]ResolvedPrincipalReference) {
+	if ref, ok := refs[item.IAMPrincipalID]; ok {
+		item.PrincipalDisplayName = ref.DisplayName
+		item.PrincipalEmail = ref.Email
+	}
+	if resourceID, ok := iamPrincipalResourceID(item.ResourceType, item.ResourceID); ok {
+		if ref, exists := refs[resourceID]; exists {
+			item.ResourceDisplayName = ref.DisplayName
+			item.ResourceEmail = ref.Email
+		}
+	}
+}
+
+func iamPrincipalResourceID(resourceType string, resourceID string) (int64, bool) {
+	switch AuditResource(strings.TrimSpace(resourceType)) {
+	case AuditResourceIAMPrincipal, AuditResourceIAMServiceAccount:
+		id, err := strconv.ParseInt(strings.TrimSpace(resourceID), 10, 64)
+		if err != nil || id <= 0 {
+			return 0, false
+		}
+		return id, true
+	default:
+		return 0, false
+	}
+}
+
+func preferredIdentityActorName(ref ResolvedIdentityReference) string {
+	if ref.Email != "" {
+		return ref.Email
+	}
+	return ref.DisplayName
+}
+
+func addPositiveID(ids map[int64]struct{}, id int64) {
+	if id > 0 {
+		ids[id] = struct{}{}
+	}
+}
+
+func idSetToSlice(ids map[int64]struct{}) []int64 {
+	result := make([]int64, 0, len(ids))
+	for id := range ids {
+		result = append(result, id)
+	}
+	return result
+}
+
+func scopeFromRequest(c *gin.Context) (iamscope.ScopeConstraint, int64, error) {
+	scope, ok := commonmw.GetScopeConstraint(c)
+	if !ok {
+		return iamscope.ScopeConstraint{}, 0, apierror.Forbidden("Scope constraint was not resolved")
+	}
+	principalID, ok := commonmw.GetScopePrincipalID(c)
+	if !ok {
+		return iamscope.ScopeConstraint{}, 0, apierror.Forbidden("Scope principal was not resolved")
+	}
+	return scope, principalID, nil
+}