@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/core/audit/repository_test.go

@@ -0,0 +1,934 @@
+package audit
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+
+	"{{module}}/internal/common/iamscope"
+	"{{module}}/internal/core/database"
+)
+
+func TestRepositoriesPersistFalseSuccessValues(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+
+	accessRepo := NewAccessLogRepository(db, testActorReferenceSearcher{db: db})
+	auditRepo := NewAuditRepository(db, testActorReferenceSearcher{db: db})
+	loginRepo := NewLoginLogRepository(db, testActorReferenceSearcher{db: db})
+	operationRepo := NewOperationLogRepository(db, testActorReferenceSearcher{db: db})
+
+	require.NoError(t, accessRepo.BatchCreate(context.Background(), []*AccessLog{{
+		ActorType:  ActorTypeAPIKey,
+		HTTPMethod: "GET",
+		HTTPPath:   "/api/v1/admin/iam/service-accounts",
+		HTTPStatus: 403,
+		IsSuccess:  false,
+	}}))
+	require.NoError(t, auditRepo.BatchCreate(context.Background(), []*AuditLog{{
+		ActorType: ActorTypeAPIKey,
+		Action:    ActionUpdate,
+		Category:  CategorySystem,
+		RiskLevel: RiskLevelHigh,
+		IsSuccess: false,
+	}}))
+	require.NoError(t, loginRepo.BatchCreate(context.Background(), []*LoginLog{{
+		ActorType:   ActorTypeUser,
+		LoginAction: LoginActionLoginFailed,
+		IsSuccess:   false,
+	}}))
+	require.NoError(t, operationRepo.Create(context.Background(), &OperationLog{
+		ActorType:         ActorTypeAdmin,
+		OperationAction:   ActionUpdate,
+		OperationCategory: CategorySystem,
+		RiskLevel:         RiskLevelHigh,
+		RequestContext:    datatypesJSONEmpty(),
+		ResponseContext:   datatypesJSONEmpty(),
+		OperationMetadata: datatypesJSONEmpty(),
+		PolicyViolation:   datatypesJSONEmpty(),
+		RecordStatus:      operationRecordStatusStarted,
+	}))
+	require.NoError(t, operationRepo.Complete(context.Background(), 1, CompleteOperationEntry{
+		RequestID:       "req_1",
+		HTTPStatus:      500,
+		DurationMS:      10,
+		IsSuccess:       false,
+		ResponseContext: datatypesJSONEmpty(),
+		PolicyViolation: datatypesJSONEmpty(),
+	}, time.Now().UTC()))
+
+	var accessSuccess bool
+	require.NoError(t, db.Table("sys_access_logs").Select("is_success").Scan(&accessSuccess).Error)
+	require.False(t, accessSuccess)
+
+	var auditSuccess bool
+	require.NoError(t, db.Table("sys_audit_logs").Select("is_success").Scan(&auditSuccess).Error)
+	require.False(t, auditSuccess)
+
+	var loginSuccess bool
+	require.NoError(t, db.Table("sys_login_logs").Select("is_success").Scan(&loginSuccess).Error)
+	require.False(t, loginSuccess)
+
+	var operationSuccess bool
+	require.NoError(t, db.Table("sys_operation_logs").Select("is_success").Scan(&operationSuccess).Error)
+	require.False(t, operationSuccess)
+}
+
+func TestAuditRepositoryClaimsSourceEventExactlyOnce(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+	repo := NewAuditRepository(db, testActorReferenceSearcher{db: db})
+	log := &AuditLog{
+		EventID: func() *string {
+			value := "019b1234-5678-7000-8000-000000000019"
+			return &value
+		}(),
+		ActorType: ActorTypeAdmin, Action: ActionExecute, Category: CategoryCommerce,
+		RiskLevel: RiskLevelCritical, ResourceType: string(AuditResourceStorePurchase),
+		ResourceID: "19", ProductCode: "product_alpha", IsSuccess: true,
+	}
+
+	occurredAt := time.Now().UTC()
+	claimed, err := repo.ClaimEventAudit(context.Background(), &AuditEventInbox{
+		EventID: "019b1234-5678-7000-8000-000000000019", OccurredAt: occurredAt, ProcessedAt: occurredAt,
+	})
+	require.NoError(t, err)
+	require.True(t, claimed)
+	require.NoError(t, repo.BatchCreate(context.Background(), []*AuditLog{log}))
+	claimed, err = repo.ClaimEventAudit(context.Background(), &AuditEventInbox{
+		EventID: "019b1234-5678-7000-8000-000000000019", OccurredAt: occurredAt, ProcessedAt: occurredAt,
+	})
+	require.NoError(t, err)
+	require.False(t, claimed)
+
+	var inboxCount int64
+	require.NoError(t, db.Table("sys_audit_event_inbox").Count(&inboxCount).Error)
+	require.Equal(t, int64(1), inboxCount)
+	var auditCount int64
+	require.NoError(t, db.Table("sys_audit_logs").Count(&auditCount).Error)
+	require.Equal(t, int64(1), auditCount)
+}
+
+func TestAuditRepositoryFiltersResourceTypes(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+
+	repo := NewAuditRepository(db, testActorReferenceSearcher{db: db})
+	require.NoError(t, repo.BatchCreate(context.Background(), []*AuditLog{
+		{
+			ActorType:    ActorTypeAdmin,
+			Action:       ActionUpdate,
+			Category:     CategorySystem,
+			RiskLevel:    RiskLevelCritical,
+			ResourceType: string(AuditResourceIAMPolicy),
+			ResourceID:   "policy-1",
+			IsSuccess:    true,
+		},
+		{
+			ActorType:    ActorTypeAdmin,
+			Action:       ActionCreate,
+			Category:     CategorySystem,
+			RiskLevel:    RiskLevelCritical,
+			ResourceType: string(AuditResourceIAMBinding),
+			ResourceID:   "binding-1",
+			IsSuccess:    true,
+		},
+		{
+			ActorType:    ActorTypeAdmin,
+			Action:       ActionUpdate,
+			Category:     CategoryContent,
+			RiskLevel:    RiskLevelMedium,
+			ResourceType: string(AuditResourceArticle),
+			ResourceID:   "article-1",
+			IsSuccess:    true,
+		},
+	}))
+
+	resourceTypes := "iam_policy,iam_binding"
+	listReq := &AdminListAuditLogsRequest{
+		ResourceTypes: &resourceTypes,
+	}
+	listReq.Normalize()
+	logs, total, err := repo.FindByQuery(context.Background(), listReq, iamscope.NewUnboundedScope(), 0)
+	require.NoError(t, err)
+	require.Equal(t, int64(2), total)
+	require.Len(t, logs, 2)
+	require.ElementsMatch(t, []string{
+		string(AuditResourceIAMPolicy),
+		string(AuditResourceIAMBinding),
+	}, []string{logs[0].ResourceType, logs[1].ResourceType})
+
+	resourceType := string(AuditResourceIAMPolicy)
+	exactReq := &AdminListAuditLogsRequest{
+		ResourceType:  &resourceType,
+		ResourceTypes: &resourceTypes,
+	}
+	exactReq.Normalize()
+	logs, total, err = repo.FindByQuery(context.Background(), exactReq, iamscope.NewUnboundedScope(), 0)
+	require.NoError(t, err)
+	require.Equal(t, int64(1), total)
+	require.Len(t, logs, 1)
+	require.Equal(t, string(AuditResourceIAMPolicy), logs[0].ResourceType)
+}
+
+func TestAuditRepositoryKeywordSearchCoversHighValueFields(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+	seedAuditRepositoryUsers(t, db, auditRepositoryUserFixture{
+		ID:          9101,
+		Email:       "security.operator@example.test",
+		DisplayName: "Security Keyword Operator",
+	})
+	seedAuditRepositoryIdentityAccounts(t, db, auditRepositoryIdentityAccountFixture{
+		ID:          21,
+		IdentityID:  9511,
+		Provider:    accountProviderEmail,
+		ProviderID:  "audit.principal@example.test",
+		DisplayName: "Audit Principal Contact",
+	})
+	seedAuditRepositoryPrincipals(t, db, auditRepositoryPrincipalFixture{
+		ID:          9601,
+		DisplayName: "Audit Principal Keyword",
+		IdentityID:  int64Ptr(9511),
+	})
+
+	repo := NewAuditRepository(db, testActorReferenceSearcher{db: db})
+	require.NoError(t, repo.BatchCreate(context.Background(), []*AuditLog{
+		{
+			TraceID:        "trace-audit-keyword",
+			RequestID:      "req-audit-keyword",
+			ActorType:      ActorTypeAdmin,
+			ActorID:        9101,
+			IAMPrincipalID: 9601,
+			Action:         ActionUpdate,
+			Category:       CategorySystem,
+			RiskLevel:      RiskLevelCritical,
+			ResourceType:   string(AuditResourceIAMServiceAccount),
+			ResourceID:     "9601",
+			TenantID:       "tenant-audit-keyword",
+			IsSuccess:      true,
+		},
+		{
+			TraceID:      "trace-audit-other",
+			RequestID:    "req-audit-other",
+			ActorType:    ActorTypeAdmin,
+			ActorID:      9102,
+			Action:       ActionCreate,
+			Category:     CategoryContent,
+			RiskLevel:    RiskLevelMedium,
+			ResourceType: string(AuditResourceArticle),
+			ResourceID:   "article-other",
+			TenantID:     "tenant-audit-other",
+			IsSuccess:    true,
+		},
+	}))
+
+	cases := []struct {
+		name    string
+		keyword string
+	}{
+		{name: "resource id", keyword: "9601"},
+		{name: "trace id", keyword: "trace-audit-keyword"},
+		{name: "request id", keyword: "req-audit-keyword"},
+		{name: "tenant id", keyword: "tenant-audit-keyword"},
+		{name: "actor email", keyword: "security.operator@example.test"},
+		{name: "actor display name", keyword: "keyword operator"},
+		{name: "actor id", keyword: "9101"},
+		{name: "principal display name", keyword: "audit principal keyword"},
+		{name: "principal email", keyword: "audit.principal@example.test"},
+		{name: "resource principal display name", keyword: "audit principal keyword"},
+		{name: "resource type", keyword: string(AuditResourceIAMServiceAccount)},
+		{name: "action", keyword: string(ActionUpdate)},
+		{name: "category", keyword: string(CategorySystem)},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			logs, total, err := repo.FindByQuery(context.Background(), auditKeywordRequest(tc.keyword), iamscope.NewUnboundedScope(), 0)
+			require.NoError(t, err)
+			require.Equal(t, int64(1), total)
+			require.Len(t, logs, 1)
+			require.Equal(t, "9601", logs[0].ResourceID)
+		})
+	}
+}
+
+func TestOperationRepositoryKeywordSearchCoversHighValueFields(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+	seedAuditRepositoryUsers(t, db, auditRepositoryUserFixture{
+		ID:          9201,
+		Email:       "operation.operator@example.test",
+		DisplayName: "Operation Keyword Operator",
+	})
+	seedAuditRepositoryIdentityAccounts(t, db, auditRepositoryIdentityAccountFixture{
+		ID:          22,
+		IdentityID:  9521,
+		Provider:    accountProviderEmail,
+		ProviderID:  "operation.principal@example.test",
+		DisplayName: "Operation Principal Contact",
+	})
+	seedAuditRepositoryPrincipals(t, db, auditRepositoryPrincipalFixture{
+		ID:          9602,
+		DisplayName: "Operation Principal Keyword",
+		IdentityID:  int64Ptr(9521),
+	})
+
+	repo := NewOperationLogRepository(db, testActorReferenceSearcher{db: db})
+	target := &OperationLog{
+		TraceID:           "trace-operation-keyword",
+		ActorType:         ActorTypeAdmin,
+		ActorID:           9201,
+		ActorIP:           "198.51.100.24",
+		OperationAction:   ActionUpdate,
+		OperationCategory: CategorySystem,
+		RiskLevel:         RiskLevelHigh,
+		SourceModule:      "iam-console",
+		HTTPMethod:        "PATCH",
+		HTTPPath:          "/api/v1/admin/iam/roles/keyword-role",
+		ProductCode:       "catalog",
+		TenantID:          "tenant-operation-keyword",
+		ResourceType:      string(AuditResourceIAMPrincipal),
+		ResourceID:        "9602",
+		IsSuccess:         true,
+		RequestContext:    datatypesJSONEmpty(),
+		OperationMetadata: datatypesJSONEmpty(),
+		RecordStatus:      operationRecordStatusStarted,
+	}
+	require.NoError(t, repo.Create(context.Background(), target))
+	require.NoError(t, repo.Complete(context.Background(), target.ID, CompleteOperationEntry{
+		RequestID:       "req-operation-keyword",
+		IAMPrincipalID:  9602,
+		IAMAction:       "iam:role:update",
+		IAMResource:     "onex:global:-:iam:role/keyword-role",
+		HTTPStatus:      200,
+		DurationMS:      15,
+		IsSuccess:       true,
+		ResponseContext: datatypesJSONEmpty(),
+		PolicyViolation: datatypesJSONEmpty(),
+	}, time.Now().UTC()))
+	require.NoError(t, repo.Create(context.Background(), &OperationLog{
+		TraceID:           "trace-operation-other",
+		ActorType:         ActorTypeAdmin,
+		ActorID:           9202,
+		ActorIP:           "198.51.100.30",
+		OperationAction:   ActionCreate,
+		OperationCategory: CategoryContent,
+		RiskLevel:         RiskLevelMedium,
+		SourceModule:      "content-console",
+		HTTPMethod:        "POST",
+		HTTPPath:          "/api/v1/admin/articles",
+		ProductCode:       "catalog",
+		TenantID:          "tenant-operation-other",
+		ResourceType:      "article",
+		ResourceID:        "article-other",
+		IsSuccess:         true,
+		RequestContext:    datatypesJSONEmpty(),
+		OperationMetadata: datatypesJSONEmpty(),
+		RecordStatus:      operationRecordStatusStarted,
+	}))
+
+	cases := []struct {
+		name    string
+		keyword string
+	}{
+		{name: "http path", keyword: "keyword-role"},
+		{name: "resource id", keyword: "9602"},
+		{name: "trace id", keyword: "trace-operation-keyword"},
+		{name: "request id", keyword: "req-operation-keyword"},
+		{name: "tenant id", keyword: "tenant-operation-keyword"},
+		{name: "iam action", keyword: "iam:role:update"},
+		{name: "source module", keyword: "iam-console"},
+		{name: "actor ip", keyword: "198.51.100.24"},
+		{name: "actor email", keyword: "operation.operator@example.test"},
+		{name: "actor display name", keyword: "operation keyword operator"},
+		{name: "actor id", keyword: "9201"},
+		{name: "principal display name", keyword: "operation principal keyword"},
+		{name: "principal email", keyword: "operation.principal@example.test"},
+		{name: "resource principal display name", keyword: "operation principal keyword"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			logs, total, err := repo.FindByQuery(context.Background(), operationKeywordRequest(tc.keyword), iamscope.NewUnboundedScope(), 0)
+			require.NoError(t, err)
+			require.Equal(t, int64(1), total)
+			require.Len(t, logs, 1)
+			require.Equal(t, "9602", logs[0].ResourceID)
+		})
+	}
+}
+
+func TestAccessRepositoryKeywordSearchCoversHighValueFields(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+	seedAuditRepositoryUsers(t, db, auditRepositoryUserFixture{
+		ID:          9301,
+		Email:       "access.operator@example.test",
+		DisplayName: "Access Keyword Operator",
+	})
+	seedAuditRepositoryIdentityAccounts(t, db, auditRepositoryIdentityAccountFixture{
+		ID:          23,
+		IdentityID:  9531,
+		Provider:    accountProviderEmail,
+		ProviderID:  "access.principal@example.test",
+		DisplayName: "Access Principal Contact",
+	})
+	seedAuditRepositoryPrincipals(t, db, auditRepositoryPrincipalFixture{
+		ID:          9603,
+		DisplayName: "Access Principal Keyword",
+		IdentityID:  int64Ptr(9531),
+	})
+
+	repo := NewAccessLogRepository(db, testActorReferenceSearcher{db: db})
+	require.NoError(t, repo.BatchCreate(context.Background(), []*AccessLog{
+		{
+			TraceID:        "trace-access-keyword",
+			RequestID:      "req-access-keyword",
+			ActorType:      ActorTypeAdmin,
+			ActorID:        9301,
+			ActorIP:        "203.0.113.24",
+			IAMPrincipalID: 9603,
+			HTTPMethod:     "GET",
+			HTTPPath:       "/api/v1/admin/iam/service-accounts/keyword-account",
+			HTTPStatus:     200,
+			ProductCode:    "catalog",
+			ResourceType:   "iam_service_account",
+			ResourceID:     "9603",
+			IsSuccess:      true,
+		},
+		{
+			TraceID:      "trace-access-other",
+			RequestID:    "req-access-other",
+			ActorType:    ActorTypeAdmin,
+			ActorID:      9302,
+			ActorIP:      "203.0.113.30",
+			HTTPMethod:   "GET",
+			HTTPPath:     "/api/v1/admin/articles",
+			HTTPStatus:   200,
+			ProductCode:  "catalog",
+			ResourceType: "article",
+			ResourceID:   "article-other",
+			IsSuccess:    true,
+		},
+	}))
+
+	cases := []struct {
+		name    string
+		keyword string
+	}{
+		{name: "http path", keyword: "keyword-account"},
+		{name: "resource id", keyword: "9603"},
+		{name: "trace id", keyword: "trace-access-keyword"},
+		{name: "request id", keyword: "req-access-keyword"},
+		{name: "actor ip", keyword: "203.0.113.24"},
+		{name: "actor email", keyword: "access.operator@example.test"},
+		{name: "actor display name", keyword: "access keyword operator"},
+		{name: "actor id", keyword: "9301"},
+		{name: "principal display name", keyword: "access principal keyword"},
+		{name: "principal email", keyword: "access.principal@example.test"},
+		{name: "resource principal display name", keyword: "access principal keyword"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			logs, total, err := repo.FindByQuery(context.Background(), accessKeywordRequest(tc.keyword), iamscope.NewUnboundedScope(), 0)
+			require.NoError(t, err)
+			require.Equal(t, int64(1), total)
+			require.Len(t, logs, 1)
+			require.Equal(t, "9603", logs[0].ResourceID)
+		})
+	}
+}
+
+func TestLoginRepositoryKeywordSearchCoversHighValueFields(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+	seedAuditRepositoryIdentityAccounts(t, db,
+		auditRepositoryIdentityAccountFixture{
+			ID:          1,
+			IdentityID:  9401,
+			Provider:    accountProviderEmail,
+			ProviderID:  "login.operator@example.test",
+			DisplayName: "Login Keyword Operator",
+		},
+		auditRepositoryIdentityAccountFixture{
+			ID:          2,
+			IdentityID:  9402,
+			Provider:    accountProviderEmail,
+			ProviderID:  "login.other@example.test",
+			DisplayName: "Login Other Operator",
+		},
+	)
+
+	repo := NewLoginLogRepository(db, testActorReferenceSearcher{db: db})
+	require.NoError(t, repo.BatchCreate(context.Background(), []*LoginLog{
+		{
+			IdentityID:  9401,
+			ActorType:   ActorTypeUser,
+			ActorIP:     "192.0.2.24",
+			LoginAction: LoginActionLogin,
+			LoginMethod: LoginMethodPassword,
+			IsSuccess:   true,
+			ProductCode: "catalog",
+			SessionID:   "session-login-keyword",
+			RequestID:   "req-login-keyword",
+			DeviceType:  "desktop-keyword",
+			OSName:      "macos-keyword",
+			BrowserName: "chrome-keyword",
+			GeoCountry:  "country-keyword",
+			GeoCity:     "city-keyword",
+		},
+		{
+			IdentityID:  9402,
+			ActorType:   ActorTypeUser,
+			ActorIP:     "192.0.2.30",
+			LoginAction: LoginActionLoginFailed,
+			LoginMethod: LoginMethodPassword,
+			IsSuccess:   false,
+			ProductCode: "catalog",
+			SessionID:   "session-login-other",
+			RequestID:   "req-login-other",
+			DeviceType:  "mobile-other",
+			OSName:      "ios-other",
+			BrowserName: "safari-other",
+			GeoCountry:  "country-other",
+			GeoCity:     "city-other",
+		},
+	}))
+
+	cases := []struct {
+		name    string
+		keyword string
+	}{
+		{name: "actor ip", keyword: "192.0.2.24"},
+		{name: "request id", keyword: "req-login-keyword"},
+		{name: "session id", keyword: "session-login-keyword"},
+		{name: "device type", keyword: "desktop-keyword"},
+		{name: "os name", keyword: "macos-keyword"},
+		{name: "browser name", keyword: "chrome-keyword"},
+		{name: "geo country", keyword: "country-keyword"},
+		{name: "geo city", keyword: "city-keyword"},
+		{name: "identity email", keyword: "login.operator@example.test"},
+		{name: "identity display name", keyword: "login keyword operator"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			logs, total, err := repo.FindByQuery(context.Background(), loginKeywordRequest(tc.keyword), iamscope.NewUnboundedScope(), 0)
+			require.NoError(t, err)
+			require.Equal(t, int64(1), total)
+			require.Len(t, logs, 1)
+			require.Equal(t, "req-login-keyword", logs[0].RequestID)
+		})
+	}
+}
+
+func TestOperationRepositoryCompleteRequiresStartedStatus(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+
+	repo := NewOperationLogRepository(db, testActorReferenceSearcher{db: db})
+	require.NoError(t, repo.Create(context.Background(), &OperationLog{
+		ActorType:         ActorTypeAdmin,
+		OperationAction:   ActionUpdate,
+		OperationCategory: CategorySystem,
+		RiskLevel:         RiskLevelHigh,
+		RequestContext:    datatypesJSONEmpty(),
+		ResponseContext:   datatypesJSONEmpty(),
+		OperationMetadata: datatypesJSONEmpty(),
+		PolicyViolation:   datatypesJSONEmpty(),
+		RecordStatus:      operationRecordStatusStarted,
+	}))
+
+	require.NoError(t, repo.Complete(context.Background(), 1, CompleteOperationEntry{
+		RequestID:       "req_1",
+		IAMPrincipalID:  77,
+		HTTPStatus:      500,
+		DurationMS:      10,
+		IsSuccess:       false,
+		ErrorMessage:    "Internal server error",
+		ResponseContext: datatypesJSONEmpty(),
+		PolicyViolation: datatypesJSONEmpty(),
+	}, time.Now().UTC()))
+
+	err = repo.Complete(context.Background(), 1, CompleteOperationEntry{
+		RequestID:       "req_1",
+		IAMPrincipalID:  88,
+		HTTPStatus:      200,
+		DurationMS:      20,
+		IsSuccess:       true,
+		ResponseContext: datatypesJSONEmpty(),
+		PolicyViolation: datatypesJSONEmpty(),
+	}, time.Now().UTC())
+	require.ErrorIs(t, err, gorm.ErrRecordNotFound)
+
+	var got struct {
+		IAMPrincipalID int64
+		HTTPStatus     int16
+		RecordStatus   string
+	}
+	require.NoError(t, db.Table("sys_operation_logs").
+		Select("iam_principal_id", "http_status", "record_status").
+		Where("id = ?", 1).
+		Scan(&got).Error)
+	require.Equal(t, int64(77), got.IAMPrincipalID)
+	require.Equal(t, int16(500), got.HTTPStatus)
+	require.Equal(t, operationRecordStatusCompleted, got.RecordStatus)
+}
+
+func createAuditRepositoryTestTables(db *gorm.DB) error {
+	statements := []string{
+		`CREATE TABLE sys_access_logs (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			trace_id TEXT DEFAULT '',
+			request_id TEXT DEFAULT '',
+			actor_type TEXT NOT NULL,
+			actor_id INTEGER DEFAULT 0,
+			auth_subject_type TEXT DEFAULT '',
+			iam_principal_id INTEGER DEFAULT 0,
+			credential_public_id TEXT DEFAULT '',
+			token_fingerprint TEXT DEFAULT '',
+			auth_mechanism TEXT DEFAULT '',
+			actor_ip TEXT DEFAULT '',
+			actor_user_agent TEXT DEFAULT '',
+			http_method TEXT DEFAULT '',
+			http_path TEXT DEFAULT '',
+			http_status INTEGER DEFAULT 0,
+			product_code TEXT DEFAULT '',
+			resource_type TEXT DEFAULT '',
+			resource_id TEXT DEFAULT '',
+			is_success BOOLEAN NOT NULL DEFAULT true,
+			error_message TEXT DEFAULT '',
+			duration_ms INTEGER DEFAULT 0,
+			created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)`,
+		`CREATE TABLE sys_audit_logs (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			event_id TEXT,
+			occurred_at DATETIME,
+			trace_id TEXT DEFAULT '',
+			request_id TEXT DEFAULT '',
+			actor_type TEXT NOT NULL,
+			actor_id INTEGER DEFAULT 0,
+			auth_subject_type TEXT DEFAULT '',
+			iam_principal_id INTEGER DEFAULT 0,
+			credential_public_id TEXT DEFAULT '',
+			token_fingerprint TEXT DEFAULT '',
+			auth_mechanism TEXT DEFAULT '',
+			actor_ip TEXT DEFAULT '',
+			actor_user_agent TEXT DEFAULT '',
+			action TEXT NOT NULL,
+			category TEXT NOT NULL,
+			risk_level TEXT DEFAULT 'medium',
+			resource_type TEXT DEFAULT '',
+			resource_id TEXT DEFAULT '',
+			product_code TEXT DEFAULT '',
+			tenant_id TEXT DEFAULT '',
+			changes TEXT,
+			metadata TEXT,
+			is_success BOOLEAN NOT NULL DEFAULT true,
+			error_message TEXT DEFAULT '',
+			created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)`,
+		`CREATE TABLE sys_audit_event_inbox (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			event_id TEXT NOT NULL UNIQUE,
+			occurred_at DATETIME NOT NULL,
+			processed_at DATETIME NOT NULL,
+			created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+			updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)`,
+		`CREATE TABLE sys_login_logs (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			identity_id INTEGER DEFAULT 0,
+			actor_type TEXT NOT NULL,
+			actor_ip TEXT DEFAULT '',
+			actor_user_agent TEXT DEFAULT '',
+			login_action TEXT NOT NULL,
+			login_method TEXT DEFAULT '',
+			is_success BOOLEAN NOT NULL DEFAULT true,
+			failure_reason TEXT DEFAULT '',
+			product_code TEXT DEFAULT '',
+			session_id TEXT DEFAULT '',
+			request_id TEXT DEFAULT '',
+			device_type TEXT DEFAULT '',
+			device_fingerprint TEXT DEFAULT '',
+			os_name TEXT DEFAULT '',
+			browser_name TEXT DEFAULT '',
+			geo_country TEXT DEFAULT '',
+			geo_city TEXT DEFAULT '',
+			created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)`,
+		`CREATE TABLE sys_operation_logs (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			trace_id TEXT DEFAULT '',
+			request_id TEXT DEFAULT '',
+			actor_type TEXT NOT NULL,
+			actor_id INTEGER DEFAULT 0,
+			auth_subject_type TEXT DEFAULT '',
+			iam_principal_id INTEGER DEFAULT 0,
+			credential_public_id TEXT DEFAULT '',
+			token_fingerprint TEXT DEFAULT '',
+			auth_mechanism TEXT DEFAULT '',
+			actor_ip TEXT DEFAULT '',
+			actor_user_agent TEXT DEFAULT '',
+			operation_action TEXT NOT NULL,
+			operation_category TEXT DEFAULT 'system',
+			risk_level TEXT DEFAULT 'medium',
+			source_module TEXT DEFAULT '',
+			iam_action TEXT DEFAULT '',
+			iam_resource TEXT DEFAULT '',
+			decision_allowed BOOLEAN NOT NULL DEFAULT false,
+			decision_reason_code TEXT DEFAULT '',
+			decision_reason_kind TEXT DEFAULT '',
+			http_method TEXT DEFAULT '',
+			http_path TEXT DEFAULT '',
+			http_status INTEGER DEFAULT 0,
+			duration_ms INTEGER DEFAULT 0,
+			product_code TEXT DEFAULT '',
+			tenant_id TEXT DEFAULT '',
+			resource_type TEXT DEFAULT '',
+			resource_id TEXT DEFAULT '',
+			is_success BOOLEAN NOT NULL DEFAULT true,
+			error_message TEXT DEFAULT '',
+			request_context TEXT DEFAULT '{}',
+			response_context TEXT DEFAULT '{}',
+			operation_metadata TEXT DEFAULT '{}',
+			policy_violation TEXT DEFAULT '{}',
+			record_status TEXT DEFAULT 'started',
+			completed_at DATETIME,
+			created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)`,
+		`CREATE TABLE p_user_users (
+			id INTEGER PRIMARY KEY,
+			email TEXT DEFAULT '',
+			display_name TEXT DEFAULT '',
+			is_deleted BOOLEAN NOT NULL DEFAULT false
+		)`,
+		`CREATE TABLE p_identity_accounts (
+			id INTEGER PRIMARY KEY,
+			identity_id INTEGER NOT NULL,
+			provider TEXT NOT NULL,
+			provider_id TEXT NOT NULL,
+			display_name TEXT DEFAULT ''
+		)`,
+		`CREATE TABLE p_iam_principals (
+			id INTEGER PRIMARY KEY,
+			display_name TEXT NOT NULL,
+			identity_id INTEGER,
+			deleted_at DATETIME
+		)`,
+	}
+	for _, statement := range statements {
+		if err := db.Exec(statement).Error; err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type auditRepositoryUserFixture struct {
+	ID          int64
+	Email       string
+	DisplayName string
+	IsDeleted   bool
+}
+
+type auditRepositoryIdentityAccountFixture struct {
+	ID          int64
+	IdentityID  int64
+	Provider    string
+	ProviderID  string
+	DisplayName string
+}
+
+type auditRepositoryPrincipalFixture struct {
+	ID          int64
+	DisplayName string
+	IdentityID  *int64
+}
+
+func seedAuditRepositoryUsers(t *testing.T, db *gorm.DB, users ...auditRepositoryUserFixture) {
+	t.Helper()
+	for _, user := range users {
+		require.NoError(t, db.Exec(
+			"INSERT INTO p_user_users (id, email, display_name, is_deleted) VALUES (?, ?, ?, ?)",
+			user.ID,
+			user.Email,
+			user.DisplayName,
+			user.IsDeleted,
+		).Error)
+	}
+}
+
+func seedAuditRepositoryIdentityAccounts(t *testing.T, db *gorm.DB, accounts ...auditRepositoryIdentityAccountFixture) {
+	t.Helper()
+	for _, account := range accounts {
+		require.NoError(t, db.Exec(
+			"INSERT INTO p_identity_accounts (id, identity_id, provider, provider_id, display_name) VALUES (?, ?, ?, ?, ?)",
+			account.ID,
+			account.IdentityID,
+			account.Provider,
+			account.ProviderID,
+			account.DisplayName,
+		).Error)
+	}
+}
+
+func seedAuditRepositoryPrincipals(t *testing.T, db *gorm.DB, principals ...auditRepositoryPrincipalFixture) {
+	t.Helper()
+	for _, principal := range principals {
+		var identityID any
+		if principal.IdentityID != nil {
+			identityID = *principal.IdentityID
+		}
+		require.NoError(t, db.Exec(
+			"INSERT INTO p_iam_principals (id, display_name, identity_id, deleted_at) VALUES (?, ?, ?, NULL)",
+			principal.ID,
+			principal.DisplayName,
+			identityID,
+		).Error)
+	}
+}
+
+func accessKeywordRequest(keyword string) *AdminListAccessLogsRequest {
+	req := &AdminListAccessLogsRequest{Keyword: stringPtr(keyword)}
+	req.Normalize()
+	return req
+}
+
+func auditKeywordRequest(keyword string) *AdminListAuditLogsRequest {
+	req := &AdminListAuditLogsRequest{Keyword: stringPtr(keyword)}
+	req.Normalize()
+	return req
+}
+
+func loginKeywordRequest(keyword string) *AdminListLoginLogsRequest {
+	req := &AdminListLoginLogsRequest{Keyword: stringPtr(keyword)}
+	req.Normalize()
+	return req
+}
+
+func operationKeywordRequest(keyword string) *AdminListOperationLogsRequest {
+	req := &AdminListOperationLogsRequest{Keyword: stringPtr(keyword)}
+	req.Normalize()
+	return req
+}
+
+func stringPtr(value string) *string {
+	return &value
+}
+
+func int64Ptr(value int64) *int64 {
+	return &value
+}
+
+const accountProviderEmail = "email"
+const accountProviderGuest = "guest"
+
+type testActorReferenceSearcher struct{ db *gorm.DB }
+
+func (r testActorReferenceSearcher) Search(ctx context.Context, keyword string) (ActorReferenceMatches, error) {
+	like := "%" + strings.ToLower(keyword) + "%"
+	var matches ActorReferenceMatches
+	if err := actorUserIDSubQuery(ctx, r.db, like).Scan(&matches.ActorIDs).Error; err != nil {
+		return matches, err
+	}
+	if err := identityContactIDSubQuery(ctx, r.db, like).Scan(&matches.IdentityIDs).Error; err != nil {
+		return matches, err
+	}
+	if err := principalIDSubQuery(ctx, r.db, like).Scan(&matches.PrincipalIDs).Error; err != nil {
+		return matches, err
+	}
+	return matches, nil
+}
+func actorUserIDSubQuery(ctx context.Context, db *gorm.DB, like string) *gorm.DB {
+	return database.GetDB(ctx, db).
+		Table("p_user_users").
+		Select("id").
+		Where(
+			keywordTextCondition("email")+" OR "+keywordTextCondition("display_name"),
+			like,
+			like,
+		)
+}
+
+func identityContactIDSubQuery(ctx context.Context, db *gorm.DB, like string) *gorm.DB {
+	return database.GetDB(ctx, db).
+		Table("p_identity_accounts").
+		Select("identity_id").
+		Where("NULLIF(TRIM(provider_id), '') IS NOT NULL").
+		Where(
+			"(provider = ? OR (provider = ? AND TRIM(provider_id) LIKE ?))",
+			accountProviderEmail, accountProviderGuest, "%@%",
+		).
+		Where(
+			keywordTextCondition("provider_id")+" OR "+keywordTextCondition("display_name"),
+			like,
+			like,
+		)
+}
+
+func principalReferenceSubQuery(ctx context.Context, db *gorm.DB, like string, selectExpr string) *gorm.DB {
+	return database.GetDB(ctx, db).
+		Table("p_iam_principals AS p").
+		Select(selectExpr).
+		Joins(
+			`LEFT JOIN p_identity_accounts AS ia ON ia.identity_id = p.identity_id
+				AND NULLIF(TRIM(ia.provider_id), '') IS NOT NULL
+				AND (ia.provider = ? OR (ia.provider = ? AND TRIM(ia.provider_id) LIKE ?))`,
+			accountProviderEmail, accountProviderGuest, "%@%",
+		).
+		Where("p.deleted_at IS NULL").
+		Where(
+			keywordTextCondition("p.display_name")+" OR "+
+				keywordTextCondition("ia.provider_id")+" OR "+
+				keywordTextCondition("ia.display_name"),
+			like,
+			like,
+			like,
+		)
+}
+
+func principalIDSubQuery(ctx context.Context, db *gorm.DB, like string) *gorm.DB {
+	return principalReferenceSubQuery(ctx, db, like, "p.id")
+}
+
+func principalIDTextSubQuery(ctx context.Context, db *gorm.DB, like string) *gorm.DB {
+	return principalReferenceSubQuery(ctx, db, like, "CAST(p.id AS TEXT)")
+}
+
+// failingActorReferenceSearcher 证明目录故障不会被解释为零匹配。
+type failingActorReferenceSearcher struct{ err error }
+
+func (s failingActorReferenceSearcher) Search(context.Context, string) (ActorReferenceMatches, error) {
+	return ActorReferenceMatches{}, s.err
+}
+
+func TestAuditKeywordSearchPropagatesReferenceDirectoryFailure(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	require.NoError(t, err)
+	require.NoError(t, createAuditRepositoryTestTables(db))
+	failure := errors.New("identity directory unavailable")
+	search := failingActorReferenceSearcher{err: failure}
+	keyword := "operator"
+	_, _, err = NewAccessLogRepository(db, search).FindByQuery(context.Background(), &AdminListAccessLogsRequest{Keyword: &keyword}, iamscope.NewUnboundedScope(), 0)
+	require.ErrorIs(t, err, failure)
+	_, _, err = NewLoginLogRepository(db, search).FindByQuery(context.Background(), &AdminListLoginLogsRequest{Keyword: &keyword}, iamscope.NewUnboundedScope(), 0)
+	require.ErrorIs(t, err, failure)
+	_, _, err = NewAuditRepository(db, search).FindByQuery(context.Background(), &AdminListAuditLogsRequest{Keyword: &keyword}, iamscope.NewUnboundedScope(), 0)
+	require.ErrorIs(t, err, failure)
+	_, _, err = NewOperationLogRepository(db, search).FindByQuery(context.Background(), &AdminListOperationLogsRequest{Keyword: &keyword}, iamscope.NewUnboundedScope(), 0)
+	require.ErrorIs(t, err, failure)
+}