@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/core/audit/service_test.go

@@ -0,0 +1,331 @@
+package audit
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"go.uber.org/zap/zaptest/observer"
+	"gorm.io/gorm"
+
+	"{{module}}/internal/common/iamscope"
+	"{{module}}/internal/common/types"
+)
+
+type memoryAccessLogRepo struct {
+	logs []*AccessLog
+}
+
+func (r *memoryAccessLogRepo) BatchCreate(_ context.Context, logs []*AccessLog) error {
+	r.logs = append(r.logs, logs...)
+	return nil
+}
+
+func (r *memoryAccessLogRepo) FindByQuery(_ context.Context, _ *AdminListAccessLogsRequest, _ iamscope.ScopeConstraint, _ int64) ([]*AccessLog, int64, error) {
+	return r.logs, int64(len(r.logs)), nil
+}
+
+func (r *memoryAccessLogRepo) FindByID(_ context.Context, id int64, _ iamscope.ScopeConstraint, _ int64) (*AccessLog, error) {
+	for _, log := range r.logs {
+		if log.ID == id {
+			return log, nil
+		}
+	}
+	return nil, assert.AnError
+}
+
+type memoryAuditRepo struct {
+	logs []*AuditLog
+	seen map[string]struct{}
+}
+
+func (r *memoryAuditRepo) BatchCreate(_ context.Context, logs []*AuditLog) error {
+	r.logs = append(r.logs, logs...)
+	return nil
+}
+
+func (r *memoryAuditRepo) ClaimEventAudit(_ context.Context, inbox *AuditEventInbox) (bool, error) {
+	if r.seen == nil {
+		r.seen = make(map[string]struct{})
+	}
+	if _, exists := r.seen[inbox.EventID]; exists {
+		return false, nil
+	}
+	r.seen[inbox.EventID] = struct{}{}
+	return true, nil
+}
+
+type auditTransactionManagerStub struct{}
+
+func (auditTransactionManagerStub) WithTransaction(ctx context.Context, fn func(context.Context) error) error {
+	return fn(ctx)
+}
+
+func (r *memoryAuditRepo) FindByQuery(_ context.Context, _ *AdminListAuditLogsRequest, _ iamscope.ScopeConstraint, _ int64) ([]*AuditLog, int64, error) {
+	return r.logs, int64(len(r.logs)), nil
+}
+
+func (r *memoryAuditRepo) FindByID(_ context.Context, id int64, _ iamscope.ScopeConstraint, _ int64) (*AuditLog, error) {
+	for _, log := range r.logs {
+		if log.ID == id {
+			return log, nil
+		}
+	}
+	return nil, assert.AnError
+}
+
+func (r *memoryAuditRepo) CountByCategory(_ context.Context, _, _ time.Time, _ iamscope.ScopeConstraint, _ int64) ([]CategoryCount, error) {
+	return nil, nil
+}
+
+func (r *memoryAuditRepo) CountByRiskLevel(_ context.Context, _, _ time.Time, _ iamscope.ScopeConstraint, _ int64) ([]RiskLevelCount, error) {
+	return nil, nil
+}
+
+type memoryOperationLogRepo struct {
+	logs []*OperationLog
+}
+
+func (r *memoryOperationLogRepo) Create(_ context.Context, log *OperationLog) error {
+	log.ID = int64(len(r.logs) + 1)
+	r.logs = append(r.logs, log)
+	return nil
+}
+
+func (r *memoryOperationLogRepo) Complete(_ context.Context, id int64, entry CompleteOperationEntry, completedAt time.Time) error {
+	for _, log := range r.logs {
+		if log.ID == id {
+			log.IAMPrincipalID = entry.IAMPrincipalID
+			log.HTTPStatus = entry.HTTPStatus
+			log.DurationMS = entry.DurationMS
+			log.IsSuccess = entry.IsSuccess
+			log.ErrorMessage = entry.ErrorMessage
+			log.RecordStatus = operationRecordStatusCompleted
+			log.CompletedAt = &completedAt
+			return nil
+		}
+	}
+	return assert.AnError
+}
+
+type failingOperationLogRepo struct {
+	memoryOperationLogRepo
+	err error
+}
+
+func (r *failingOperationLogRepo) Complete(context.Context, int64, CompleteOperationEntry, time.Time) error {
+	return r.err
+}
+
+func (r *memoryOperationLogRepo) FindByQuery(_ context.Context, _ *AdminListOperationLogsRequest, _ iamscope.ScopeConstraint, _ int64) ([]*OperationLog, int64, error) {
+	return r.logs, int64(len(r.logs)), nil
+}
+
+func (r *memoryOperationLogRepo) FindByID(_ context.Context, id int64, _ iamscope.ScopeConstraint, _ int64) (*OperationLog, error) {
+	for _, log := range r.logs {
+		if log.ID == id {
+			return log, nil
+		}
+	}
+	return nil, assert.AnError
+}
+
+func TestAuditServiceAccessPolicySuppressesSuccessfulReads(t *testing.T) {
+	accessRepo := &memoryAccessLogRepo{}
+	svc := &auditService{
+		accessRepo: accessRepo,
+		accessPolicy: AccessLogPolicy{
+			enabled:               true,
+			successReadSampleRate: 0,
+			slowRequestThreshold:  time.Second,
+			recordWriteMethods:    true,
+			recordClientErrors:    true,
+		},
+		logger:       zap.NewNop(),
+		accessBuffer: make(chan AccessEntry, 1),
+	}
+
+	svc.LogAccess(context.Background(), AccessEntry{HTTPMethod: "GET", HTTPStatus: 200, DurationMS: 10})
+	assert.Empty(t, svc.accessBuffer)
+
+	svc.LogAccess(context.Background(), AccessEntry{HTTPMethod: "POST", HTTPStatus: 201, DurationMS: 10})
+	require.Len(t, svc.accessBuffer, 1)
+}
+
+func TestAuditServiceWritesHighRiskAuditWhenBufferIsFull(t *testing.T) {
+	auditRepo := &memoryAuditRepo{}
+	svc := &auditService{
+		auditRepo:    auditRepo,
+		logger:       zap.NewNop(),
+		auditBuffer:  make(chan AuditEntry),
+		auditDrop:    auditDropState{},
+		accessPolicy: AccessLogPolicy{enabled: true},
+	}
+
+	svc.LogAudit(context.Background(), AuditEntry{
+		Action:    ActionDelete,
+		Category:  CategoryCommerce,
+		RiskLevel: RiskLevelCritical,
+		ActorID:   types.UserID(42),
+	})
+
+	require.Len(t, auditRepo.logs, 1)
+	assert.Equal(t, ActionDelete, auditRepo.logs[0].Action)
+	assert.Equal(t, RiskLevelCritical, auditRepo.logs[0].RiskLevel)
+}
+
+func TestAuditServiceLogSyncPreservesDomainEventIdempotencyEnvelope(t *testing.T) {
+	auditRepo := &memoryAuditRepo{}
+	svc := &auditService{auditRepo: auditRepo, txManager: auditTransactionManagerStub{}}
+	occurredAt := time.Date(2026, 8, 9, 5, 6, 7, 123_000_000, time.UTC)
+
+	err := svc.LogSync(context.Background(), AuditEntry{
+		EventID:    "evt-payment-webhook-42",
+		OccurredAt: occurredAt,
+		Action:     ActionExecute,
+		Category:   CategoryCommerce,
+		RiskLevel:  RiskLevelCritical,
+	})
+	require.NoError(t, err)
+	require.Len(t, auditRepo.logs, 1)
+	require.NotNil(t, auditRepo.logs[0].EventID)
+	require.NotNil(t, auditRepo.logs[0].OccurredAt)
+	assert.Equal(t, "evt-payment-webhook-42", *auditRepo.logs[0].EventID)
+	assert.Equal(t, occurredAt, *auditRepo.logs[0].OccurredAt)
+	assert.True(t, auditRepo.logs[0].CreatedAt.IsZero(), "repository owns the audit write timestamp")
+
+	require.NoError(t, svc.LogSync(context.Background(), AuditEntry{
+		EventID:    "evt-payment-webhook-42",
+		OccurredAt: occurredAt,
+		Action:     ActionExecute,
+		Category:   CategoryCommerce,
+		RiskLevel:  RiskLevelCritical,
+	}))
+	require.Len(t, auditRepo.logs, 1, "replayed domain event must be idempotent")
+}
+
+func TestAuditServiceBoundsErrorMessagesToSchema(t *testing.T) {
+	longMessage := strings.Repeat("x", auditErrorMessageMaxLength+100)
+
+	accessLog := toAccessLog(AccessEntry{ErrorMessage: longMessage})
+	require.Len(t, []rune(accessLog.ErrorMessage), auditErrorMessageMaxLength)
+	assert.True(t, strings.HasSuffix(accessLog.ErrorMessage, "..."))
+
+	auditLog := toAuditLog(AuditEntry{ErrorMessage: longMessage})
+	require.Len(t, []rune(auditLog.ErrorMessage), auditErrorMessageMaxLength)
+	assert.True(t, strings.HasSuffix(auditLog.ErrorMessage, "..."))
+}
+
+func TestAuditServiceOperationWriteFlow(t *testing.T) {
+	operationRepo := &memoryOperationLogRepo{}
+	svc := &auditService{
+		operationRepo: operationRepo,
+		logger:        zap.NewNop(),
+	}
+
+	id, err := svc.BeginOperation(context.Background(), BeginOperationEntry{
+		RequestID:         "req_1",
+		ActorType:         ActorTypeAdmin,
+		OperationAction:   ActionUpdate,
+		OperationCategory: CategorySystem,
+		RiskLevel:         RiskLevelMedium,
+		RequestContext:    BuildOperationRequestContext(OperationRequestEnvelopeInput{RouteTemplate: "/admin/audit-logs"}),
+		OperationMetadata: BuildOperationMetadata(OperationMetadataEnvelopeInput{SourceModule: "audit-logs"}),
+	})
+	require.NoError(t, err)
+	require.Equal(t, int64(1), id)
+	require.Equal(t, operationRecordStatusStarted, operationRepo.logs[0].RecordStatus)
+
+	err = svc.CompleteOperation(context.Background(), id, CompleteOperationEntry{
+		RequestID:      "req_1",
+		IAMPrincipalID: 42,
+		HTTPStatus:     200,
+		DurationMS:     15,
+		IsSuccess:      true,
+		IAMAction:      "ops:audit-log:read",
+		IAMResource:    "onex:global:-:ops:audit-log/1",
+	})
+	require.NoError(t, err)
+	require.Equal(t, int64(42), operationRepo.logs[0].IAMPrincipalID)
+	require.Equal(t, operationRecordStatusCompleted, operationRepo.logs[0].RecordStatus)
+	require.NotNil(t, operationRepo.logs[0].CompletedAt)
+}
+
+func TestAuditServiceOperationCompletionFailureLogUsesBoundedEvidence(t *testing.T) {
+	core, observed := observer.New(zapcore.ErrorLevel)
+	svc := &auditService{
+		operationRepo: &failingOperationLogRepo{err: gorm.ErrRecordNotFound},
+		logger:        zap.New(core),
+	}
+
+	err := svc.CompleteOperation(context.Background(), 9, CompleteOperationEntry{
+		RequestID:  "req_9",
+		HTTPStatus: 500,
+		IsSuccess:  false,
+	})
+
+	require.ErrorIs(t, err, gorm.ErrRecordNotFound)
+	logs := observed.FilterMessage("operation log completion failed").All()
+	require.Len(t, logs, 1)
+	fields := logs[0].ContextMap()
+	require.Equal(t, "audit.operation.complete", fields["event"])
+	require.Equal(t, "sys_operation_logs", fields["table"])
+	require.Equal(t, "failed", fields["outcome"])
+	require.Equal(t, "not_started_or_already_completed", fields["errorKind"])
+	require.Equal(t, operationRecordStatusStarted, fields["expectedRecordStatus"])
+	require.Equal(t, int64(9), fields["operationLogId"])
+	require.Equal(t, "req_9", fields["requestId"])
+	require.Equal(t, int64(500), fields["httpStatus"])
+	require.Equal(t, false, fields["isSuccess"])
+}
+
+func TestOperationRequestEnvelopeKeepsOnlySafeNames(t *testing.T) {
+	payload := BuildOperationRequestContext(OperationRequestEnvelopeInput{
+		RouteTemplate: "/admin/users/:id",
+		QueryKeyNames: []string{
+			"page",
+			"authorization",
+			"email",
+			"page",
+		},
+		RouteParamNames: []string{"id", "purchaseToken"},
+		ContentType:     "application/json",
+		ProductCode:     "catalog",
+	})
+
+	var envelope map[string]any
+	require.NoError(t, json.Unmarshal(payload, &envelope))
+	require.Equal(t, "/admin/users/:id", envelope["route_template"])
+	require.Equal(t, []any{"page"}, envelope["query_key_names"])
+	require.Equal(t, []any{"id"}, envelope["route_param_names"])
+	_, routeParamsPresent := envelope["route_params"]
+	require.False(t, routeParamsPresent)
+	_, authorizationPresent := envelope["authorization"]
+	require.False(t, authorizationPresent)
+}
+
+func TestOperationEnvelopeDropsOptionalKeysWhenOversized(t *testing.T) {
+	oversized := strings.Repeat("x", operationEnvelopeMaxBytes+100)
+	payload := BuildOperationMetadata(OperationMetadataEnvelopeInput{
+		SourceModule:     "audit",
+		RouteName:        oversized,
+		Handler:          oversized,
+		MenuKey:          oversized,
+		ResourceHint:     oversized,
+		RelatedRequestID: oversized,
+	})
+
+	require.LessOrEqual(t, len(payload), operationEnvelopeMaxBytes)
+
+	var envelope map[string]any
+	require.NoError(t, json.Unmarshal(payload, &envelope))
+	require.Equal(t, "audit", envelope["source_module"])
+	_, ok := envelope["route_name"]
+	require.False(t, ok)
+}