Merge pull request #813 from humblezdan/feat/wire-audit-middleware

feat: install audit middleware and emit admin action events

Author: thlpkee20-wq

internal/audit/exporter_test.go

@@ -3,6 +3,7 @@ package audit
 import (
 	"context"
 	"errors"
+	"fmt"
 	"sync"
 	"testing"
 	"time"
@@ -67,7 +68,7 @@ func TestWORMExporter_RotationBySize(t *testing.T) {
 	err = exporter.WriteEvent(e2)
 	require.NoError(t, err)
 	assert.True(t, uploaded)
-	
+
 	// Buffer should be empty now
 	exporter.mu.Lock()
 	assert.Equal(t, 0, len(exporter.buffer))
@@ -159,7 +160,7 @@ func TestWORMExporter_ConcurrentWritesAndRotations(t *testing.T) {
 	// 5 concurrent routines writing 20 events each = 100 events total. Should trigger 2 rotations.
 	// But wait! Hash chaining requires strictly sequential hashing. We can't generate sequential events concurrently easily.
 	// We will serialize event generation, but test that `Rotate` doesn't block `WriteEvent`.
-	
+
 	events := make([]AuditEvent, 100)
 	var prev string
 	for i := 0; i < 100; i++ {
@@ -174,7 +175,7 @@ func TestWORMExporter_ConcurrentWritesAndRotations(t *testing.T) {
 			_ = exporter.WriteEvent(ev) // Order doesn't actually matter for WriteEvent thread safety, but the verifier requires sequential order!
 		}(events[i])
 	}
-	
+
 	// Wait, if they are written out of order, the chain verification will FAIL and panic!
 	// So we can't test concurrent writes this way.
 }
@@ -208,7 +209,7 @@ func TestWORMExporter_ConcurrentWritesAndRotations_Fixed(t *testing.T) {
 	for i := 0; i < 49; i++ {
 		_ = exporter.WriteEvent(events[i])
 	}
-	
+
 	wg.Add(1)
 	go func() {
 		defer wg.Done()

internal/audit/logger.go

@@ -7,6 +7,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -50,6 +51,15 @@ func NewLogger(secret string, sink Sink) *Logger {
 	}
 }
 
+// NewSinkFromEnv creates a sink from AUDIT_LOG_PATH, falling back to stderr.
+func NewSinkFromEnv() Sink {
+	path := strings.TrimSpace(os.Getenv("AUDIT_LOG_PATH"))
+	if path == "" {
+		return NewStderrSink()
+	}
+	return NewFileSink(path)
+}
+
 func (l *Logger) Log(ctx context.Context, event AuditEvent) (AuditEvent, error) {
 	if l == nil {
 		return AuditEvent{}, errors.New("audit logger is not initialized")

internal/audit/sink.go

@@ -38,6 +38,23 @@ func (s *FileSink) WriteEvent(e AuditEvent) error {
 	return err
 }
 
+// StderrSink writes JSONL audit entries to stderr for environments without a configured file path.
+type StderrSink struct{}
+
+// NewStderrSink returns a sink that writes JSONL data to stderr.
+func NewStderrSink() *StderrSink {
+	return &StderrSink{}
+}
+
+func (s *StderrSink) WriteEvent(e AuditEvent) error {
+	encoded, err := json.Marshal(e)
+	if err != nil {
+		return err
+	}
+	_, err = os.Stderr.Write(append(encoded, '\n'))
+	return err
+}
+
 // MemorySink keeps audit entries in-memory, intended for tests.
 type MemorySink struct {
 	mu      sync.Mutex

internal/handlers/admin.go

@@ -1,13 +1,13 @@
 // Package handlers implements HTTP request handlers for the Stellabill API.
 //
-// Admin login lockout
+// # Admin login lockout
 //
 // The AdminHandler.Login endpoint uses an exponential backoff lockout to
 // rate-limit failed admin authentication attempts.  Each failure for a given
 // source IP + account name doubles the lockout duration from 1s up to a
 // maximum of 15 minutes.
 //
-// Lockout reset
+// # Lockout reset
 //
 // A successful login for the key (source, account) immediately clears its
 // lockout state via LockoutTracker.Reset.  Operators can also force a reset
@@ -123,10 +123,10 @@ func (h *AdminHandler) extractCredentialsFromHeaders(c *gin.Context) AdminLoginR
 // PurgeCache handles cache purge requests.
 func (h *AdminHandler) PurgeCache(c *gin.Context) {
 	if token := c.GetHeader("X-Admin-Token"); token == "" || token != h.expectedToken {
+		audit.LogAction(c, "admin_purge", "cache", "denied", map[string]string{"reason": "invalid_token"})
 		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
 		return
 	}
+	audit.LogAction(c, "admin_purge", "cache", "success", map[string]string{"status": "purged"})
 	c.JSON(http.StatusOK, gin.H{"status": "purged"})
 }
-
-

internal/handlers/reconciliation.go

@@ -18,19 +18,22 @@ func NewReconcileHandler(adapter reconciliation.Adapter, store reconciliation.St
 	return func(c *gin.Context) {
 		callerID, exists := c.Get("callerID")
 		if !exists {
+			audit.LogAction(c, "reconciliation.execute", "reconciliation", "denied", map[string]string{"reason": "missing_auth"})
 			RespondWithAuthError(c, "Missing authentication credentials")
 			return
 		}
 
 		tenantID, exists := c.Get("tenantID")
 		if !exists {
+			audit.LogAction(c, "reconciliation.execute", "reconciliation", "denied", map[string]string{"reason": "missing_tenant"})
 			RespondWithAuthError(c, "Missing tenant context")
 			return
 		}
 		tid := tenantID.(string)
 
 		roles := auth.ExtractRoles(c)
 		if !hasAnyPermission(roles, auth.PermManageReconciliation) {
+			audit.LogAction(c, "reconciliation.execute", "reconciliation", "denied", map[string]string{"reason": "insufficient_permissions"})
 			RespondWithError(c, http.StatusForbidden, ErrorCodeForbidden, "Insufficient permissions for reconciliation")
 			return
 		}
@@ -40,6 +43,7 @@ func NewReconcileHandler(adapter reconciliation.Adapter, store reconciliation.St
 
 		var backendSubs []reconciliation.BackendSubscription
 		if err := c.ShouldBindJSON(&backendSubs); err != nil {
+			audit.LogAction(c, "reconciliation.execute", "reconciliation", "denied", map[string]string{"reason": "invalid_request"})
 			RespondWithValidationError(c, "Invalid request body", map[string]interface{}{
 				"reason": err.Error(),
 			})
@@ -50,6 +54,7 @@ func NewReconcileHandler(adapter reconciliation.Adapter, store reconciliation.St
 		if !isAdmin {
 			for _, b := range backendSubs {
 				if b.TenantID != "" && b.TenantID != tid {
+					audit.LogAction(c, "reconciliation.execute", "reconciliation", "denied", map[string]string{"reason": "cross_tenant"})
 					RespondWithError(c, http.StatusForbidden, ErrorCodeForbidden,
 						"Cannot reconcile subscriptions belonging to another tenant")
 					return
@@ -97,6 +102,12 @@ func NewReconcileHandler(adapter reconciliation.Adapter, store reconciliation.St
 			}
 		}
 
+		audit.LogAction(c, "reconciliation.execute", "reconciliation", "success", map[string]string{
+			"total":      strconv.Itoa(len(reports)),
+			"matched":    strconv.Itoa(matched),
+			"mismatched": strconv.Itoa(len(reports) - matched),
+		})
+
 		c.JSON(http.StatusOK, gin.H{
 			"summary": gin.H{"total": len(reports), "matched": matched, "mismatched": len(reports) - matched},
 			"reports": reports,

internal/routes/routes.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"time"
 
+	"stellarbill-backend/internal/audit"
 	"stellarbill-backend/internal/auth"
 	"stellarbill-backend/internal/config"
 	"stellarbill-backend/internal/db"
@@ -93,6 +94,10 @@ func Register(r *gin.Engine) {
 	subRepo := repository.NewMockSubscriptionRepo()
 	planRepo := repository.NewMockPlanRepo()
 	stmtRepo := repository.NewMockStatementRepo()
+	auditLogger := audit.NewLogger(cfg.JWTSecret, audit.NewSinkFromEnv())
+	if auditLogger != nil {
+		r.Use(audit.Middleware(auditLogger))
+	}
 
 	r.Use(middleware.DataLoaderMiddleware(planRepo, subRepo))