Merge pull request #711 from d3v-active/feat/flag-audit-trail

feat: audit trail for feature flag changes

Author: thlpkee20-wq

internal/featureflags/featureflags.go

@@ -15,6 +15,7 @@ type Flag struct {
 	Enabled     bool      `json:"enabled"`
 	Description string    `json:"description"`
 	UpdatedAt   time.Time `json:"updated_at"`
+	Version     int64     `json:"version"`
 }
 
 type Manager struct {
@@ -79,6 +80,7 @@ func (m *Manager) LoadDefaultFlags() {
 			Enabled:     false,
 			Description: "Enable fault injection middleware for resilience testing",
 			UpdatedAt:   time.Now(),
+			Version:     time.Now().UnixNano(),
 		},
 	}
 
@@ -103,6 +105,7 @@ func (m *Manager) LoadFromEnvironment() {
 						Enabled:     enabled,
 						Description: "Environment-defined flag",
 						UpdatedAt:   time.Now(),
+						Version:     time.Now().UnixNano(),
 					}
 				}
 				m.mutex.Unlock()
@@ -133,6 +136,7 @@ func (m *Manager) LoadFromEnvironment() {
 						Enabled:     enabled,
 						Description: "Environment flag",
 						UpdatedAt:   time.Now(),
+						Version:     time.Now().UnixNano(),
 					}
 				}
 				m.mutex.Unlock()
@@ -212,22 +216,34 @@ func (m *Manager) GetFlag(flagName string) (*Flag, bool) {
 }
 
 func (m *Manager) SetFlag(flagName string, enabled bool, description string) {
+	m.SetFlagWithVersion(flagName, enabled, description, time.Now().UnixNano())
+}
+
+func (m *Manager) SetFlagWithVersion(flagName string, enabled bool, description string, version int64) bool {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
 	if flag, exists := m.flags[flagName]; exists {
+		if version <= flag.Version {
+			// Monotonic version check: last writer wins. If version is older, reject.
+			return false
+		}
 		flag.Enabled = enabled
 		flag.UpdatedAt = time.Now()
+		flag.Version = version
 		if description != "" {
 			flag.Description = description
 		}
+		return true
 	} else {
 		m.flags[flagName] = &Flag{
 			Name:        flagName,
 			Enabled:     enabled,
 			Description: description,
 			UpdatedAt:   time.Now(),
+			Version:     version,
 		}
+		return true
 	}
 }
 

internal/featureflags/featureflags_test.go

@@ -228,3 +228,36 @@ func TestSafeFlagProtection(t *testing.T) {
 		t.Error("Critical flag should not be disabled")
 	}
 }
+
+func TestSetFlagWithVersion_Monotonic(t *testing.T) {
+	manager := GetInstance()
+
+	// Initial set
+	success := manager.SetFlagWithVersion("monotonic_test", true, "Initial", 100)
+	if !success {
+		t.Error("Expected initial set to succeed")
+	}
+
+	// Try to set with older version
+	success = manager.SetFlagWithVersion("monotonic_test", false, "Older", 50)
+	if success {
+		t.Error("Expected set with older version to fail")
+	}
+
+	// Try to set with same version
+	success = manager.SetFlagWithVersion("monotonic_test", false, "Same", 100)
+	if success {
+		t.Error("Expected set with same version to fail")
+	}
+
+	// Try to set with newer version
+	success = manager.SetFlagWithVersion("monotonic_test", false, "Newer", 150)
+	if !success {
+		t.Error("Expected set with newer version to succeed")
+	}
+	
+	flag, exists := manager.GetFlag("monotonic_test")
+	if !exists || flag.Enabled {
+		t.Error("Flag should be disabled now")
+	}
+}

internal/handlers/feature_flags.go

@@ -2,6 +2,8 @@ package handlers
 
 import (
 	"net/http"
+	"strings"
+	"time"
 	"stellarbill-backend/internal/audit"
 	"stellarbill-backend/internal/featureflags"
 
@@ -50,15 +52,38 @@ func (h *FeatureFlagsHandler) ToggleFeatureFlag(c *gin.Context) {
 
 	// Toggle and update flag
 	afterEnabled := !beforeEnabled
-	h.flagManager.SetFlag(req.Name, afterEnabled, flag.Description)
+	newVersion := time.Now().UnixNano()
+	
+	success := h.flagManager.SetFlagWithVersion(req.Name, afterEnabled, flag.Description, newVersion)
+	if !success {
+		RespondWithError(c, http.StatusConflict, ErrorCodeConflict, "concurrent modification: flag was updated by another request")
+		return
+	}
 
 	// Get updated flag
 	updatedFlag, _ := h.flagManager.GetFlag(req.Name)
 
+	isSensitive := false
+	lowerName := strings.ToLower(req.Name)
+	sensitiveKeys := []string{"secret", "token", "password", "key", "auth", "cvv", "card"}
+	for _, sk := range sensitiveKeys {
+		if strings.Contains(lowerName, sk) {
+			isSensitive = true
+			break
+		}
+	}
+
+	beforeStr := boolToString(beforeEnabled)
+	afterStr := boolToString(afterEnabled)
+	if isSensitive {
+		beforeStr = "[REDACTED]"
+		afterStr = "[REDACTED]"
+	}
+
 	// Log audit action (failure doesn't block success)
 	audit.LogAction(c, "feature_flag_toggle", req.Name, "success", map[string]string{
-		"before_enabled": boolToString(beforeEnabled),
-		"after_enabled":  boolToString(afterEnabled),
+		"before_enabled": beforeStr,
+		"after_enabled":  afterStr,
 		"reason":         req.Reason,
 	})
 

internal/worker/audit_exporter.go

@@ -16,6 +16,17 @@ import (
 // AuditExporterJob handles the nightly export of audit logs to a data warehouse.
 // In this implementation, it exports to a local staging file which a data warehouse
 // ingestion tool (like Fluentd, Logstash, or a cron script) will pick up.
+//
+// Export Schema (JSONL):
+// - timestamp: ISO8601 string of the event time
+// - actor: ID or IP of the user who performed the action
+// - action: "feature_flag_toggle"
+// - resource: The name of the feature flag
+// - outcome: "success" or "failure"
+// - reason: The reason provided for the toggle
+// - before_enable: The state of the flag before the toggle (or [REDACTED])
+// - after_enable: The state of the flag after the toggle (or [REDACTED])
+// - hash: Cryptographic hash of the event
 type AuditExporterJob struct {
 	auditLogPath   string
 	exportFilePath string
@@ -107,3 +118,24 @@ func (j *AuditExporterJob) Run(ctx context.Context) error {
 	security.ProductionLogger().Info("Audit log export completed", zap.Int("exported_count", exportedCount))
 	return nil
 }
+
+// Start begins the ticker for the nightly export process.
+func (j *AuditExporterJob) Start(ctx context.Context, interval time.Duration) {
+	if interval <= 0 {
+		interval = 24 * time.Hour
+	}
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			if err := j.Run(ctx); err != nil {
+				security.ProductionLogger().Error("Nightly audit export failed", zap.Error(err))
+			}
+		}
+	}
+}
+