add audit records where documents accessed

Author: dbarkowsky

apps/backend-services/src/benchmark/dataset.controller.spec.ts

@@ -6,6 +6,8 @@ jest.mock("@/auth/identity.helpers", () => ({
 import { BadRequestException, NotFoundException } from "@nestjs/common";
 import { Test, TestingModule } from "@nestjs/testing";
 import { Request } from "express";
+import { AuditService } from "@/audit/audit.service";
+import { AppLoggerService } from "@/logging/app-logger.service";
 import { DatasetController } from "./dataset.controller";
 import { DatasetService } from "./dataset.service";
 import {
@@ -40,6 +42,16 @@ const mockDatasetService = {
   deleteDataset: jest.fn(),
 };
 
+const mockAuditService = {
+  recordEvent: jest.fn().mockResolvedValue(undefined),
+};
+const mockLogger = {
+  debug: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  log: jest.fn(),
+};
+
 describe("DatasetController", () => {
   let controller: DatasetController;
 
@@ -58,7 +70,11 @@ describe("DatasetController", () => {
 
     const module: TestingModule = await Test.createTestingModule({
       controllers: [DatasetController],
-      providers: [{ provide: DatasetService, useValue: mockDatasetService }],
+      providers: [
+        { provide: DatasetService, useValue: mockDatasetService },
+        { provide: AppLoggerService, useValue: mockLogger },
+        { provide: AuditService, useValue: mockAuditService },
+      ],
     }).compile();
 
     controller = module.get<DatasetController>(DatasetController);
@@ -701,6 +717,14 @@ describe("DatasetController", () => {
         "Content-Length": fileBuffer.length.toString(),
       });
       expect(mockRes.send).toHaveBeenCalledWith(fileBuffer);
+      expect(mockAuditService.recordEvent).toHaveBeenCalledWith({
+        event_type: "document_accessed",
+        resource_type: "dataset_document",
+        resource_id: "dataset-123",
+        actor_id: "user-123",
+        group_id: "test-group",
+        payload: { action: "download" },
+      });
     });
 
     it("throws when path query param is missing", async () => {

apps/backend-services/src/benchmark/dataset.controller.ts

@@ -40,11 +40,13 @@ import {
 } from "@nestjs/swagger";
 import type { Response } from "express";
 import { Request } from "express";
+import { AuditService } from "@/audit/audit.service";
 import { Identity } from "@/auth/identity.decorator";
 import {
   getIdentityGroupIds,
   identityCanAccessGroup,
 } from "@/auth/identity.helpers";
+import { AppLoggerService } from "@/logging/app-logger.service";
 import { DatasetService } from "./dataset.service";
 import {
   CreateDatasetDto,
@@ -69,14 +71,18 @@ import {
 @ApiTags("Benchmark - Datasets")
 @Controller("api/benchmark/datasets")
 export class DatasetController {
-  constructor(private readonly datasetService: DatasetService) {}
+  constructor(
+    private readonly datasetService: DatasetService,
+    private readonly auditService: AuditService,
+  ) {}
 
   private async assertDatasetGroupAccess(
     datasetId: string,
     req: Request,
-  ): Promise<void> {
+  ): Promise<string> {
     const dataset = await this.datasetService.getDatasetById(datasetId);
     identityCanAccessGroup(req.resolvedIdentity, dataset.groupId);
+    return dataset.groupId;
   }
 
   @Post()
@@ -508,7 +514,15 @@ export class DatasetController {
     @Param("sampleId") sampleId: string,
     @Req() req: Request,
   ): Promise<GroundTruthResponseDto> {
-    await this.assertDatasetGroupAccess(id, req);
+    const groupId = await this.assertDatasetGroupAccess(id, req);
+    await this.auditService.recordEvent({
+      event_type: "dataset_accessed",
+      resource_type: "ground_truth",
+      resource_id: id,
+      actor_id: req.resolvedIdentity.actorId,
+      group_id: groupId,
+      payload: { action: "download" },
+    });
     return this.datasetService.getGroundTruth(id, versionId, sampleId);
   }
 
@@ -530,13 +544,21 @@ export class DatasetController {
     @Req() req: Request,
     @Res() res: Response,
   ): Promise<void> {
-    await this.assertDatasetGroupAccess(id, req);
+    const groupId = await this.assertDatasetGroupAccess(id, req);
 
     if (!filePath) {
       throw new BadRequestException("Query parameter 'path' is required");
     }
     const { buffer, filename, mimeType } =
       await this.datasetService.getSampleFile(id, versionId, filePath);
+    await this.auditService.recordEvent({
+      event_type: "document_accessed",
+      resource_type: "dataset_document",
+      resource_id: id,
+      actor_id: req.resolvedIdentity.actorId,
+      group_id: groupId,
+      payload: { action: "download" },
+    });
     res.set({
       "Content-Type": mimeType,
       "Content-Disposition": `attachment; filename="${filename}"`,

apps/backend-services/src/document/document.controller.spec.ts

@@ -224,12 +224,11 @@ describe("DocumentController", () => {
       const result = await controller.getOcrResult("1", mockReq as any);
       expect(mockAuditService.recordEvent).toHaveBeenCalledWith({
         event_type: "document_accessed",
-        resource_type: "document",
-        resource_id: "1",
+        resource_type: "ocr_result",
+        resource_id: "ocr-1",
         actor_id: "actor-1",
         document_id: "1",
         group_id: mockGroupId,
-        request_id: undefined,
         payload: { action: "ocr" },
       });
       expect(result).toEqual({

apps/backend-services/src/document/document.controller.ts

@@ -137,6 +137,16 @@ export class DocumentController {
       throw new NotFoundException(`Document not found: ${documentId}`);
     }
 
+    await this.auditService.recordEvent({
+      event_type: "document_accessed",
+      resource_type: "document",
+      resource_id: documentId,
+      actor_id: req.resolvedIdentity.actorId,
+      document_id: documentId,
+      group_id: document.group_id ?? undefined,
+      payload: { action: "metadata" },
+    });
+
     this.logger.debug("=== DocumentController.updateDocument completed ===");
     return updated;
   }
@@ -277,6 +287,15 @@ export class DocumentController {
               );
             }
           }
+          await this.auditService.recordEvent({
+            event_type: "document_accessed",
+            resource_type: "document",
+            resource_id: doc.id,
+            actor_id: req.resolvedIdentity.actorId,
+            document_id: doc.id,
+            group_id: doc.group_id,
+            payload: { action: "metadata" },
+          });
           return doc;
         }),
       );
@@ -323,16 +342,6 @@ export class DocumentController {
 
       identityCanAccessGroup(req.resolvedIdentity, document.group_id);
 
-      await this.auditService.recordEvent({
-        event_type: "document_accessed",
-        resource_type: "document",
-        resource_id: documentId,
-        actor_id: req.resolvedIdentity.actorId,
-        document_id: documentId,
-        group_id: document.group_id ?? undefined,
-        payload: { action: "ocr" },
-      });
-
       this.logger.debug(`Document status: ${document.status}`);
       this.logger.debug(`Document created: ${document.created_at}`);
       if (document.apim_request_id) {
@@ -366,9 +375,20 @@ export class DocumentController {
           `OCR result retrieved successfully for document: ${documentId}`,
         );
         this.logger.debug(`OCR processed at: ${ocrResult.processed_at}`);
+
+        await this.auditService.recordEvent({
+          event_type: "document_accessed",
+          resource_type: "ocr_result",
+          resource_id: ocrResult.id,
+          actor_id: req.resolvedIdentity.actorId,
+          document_id: documentId,
+          group_id: document.group_id ?? undefined,
+          payload: { action: "ocr" },
+        });
       }
 
       this.logger.debug("=== DocumentController.getOcrResult completed ===");
+
       return response;
     } catch (error) {
       this.logger.error(`Error retrieving OCR result: ${error.message}`);
@@ -415,16 +435,6 @@ export class DocumentController {
 
       identityCanAccessGroup(req.resolvedIdentity, document.group_id);
 
-      await this.auditService.recordEvent({
-        event_type: "document_accessed",
-        resource_type: "document",
-        resource_id: documentId,
-        actor_id: req.resolvedIdentity.actorId,
-        document_id: documentId,
-        group_id: document.group_id ?? undefined,
-        payload: { action: "download" },
-      });
-
       // Read file from blob storage using the blob key
       const fileBuffer = await this.blobStorage.read(document.file_path);
 
@@ -448,6 +458,16 @@ export class DocumentController {
         "=== DocumentController.downloadDocument completed ===",
       );
 
+      await this.auditService.recordEvent({
+        event_type: "document_accessed",
+        resource_type: "document",
+        resource_id: documentId,
+        actor_id: req.resolvedIdentity.actorId,
+        document_id: documentId,
+        group_id: document.group_id,
+        payload: { action: "download" },
+      });
+
       res.send(fileBuffer);
     } catch (error) {
       this.logger.error(`Error downloading document: ${error.message}`);

apps/backend-services/src/hitl/hitl.controller.spec.ts

@@ -2,6 +2,7 @@ import { GroupRole } from "@generated/client";
 import { ForbiddenException, NotFoundException } from "@nestjs/common";
 import { Test, TestingModule } from "@nestjs/testing";
 import { Request } from "express";
+import { AuditService } from "@/audit/audit.service";
 import { DocumentService } from "../document/document.service";
 import { EscalateDto, SubmitCorrectionsDto } from "./dto/correction.dto";
 import { ReviewSessionDto } from "./dto/review-session.dto";
@@ -63,6 +64,10 @@ describe("HitlController", () => {
           provide: DocumentService,
           useValue: documentService,
         },
+        {
+          provide: AuditService,
+          useValue: { recordEvent: jest.fn().mockResolvedValue(undefined) },
+        },
       ],
     }).compile();
 
@@ -76,6 +81,7 @@ describe("HitlController", () => {
           userId: "user-1",
           isSystemAdmin: false,
           groupRoles: { "group-1": GroupRole.MEMBER },
+          actorId: "actor-1",
         },
       } as unknown as Request;
       const mockResult = { documents: [], total: 0 };
@@ -103,6 +109,7 @@ describe("HitlController", () => {
           userId: "user-1",
           isSystemAdmin: false,
           groupRoles: { "group-1": GroupRole.MEMBER },
+          actorId: "actor-1",
         },
       } as unknown as Request;
       hitlService.getQueue.mockResolvedValue({
@@ -315,6 +322,7 @@ describe("HitlController", () => {
           userId: "user-1",
           isSystemAdmin: false,
           groupRoles: { "group-1": GroupRole.MEMBER },
+          actorId: "actor-1",
         },
       } as unknown as Request;
       const mockResult = { id: "session-1" };

apps/backend-services/src/hitl/hitl.controller.ts

@@ -20,6 +20,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import { Request } from "express";
+import { AuditService } from "@/audit/audit.service";
 import { Identity } from "@/auth/identity.decorator";
 import {
   getIdentityGroupIds,
@@ -47,6 +48,7 @@ export class HitlController {
   constructor(
     private readonly hitlService: HitlService,
     private readonly documentService: DocumentService,
+    private readonly auditService: AuditService,
   ) {}
 
   @Get("queue")
@@ -64,7 +66,20 @@ export class HitlController {
     } else {
       groupIds = getIdentityGroupIds(req.resolvedIdentity);
     }
-    return this.hitlService.getQueue(filters, groupIds);
+    const result = await this.hitlService.getQueue(filters, groupIds);
+    await Promise.all(
+      result.documents.map((doc) =>
+        this.auditService.recordEvent({
+          event_type: "document_accessed",
+          resource_type: "document",
+          resource_id: doc.id,
+          actor_id: req.resolvedIdentity?.actorId,
+          document_id: doc.id,
+          payload: { action: "queue_review" },
+        }),
+      ),
+    );
+    return result;
   }
 
   @Get("queue/stats")
@@ -138,7 +153,17 @@ export class HitlController {
       throw new NotFoundException(`Review session ${id} not found`);
     }
     identityCanAccessGroup(req.resolvedIdentity, session.document.group_id);
-    return this.hitlService.getSession(id);
+    const result = await this.hitlService.getSession(id);
+    await this.auditService.recordEvent({
+      event_type: "document_accessed",
+      resource_type: "ocr_result",
+      resource_id: session.document_id,
+      actor_id: req.resolvedIdentity?.actorId,
+      document_id: session.document_id,
+      group_id: session.document.group_id ?? undefined,
+      payload: { action: "review_session" },
+    });
+    return result;
   }
 
   @Post("sessions/:id/corrections")