| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 3 | | using ArturRios.Heimdall.Query.Input; |
| | | 4 | | using ArturRios.Heimdall.Query.Output; |
| | | 5 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 6 | | using ArturRios.Heimdall.Shared.Time; |
| | | 7 | | using ArturRios.Mediator.Query.Interfaces; |
| | | 8 | | using ArturRios.Output; |
| | | 9 | | using FluentValidation; |
| | | 10 | | |
| | | 11 | | namespace ArturRios.Heimdall.Query.Handlers; |
| | | 12 | | |
| | | 13 | | /// <summary> |
| | | 14 | | /// Handles <see cref="ListAuditLogQuery" /> (UC-48, FR-AT-01/02): the audit trail, newest first, |
| | | 15 | | /// filtered by recording time, actor, action, target and outcome. |
| | | 16 | | /// </summary> |
| | | 17 | | /// <remarks> |
| | | 18 | | /// <para> |
| | | 19 | | /// Authorization is entirely the endpoint's: the only actor is the System Admin, and the |
| | | 20 | | /// <c>RoleRequirement</c> settles it. There is no data-dependent rule left, because the trail |
| | | 21 | | /// has no scope column to scope a Scope Admin's view by. |
| | | 22 | | /// </para> |
| | | 23 | | /// <para> |
| | | 24 | | /// Entries are projected as stored and nothing else is read — no join to <c>PERSON</c>, no |
| | | 25 | | /// inference from neighbouring entries. An attribution cleared under NFR-21 stays cleared |
| | | 26 | | /// here (Data Retention Schedule §7.1); reading the trail must not undo what retention did. |
| | | 27 | | /// </para> |
| | | 28 | | /// </remarks> |
| | 38 | 29 | | public class ListAuditLogQueryHandler( |
| | 38 | 30 | | IAsyncReadOnlyRepository<AuditLog, long> auditReader, |
| | 38 | 31 | | IValidator<ListAuditLogQuery> validator) |
| | | 32 | | : IPaginatedQueryHandlerAsync<ListAuditLogQuery, AuditLogEntryOutput> |
| | | 33 | | { |
| | | 34 | | public async Task<PaginatedOutput<AuditLogEntryOutput>> HandleAsync( |
| | | 35 | | ListAuditLogQuery query, CancellationToken cancellationToken = default) |
| | | 36 | | { |
| | 38 | 37 | | var output = PaginatedOutput<AuditLogEntryOutput>.New; |
| | | 38 | | |
| | | 39 | | // AF-48a (NFR-10): the range, the action's length and the page, before any query runs. |
| | 38 | 40 | | var validation = await validator.ValidateAsync(query, cancellationToken); |
| | | 41 | | |
| | 38 | 42 | | if (!validation.IsValid) |
| | | 43 | | { |
| | 8 | 44 | | return output.WithErrors(validation.Errors.Select(failure => failure.ErrorMessage)); |
| | | 45 | | } |
| | | 46 | | |
| | 34 | 47 | | var entries = auditReader.Query(); |
| | | 48 | | |
| | 34 | 49 | | if (query.From is { } from) |
| | | 50 | | { |
| | 6 | 51 | | var fromUtc = UtcInstant.Of(from); |
| | 6 | 52 | | entries = entries.Where(x => x.CreatedAt >= fromUtc); |
| | | 53 | | } |
| | | 54 | | |
| | 34 | 55 | | if (query.To is { } to) |
| | | 56 | | { |
| | 3 | 57 | | var toUtc = UtcInstant.Of(to); |
| | 3 | 58 | | entries = entries.Where(x => x.CreatedAt <= toUtc); |
| | | 59 | | } |
| | | 60 | | |
| | 34 | 61 | | if (query.ActorId is { } actorId) |
| | | 62 | | { |
| | 3 | 63 | | entries = entries.Where(x => x.ActorPersonId == actorId); |
| | | 64 | | } |
| | | 65 | | |
| | | 66 | | // Exact, as recorded. Blank means no filter — what a cleared text box submits. |
| | 34 | 67 | | if (!string.IsNullOrWhiteSpace(query.Action)) |
| | | 68 | | { |
| | 8 | 69 | | var action = query.Action; |
| | 8 | 70 | | entries = entries.Where(x => x.Action == action); |
| | | 71 | | } |
| | | 72 | | |
| | 34 | 73 | | if (query.TargetId is { } targetId) |
| | | 74 | | { |
| | 14 | 75 | | entries = entries.Where(x => x.TargetId == targetId); |
| | | 76 | | } |
| | | 77 | | |
| | 34 | 78 | | if (query.Succeeded is { } succeeded) |
| | | 79 | | { |
| | 3 | 80 | | entries = entries.Where(x => x.Succeeded == succeeded); |
| | | 81 | | } |
| | | 82 | | |
| | | 83 | | // Newest first, with the internal id as tiebreaker: a command and its audited side effects |
| | | 84 | | // share an instant often enough that, without it, a page boundary between them could show |
| | | 85 | | // one entry twice and another never. Ordered on the entity, since the id never reaches the |
| | | 86 | | // output, then projected and paginated over that ordering. |
| | 34 | 87 | | var projected = entries |
| | 34 | 88 | | .OrderByDescending(x => x.CreatedAt) |
| | 34 | 89 | | .ThenByDescending(x => x.Id) |
| | 34 | 90 | | .Select(x => new AuditLogEntryOutput |
| | 34 | 91 | | { |
| | 34 | 92 | | Id = x.PublicId, |
| | 34 | 93 | | RecordedAt = x.CreatedAt, |
| | 34 | 94 | | ActorId = x.ActorPersonId, |
| | 34 | 95 | | ActorRole = x.ActorRole, |
| | 34 | 96 | | Action = x.Action, |
| | 34 | 97 | | TargetId = x.TargetId, |
| | 34 | 98 | | Succeeded = x.Succeeded, |
| | 34 | 99 | | FailureReason = x.FailureReason |
| | 34 | 100 | | }); |
| | | 101 | | |
| | 34 | 102 | | var page = await projected.PaginateAsync(query.PageNumber, query.PageSize, orderBy: null); |
| | | 103 | | |
| | 34 | 104 | | return page.WithMessage(AuditMessages.AuditLogRetrieved); |
| | 38 | 105 | | } |
| | | 106 | | } |