minstrel/internal/audit/audit_test.go

package audit_test

import (
	"context"
	"os"
	"testing"

	"github.com/jackc/pgx/v5/pgtype"
	"github.com/jackc/pgx/v5/pgxpool"

	"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
)

func newTestPool(t *testing.T) *pgxpool.Pool {
	t.Helper()
	url := os.Getenv("MINSTREL_TEST_DATABASE_URL")
	if url == "" {
		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
	}
	pool, err := pgxpool.New(context.Background(), url)
	if err != nil {
		t.Fatalf("connect: %v", err)
	}
	t.Cleanup(pool.Close)
	// Reset audit_log so each test runs against a known state.
	if _, err := pool.Exec(context.Background(), `DELETE FROM audit_log`); err != nil {
		t.Fatalf("reset audit_log: %v", err)
	}
	return pool
}

func validUUID() pgtype.UUID {
	var u pgtype.UUID
	u.Valid = true
	// Arbitrary fixed bytes; we don't need a real user to exist
	// because the FK is ON DELETE SET NULL — orphan FKs are fine
	// for the audit_log column shape.
	for i := range u.Bytes {
		u.Bytes[i] = byte(i + 1)
	}
	return u
}

func TestWrite_NoMetadata(t *testing.T) {
	pool := newTestPool(t)
	// Use NULL FKs (Valid: false) — the column is nullable.
	var nilUUID pgtype.UUID
	if err := audit.Write(context.Background(), pool, nilUUID, nilUUID, audit.ActionRegister, nil); err != nil {
		t.Fatalf("Write: %v", err)
	}
	var count int
	if err := pool.QueryRow(context.Background(),
		`SELECT count(*) FROM audit_log WHERE action = 'register' AND metadata IS NULL`,
	).Scan(&count); err != nil {
		t.Fatalf("count: %v", err)
	}
	if count != 1 {
		t.Errorf("count = %d, want 1", count)
	}
}

func TestWrite_WithMetadata(t *testing.T) {
	pool := newTestPool(t)
	var nilUUID pgtype.UUID
	if err := audit.Write(context.Background(), pool, nilUUID, nilUUID, audit.ActionPromoteAdmin, map[string]any{
		"reason":      "test",
		"first_admin": true,
	}); err != nil {
		t.Fatalf("Write: %v", err)
	}
	var meta string
	if err := pool.QueryRow(context.Background(),
		`SELECT metadata::text FROM audit_log WHERE action = 'promote_admin' LIMIT 1`,
	).Scan(&meta); err != nil {
		t.Fatalf("read metadata: %v", err)
	}
	if !contains(meta, `"first_admin":true`) || !contains(meta, `"reason":"test"`) {
		t.Errorf("metadata = %q, expected first_admin + reason fields", meta)
	}
}

func contains(s, sub string) bool {
	return len(s) >= len(sub) && (func() bool {
		for i := 0; i+len(sub) <= len(s); i++ {
			if s[i:i+len(sub)] == sub {
				return true
			}
		}
		return false
	})()
}

func TestWrite_AllActionConstantsArePersisted(t *testing.T) {
	pool := newTestPool(t)
	var nilUUID pgtype.UUID
	actions := []audit.Action{
		audit.ActionRegister,
		audit.ActionPromoteAdmin,
		audit.ActionDemoteAdmin,
		audit.ActionInviteCreate,
		audit.ActionInviteRedeem,
		audit.ActionInviteRevoke,
		audit.ActionCreateUserAdmin,
		audit.ActionDeleteUser,
		audit.ActionPasswordResetAdmin,
		audit.ActionAutoApproveToggle,
		audit.ActionPasswordChangeSelf,
		audit.ActionTokenRegenerate,
		audit.ActionForgotPasswordInit,
		audit.ActionPasswordResetByEmail,
	}
	for _, a := range actions {
		if err := audit.Write(context.Background(), pool, nilUUID, nilUUID, a, nil); err != nil {
			t.Errorf("action %q: Write: %v", a, err)
		}
	}
	var count int
	if err := pool.QueryRow(context.Background(), `SELECT count(*) FROM audit_log`).Scan(&count); err != nil {
		t.Fatalf("count: %v", err)
	}
	if count != len(actions) {
		t.Errorf("count = %d, want %d", count, len(actions))
	}
}