koprogo_api/infrastructure/
audit.rs

1use chrono::Utc;
2use serde::{Deserialize, Serialize};
3use uuid::Uuid;
4
5/// Audit log event types
6#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
7pub enum AuditEventType {
8    // Authentication events
9    UserLogin,
10    UserLogout,
11    UserRegistration,
12    TokenRefresh,
13    AuthenticationFailed,
14
15    // Data modification events
16    BuildingCreated,
17    BuildingUpdated,
18    BuildingDeleted,
19    JournalEntryCreated,
20    JournalEntryDeleted,
21    UnitCreated,
22    UnitUpdated,
23    UnitDeleted,
24    UnitAssignedToOwner,
25    UnitOwnerCreated,
26    UnitOwnerUpdated,
27    UnitOwnerDeleted,
28    OwnerCreated,
29    OwnerUpdated,
30    ExpenseCreated,
31    ExpenseMarkedPaid,
32    InvoiceUpdated,
33    InvoiceSubmitted,
34    InvoiceApproved,
35    InvoiceRejected,
36    MeetingCreated,
37    MeetingCompleted,
38    MeetingMinutesSent,
39    DocumentUploaded,
40    DocumentDeleted,
41
42    // Board management events
43    BoardMemberElected,
44    BoardMemberRemoved,
45    BoardMemberMandateRenewed,
46    BoardDecisionCreated,
47    BoardDecisionUpdated,
48    BoardDecisionCompleted,
49    BoardDecisionNotesAdded,
50
51    // Voting events (Issue #46 - Phase 2)
52    ResolutionCreated,
53    ResolutionDeleted,
54    VoteCast,
55    VoteChanged,
56    VotingClosed,
57
58    // Ticketing events (Issue #85 - Phase 2)
59    TicketCreated,
60    TicketAssigned,
61    TicketStatusChanged,
62    TicketResolved,
63    TicketClosed,
64    TicketCancelled,
65    TicketReopened,
66    TicketDeleted,
67    TicketWorkOrderSent,
68
69    // Notification events (Issue #86 - Phase 2)
70    NotificationCreated,
71    NotificationRead,
72    NotificationDeleted,
73    NotificationPreferenceUpdated,
74
75    // Payment events (Issue #84 - Phase 2)
76    PaymentCreated,
77    PaymentProcessing,
78    PaymentRequiresAction,
79    PaymentSucceeded,
80    PaymentFailed,
81    PaymentCancelled,
82    PaymentRefunded,
83    PaymentDeleted,
84
85    // Payment method events (Issue #84 - Phase 2)
86    PaymentMethodCreated,
87    PaymentMethodUpdated,
88    PaymentMethodSetDefault,
89    PaymentMethodDeactivated,
90    PaymentMethodReactivated,
91    PaymentMethodDeleted,
92
93    // Convocation events (Issue #88 - Phase 2)
94    ConvocationCreated,
95    ConvocationScheduled,
96    ConvocationSent,
97    ConvocationCancelled,
98    ConvocationDeleted,
99    ConvocationReminderSent,
100    ConvocationAttendanceUpdated,
101    ConvocationProxySet,
102    SecondConvocationScheduled,
103
104    // Quote events (Contractor Quotes Module - Issue #91 - Phase 2)
105    QuoteCreated,
106    QuoteSubmitted,
107    QuoteUnderReview,
108    QuoteAccepted,
109    QuoteRejected,
110    QuoteWithdrawn,
111    QuoteExpired,
112    QuoteRatingUpdated,
113    QuoteComparisonPerformed,
114    QuoteDeleted,
115
116    // SEL events (Local Exchange Trading System - Issue #49 - Phase 2)
117    ExchangeCreated,
118    ExchangeRequested,
119    ExchangeStarted,
120    ExchangeCompleted,
121    ExchangeCancelled,
122    ExchangeProviderRated,
123    ExchangeRequesterRated,
124    ExchangeDeleted,
125    CreditBalanceUpdated,
126    CreditBalanceCreated,
127
128    // Notice events (Community Notice Board - Issue #49 - Phase 2)
129    NoticeCreated,
130    NoticeUpdated,
131    NoticePublished,
132    NoticeArchived,
133    NoticePinned,
134    NoticeUnpinned,
135    NoticeExpirationSet,
136    NoticeExpired,
137    NoticeDeleted,
138
139    // Skill events (Skills Directory - Issue #49 - Phase 3)
140    SkillCreated,
141    SkillUpdated,
142    SkillMarkedAvailable,
143    SkillMarkedUnavailable,
144    SkillDeleted,
145
146    // Shared Object events (Object Sharing Library - Issue #49 - Phase 4)
147    SharedObjectCreated,
148    SharedObjectUpdated,
149    SharedObjectMarkedAvailable,
150    SharedObjectMarkedUnavailable,
151    SharedObjectBorrowed,
152    SharedObjectReturned,
153    SharedObjectDeleted,
154
155    // Resource Booking events (Resource Booking Calendar - Issue #49 - Phase 5)
156    ResourceBookingCreated,
157    ResourceBookingUpdated,
158    ResourceBookingCancelled,
159    ResourceBookingCompleted,
160    ResourceBookingNoShow,
161    ResourceBookingConfirmed,
162    ResourceBookingDeleted,
163
164    // Gamification events (Achievements & Challenges - Issue #49 - Phase 6)
165    AchievementCreated,
166    AchievementUpdated,
167    AchievementDeleted,
168    AchievementAwarded,
169    ChallengeCreated,
170    ChallengeActivated,
171    ChallengeUpdated,
172    ChallengeCompleted,
173    ChallengeCancelled,
174    ChallengeDeleted,
175    ChallengeProgressIncremented,
176    ChallengeProgressCompleted,
177
178    // Payment reminder events
179    PaymentReminderCreated,
180    PaymentReminderSent,
181    PaymentReminderOpened,
182    PaymentReminderPaid,
183    PaymentReminderCancelled,
184    PaymentReminderEscalated,
185    PaymentReminderTrackingAdded,
186    PaymentRemindersBulkCreated,
187    PaymentReminderDeleted,
188
189    // État Daté events (Belgian legal requirement for property sales)
190    EtatDateCreated,
191    EtatDateInProgress,
192    EtatDateGenerated,
193    EtatDateDelivered,
194    EtatDateFinancialUpdate,
195    EtatDateAdditionalDataUpdate,
196    EtatDateDeleted,
197
198    // Budget events (Annual budget management)
199    BudgetCreated,
200    BudgetUpdated,
201    BudgetSubmitted,
202    BudgetApproved,
203    BudgetRejected,
204    BudgetArchived,
205    BudgetDeleted,
206
207    // Work Report events (Digital Maintenance Logbook - Issue #134)
208    WorkReportCreated,
209    WorkReportUpdated,
210    WorkReportDeleted,
211    WorkReportPhotoAdded,
212    WorkReportDocumentAdded,
213
214    // Technical Inspection events (Digital Maintenance Logbook - Issue #134)
215    TechnicalInspectionCreated,
216    TechnicalInspectionUpdated,
217    TechnicalInspectionDeleted,
218    TechnicalInspectionReportAdded,
219    TechnicalInspectionPhotoAdded,
220    TechnicalInspectionCertificateAdded,
221
222    // Security events
223    UnauthorizedAccess,
224    RateLimitExceeded,
225    InvalidToken,
226
227    // Two-Factor Authentication events (Issue #78 - Security Hardening)
228    TwoFactorSetupInitiated,
229    TwoFactorEnabled,
230    TwoFactorDisabled,
231    TwoFactorVerified,
232    TwoFactorVerificationFailed,
233    BackupCodeUsed,
234    BackupCodesRegenerated,
235    TwoFactorReverificationRequired,
236
237    // IoT events (Linky/Ores Smart Meter Integration - Issue #133 - IoT Phase 0)
238    IoTReadingCreated,
239    IoTReadingsBulkCreated,
240    LinkyDeviceConfigured,
241    LinkyDataSynced,
242    LinkyDeviceDeleted,
243    LinkySyncToggled,
244
245    // GDPR events (Data Privacy Compliance - Article 30: Records of Processing)
246    GdprDataExported,
247    GdprDataExportFailed,
248    GdprDataErased,
249    GdprDataErasureFailed,
250    GdprErasureCheckRequested,
251    // GDPR Article 16: Right to Rectification
252    GdprDataRectified,
253    GdprDataRectificationFailed,
254    // GDPR Article 18: Right to Restriction of Processing
255    GdprProcessingRestricted,
256    GdprProcessingRestrictionFailed,
257    // GDPR Article 21: Right to Object (Marketing)
258    GdprMarketingOptOut,
259    GdprMarketingOptIn,
260    GdprMarketingPreferenceChangeFailed,
261
262    // GDPR Article 7: Consent Management (Issue #337)
263    ConsentRecorded,
264    ConsentStatusChecked,
265
266    // GDPR Article 33: Security Incidents & APD Notification (Issue #317)
267    SecurityIncidentReported,
268
269    // Accounting events
270    AccountCreated,
271    AccountUpdated,
272    AccountDeleted,
273    BelgianPCMNSeeded,
274
275    // Financial reporting events
276    ReportGenerated,
277}
278
279/// Audit log entry
280#[derive(Debug, Clone, Serialize, Deserialize)]
281pub struct AuditLogEntry {
282    /// Unique ID for this audit entry
283    pub id: Uuid,
284    /// Timestamp of the event
285    pub timestamp: chrono::DateTime<chrono::Utc>,
286    /// Type of event
287    pub event_type: AuditEventType,
288    /// User ID who performed the action (if authenticated)
289    pub user_id: Option<Uuid>,
290    /// Organization ID (for multi-tenant isolation)
291    pub organization_id: Option<Uuid>,
292    /// Resource type affected (e.g., "Building", "Unit")
293    pub resource_type: Option<String>,
294    /// Resource ID affected
295    pub resource_id: Option<Uuid>,
296    /// IP address of the client
297    pub ip_address: Option<String>,
298    /// User agent string
299    pub user_agent: Option<String>,
300    /// Additional metadata as JSON
301    pub metadata: Option<serde_json::Value>,
302    /// Success or failure
303    pub success: bool,
304    /// Error message if failed
305    pub error_message: Option<String>,
306}
307
308impl AuditLogEntry {
309    /// Create a new audit log entry
310    pub fn new(
311        event_type: AuditEventType,
312        user_id: Option<Uuid>,
313        organization_id: Option<Uuid>,
314    ) -> Self {
315        Self {
316            id: Uuid::new_v4(),
317            timestamp: Utc::now(),
318            event_type,
319            user_id,
320            organization_id,
321            resource_type: None,
322            resource_id: None,
323            ip_address: None,
324            user_agent: None,
325            metadata: None,
326            success: true,
327            error_message: None,
328        }
329    }
330
331    /// Set resource information
332    pub fn with_resource(mut self, resource_type: &str, resource_id: Uuid) -> Self {
333        self.resource_type = Some(resource_type.to_string());
334        self.resource_id = Some(resource_id);
335        self
336    }
337
338    /// Set client information
339    pub fn with_client_info(
340        mut self,
341        ip_address: Option<String>,
342        user_agent: Option<String>,
343    ) -> Self {
344        self.ip_address = ip_address;
345        self.user_agent = user_agent;
346        self
347    }
348
349    /// Set metadata
350    pub fn with_metadata(mut self, metadata: serde_json::Value) -> Self {
351        self.metadata = Some(metadata);
352        self
353    }
354
355    /// Mark as failed with error message
356    pub fn with_error(mut self, error_message: String) -> Self {
357        self.success = false;
358        self.error_message = Some(error_message);
359        self
360    }
361
362    /// Add details to metadata as a string
363    pub fn with_details(mut self, details: String) -> Self {
364        let details_json = serde_json::json!({ "details": details });
365        self.metadata = Some(details_json);
366        self
367    }
368
369    /// Log this entry (currently to stdout, can be extended to database/file)
370    pub fn log(&self) {
371        // Redact sensitive information for logging (GDPR compliance)
372        let redact_presence = |present| if present { "[REDACTED]" } else { "None" };
373        let redacted_user = redact_presence(self.user_id.is_some());
374        let redacted_org = redact_presence(self.organization_id.is_some());
375        let redacted_resource_id = redact_presence(self.resource_id.is_some());
376        let redacted_ip = redact_presence(self.ip_address.is_some());
377        let redacted_error = self.error_message.as_ref().map(|_| "[REDACTED]");
378
379        let log_message = format!(
380            "[AUDIT] {} | {:?} | User: {} | Org: {} | Resource: {}/{} | Success: {} | IP: {}",
381            self.timestamp.format("%Y-%m-%d %H:%M:%S"),
382            self.event_type,
383            redacted_user,
384            redacted_org,
385            self.resource_type.as_deref().unwrap_or("None"),
386            redacted_resource_id,
387            self.success,
388            redacted_ip
389        );
390
391        if self.success {
392            log::info!("{}", log_message);
393        } else {
394            log::warn!(
395                "{} | Error: {}",
396                log_message,
397                redacted_error.unwrap_or("None")
398            );
399        }
400
401        // TODO: In production, write full (unredacted) audit data to:
402        // - Database table (audit_logs) with encryption at rest
403        // - Rotating log files in secure location with restricted access
404        // - SIEM system (Security Information and Event Management)
405        // Note: Full audit data (including IP, error messages) should only be
406        // stored in secure, access-controlled systems for compliance and forensics
407    }
408}
409
410/// Helper function to log audit events asynchronously
411///
412/// This is a convenience function for background audit logging
413/// without database persistence (logs to stdout/file only).
414///
415/// Parameters:
416/// - event_type: Type of audit event
417/// - user_id: Optional user ID who performed the action
418/// - organization_id: Optional organization ID for multi-tenant isolation
419/// - details: Optional details string
420/// - metadata: Optional additional metadata as JSON
421pub async fn log_audit_event(
422    event_type: AuditEventType,
423    user_id: Option<Uuid>,
424    organization_id: Option<Uuid>,
425    details: Option<String>,
426    metadata: Option<serde_json::Value>,
427) {
428    let mut entry = AuditLogEntry::new(event_type, user_id, organization_id);
429
430    if let Some(details_str) = details {
431        entry = entry.with_details(details_str);
432    }
433
434    if let Some(meta) = metadata {
435        entry.metadata = Some(meta);
436    }
437
438    entry.log();
439}
440
441/// Helper macro to create and log audit entries
442#[macro_export]
443macro_rules! audit_log {
444    ($event_type:expr, $user_id:expr, $org_id:expr) => {
445        $crate::infrastructure::audit::AuditLogEntry::new($event_type, $user_id, $org_id).log()
446    };
447    ($event_type:expr, $user_id:expr, $org_id:expr, $resource_type:expr, $resource_id:expr) => {
448        $crate::infrastructure::audit::AuditLogEntry::new($event_type, $user_id, $org_id)
449            .with_resource($resource_type, $resource_id)
450            .log()
451    };
452}
453
454#[cfg(test)]
455mod tests {
456    use super::*;
457
458    #[test]
459    fn test_audit_log_creation() {
460        let user_id = Uuid::new_v4();
461        let org_id = Uuid::new_v4();
462        let building_id = Uuid::new_v4();
463
464        let entry =
465            AuditLogEntry::new(AuditEventType::BuildingCreated, Some(user_id), Some(org_id))
466                .with_resource("Building", building_id)
467                .with_client_info(Some("192.168.1.1".to_string()), None);
468
469        assert_eq!(entry.user_id, Some(user_id));
470        assert_eq!(entry.organization_id, Some(org_id));
471        assert_eq!(entry.resource_id, Some(building_id));
472        assert!(entry.success);
473    }
474
475    #[test]
476    fn test_audit_log_with_error() {
477        let entry = AuditLogEntry::new(AuditEventType::AuthenticationFailed, None, None)
478            .with_error("Invalid credentials".to_string());
479
480        assert!(!entry.success);
481        assert_eq!(entry.error_message, Some("Invalid credentials".to_string()));
482    }
483}
koprogo_api/infrastructure/audit.rs

koprogo_api/infrastructure/
audit.rs
