feat(audit): align chatwoot audit log payloads

internal/handler/api/v1/audit_handler_test.go

@@ -1,10 +1,12 @@
 package v1
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/gochat/gochat/internal/model"
@@ -52,24 +54,135 @@ func TestAuditHandlerSuite(t *testing.T) {
 	suite.Run(t, new(AuditHandlerTestSuite))
 }
 
-func (s *AuditHandlerTestSuite) TestList_Success() {
+func (s *AuditHandlerTestSuite) SetupTest() {
+	s.Require().NoError(s.db.Exec("DELETE FROM audits").Error)
+}
+
+func (s *AuditHandlerTestSuite) TestList_ChatwootPayloadFiltersAndSerializer() {
 	r := gin.New()
-	r.GET("/api/v1/accounts/:account_id/audit_logs", s.handler.List)
+	r.GET("/api/v1/accounts/:account_id/audit_logs", withAuditRole("administrator", s.handler.List))
+
+	createdAt := time.Unix(1710000000, 0).UTC()
+	userID := uint(42)
+	associatedID := s.account.ID
+	version := 3
+	audit := &model.Audit{
+		AccountID:      &s.account.ID,
+		UserID:         &userID,
+		AuditableType:  "Conversation",
+		AuditableID:    777,
+		Action:         "update",
+		AuditedChanges: json.RawMessage(`{"status":["open","resolved"]}`),
+		AssociatedType: "Account",
+		AssociatedID:   &associatedID,
+		Username:       "admin@example.com",
+		RemoteAddress:  "203.0.113.10",
+		RequestUUID:    "req-123",
+		Version:        &version,
+		Comment:        "status changed",
+		UserType:       "User",
+		CreatedAt:      createdAt,
+	}
+	s.Require().NoError(s.db.Create(audit).Error)
+
+	otherAccount := &model.Account{Name: "other-audit-account"}
+	s.Require().NoError(s.db.Create(otherAccount).Error)
+	s.Require().NoError(s.db.Create(&model.Audit{
+		AccountID:      &otherAccount.ID,
+		AuditableType:  "Conversation",
+		AuditableID:    999,
+		Action:         "update",
+		AuditedChanges: json.RawMessage(`{}`),
+	}).Error)
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", fmt.Sprintf("/api/v1/accounts/%d/audit_logs?page=1&per_page=100&action=update&auditable_type=Conversation", s.account.ID), nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(s.T(), http.StatusOK, w.Code)
+	var body map[string]any
+	s.Require().NoError(json.Unmarshal(w.Body.Bytes(), &body))
+	assert.NotContains(s.T(), body, "success")
+	assert.Equal(s.T(), float64(25), body["per_page"])
+	assert.Equal(s.T(), float64(1), body["current_page"])
+	assert.Equal(s.T(), float64(1), body["total_entries"])
+
+	logs := body["audit_logs"].([]any)
+	s.Require().Len(logs, 1)
+	log := logs[0].(map[string]any)
+	assert.Equal(s.T(), float64(audit.ID), log["id"])
+	assert.Equal(s.T(), float64(777), log["auditable_id"])
+	assert.Equal(s.T(), "Conversation", log["auditable_type"])
+	assert.Contains(s.T(), log, "auditable")
+	assert.Nil(s.T(), log["auditable"])
+	assert.Equal(s.T(), float64(s.account.ID), log["associated_id"])
+	assert.Equal(s.T(), "Account", log["associated_type"])
+	assert.Equal(s.T(), float64(userID), log["user_id"])
+	assert.Equal(s.T(), "User", log["user_type"])
+	assert.Equal(s.T(), "admin@example.com", log["username"])
+	assert.Equal(s.T(), "update", log["action"])
+	assert.Equal(s.T(), float64(version), log["version"])
+	assert.Equal(s.T(), "status changed", log["comment"])
+	assert.Equal(s.T(), "req-123", log["request_uuid"])
+	assert.Equal(s.T(), float64(createdAt.Unix()), log["created_at"])
+	assert.Equal(s.T(), "203.0.113.10", log["remote_address"])
+}
+
+func (s *AuditHandlerTestSuite) TestList_AssociatedAccountScopeAndFixedPageSize() {
+	r := gin.New()
+	r.GET("/api/v1/accounts/:account_id/audit_logs", withAuditRole("administrator", s.handler.List))
+
+	associatedID := s.account.ID
+	for i := 0; i < 26; i++ {
+		s.Require().NoError(s.db.Create(&model.Audit{
+			AuditableType:  "Conversation",
+			AuditableID:    uint(i + 1),
+			Action:         "update",
+			AuditedChanges: json.RawMessage(`{}`),
+			AssociatedType: "Account",
+			AssociatedID:   &associatedID,
+			CreatedAt:      time.Unix(int64(1710000000+i), 0),
+		}).Error)
+	}
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", fmt.Sprintf("/api/v1/accounts/%d/audit_logs?page=2&per_page=1", s.account.ID), nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(s.T(), http.StatusOK, w.Code)
+	var body map[string]any
+	s.Require().NoError(json.Unmarshal(w.Body.Bytes(), &body))
+	assert.Equal(s.T(), float64(25), body["per_page"])
+	assert.Equal(s.T(), float64(2), body["current_page"])
+	assert.Equal(s.T(), float64(26), body["total_entries"])
+	assert.Len(s.T(), body["audit_logs"].([]any), 1)
+}
+
+func (s *AuditHandlerTestSuite) TestList_UnauthorizedForAgent() {
+	r := gin.New()
+	r.GET("/api/v1/accounts/:account_id/audit_logs", withAuditRole("agent", s.handler.List))
 
 	w := httptest.NewRecorder()
 	req, _ := http.NewRequest("GET", fmt.Sprintf("/api/v1/accounts/%d/audit_logs", s.account.ID), nil)
 	r.ServeHTTP(w, req)
 
-	assert.Equal(s.T(), http.StatusOK, w.Code)
+	assert.Equal(s.T(), http.StatusUnauthorized, w.Code)
 }
 
 func (s *AuditHandlerTestSuite) TestGet_BadRequest_InvalidID() {
 	r := gin.New()
-	r.GET("/api/v1/accounts/:account_id/audit_logs/:id", s.handler.Get)
+	r.GET("/api/v1/accounts/:account_id/audit_logs/:id", withAuditRole("administrator", s.handler.Get))
 
 	w := httptest.NewRecorder()
 	req, _ := http.NewRequest("GET", fmt.Sprintf("/api/v1/accounts/%d/audit_logs/abc", s.account.ID), nil)
 	r.ServeHTTP(w, req)
 
 	assert.Equal(s.T(), http.StatusBadRequest, w.Code)
-}
+}
+
+func withAuditRole(role string, h gin.HandlerFunc) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Set("role", role)
+		h(c)
+	}
+}