boc/landvex-admin-backend/tests/test_audit.py

"""
Tester för Audit Log endpoints.
"""
import pytest
from httpx import AsyncClient
from sqlalchemy.ext.asyncio import AsyncSession

from app.models import AuditLog, AuditAction
from app.services.audit_service import AuditService


@pytest.mark.asyncio
async def test_list_audit_logs(client: AsyncClient, auth_headers: dict, db_session: AsyncSession):
    # Skapa några audit-loggar
    audit = AuditService(db_session)
    await audit.log(
        action=AuditAction.CREATE,
        entity_type="tenant",
        entity_id="test-tenant-1",
        actor_id="admin-user",
        new_values={"name": "Test Tenant"},
    )
    await audit.log(
        action=AuditAction.UPDATE,
        entity_type="tenant",
        entity_id="test-tenant-1",
        actor_id="admin-user",
        changed_fields=["name"],
    )
    await db_session.commit()

    response = await client.get("/api/v1/audit-logs", headers=auth_headers)
    assert response.status_code == 200
    data = response.json()
    assert "items" in data
    assert "total" in data
    assert len(data["items"]) >= 2


@pytest.mark.asyncio
async def test_list_audit_logs_filtered_by_entity(
    client: AsyncClient, auth_headers: dict, db_session: AsyncSession
):
    audit = AuditService(db_session)
    await audit.log(
        action=AuditAction.CREATE,
        entity_type="user",
        entity_id="user-123",
        actor_id="admin-user",
    )
    await db_session.commit()

    response = await client.get(
        "/api/v1/audit-logs?entity_type=user&entity_id=user-123",
        headers=auth_headers,
    )
    assert response.status_code == 200
    data = response.json()
    for item in data["items"]:
        assert item["entity_type"] == "user"
        assert item["entity_id"] == "user-123"


@pytest.mark.asyncio
async def test_get_entity_audit_logs(client: AsyncClient, auth_headers: dict, db_session: AsyncSession):
    audit = AuditService(db_session)
    await audit.log(
        action=AuditAction.CREATE,
        entity_type="tenant",
        entity_id="entity-test-1",
        actor_id="admin-user",
        new_values={"name": "Entity Test"},
    )
    await db_session.commit()

    response = await client.get(
        "/api/v1/audit-logs/entity/tenant/entity-test-1",
        headers=auth_headers,
    )
    assert response.status_code == 200
    data = response.json()
    assert len(data["items"]) >= 1
    assert data["items"][0]["entity_type"] == "tenant"


@pytest.mark.asyncio
async def test_get_actor_audit_logs(client: AsyncClient, auth_headers: dict, db_session: AsyncSession):
    audit = AuditService(db_session)
    await audit.log(
        action=AuditAction.LOGIN,
        entity_type="session",
        entity_id="session-1",
        actor_id="test-actor-1",
    )
    await db_session.commit()

    response = await client.get(
        "/api/v1/audit-logs/actor/test-actor-1",
        headers=auth_headers,
    )
    assert response.status_code == 200
    data = response.json()
    for item in data["items"]:
        assert item["actor_id"] == "test-actor-1"


@pytest.mark.asyncio
async def test_audit_log_sanitization(db_session: AsyncSession):
    """Testa att känslig data saniteras i audit-loggar."""
    audit = AuditService(db_session)

    log = await audit.log(
        action=AuditAction.CREATE,
        entity_type="user",
        entity_id="user-1",
        request_body='{"email": "test@test.se", "password": "supersecret123", "api_key": "abc123"}',
    )
    await db_session.commit()

    assert "supersecret123" not in (log.request_body or "")
    assert "***REDACTED***" in (log.request_body or "")
    assert "abc123" not in (log.request_body or "")


@pytest.mark.asyncio
async def test_audit_log_unauthorized(client: AsyncClient):
    response = await client.get("/api/v1/audit-logs")
    assert response.status_code == 403