Merge pull request #177 from Nanfe01/confiq

feat: add on-chain config registry (Solidity+Soroban) + integration and tests

Author: mijinummi

apps/api-service/src/audit/entities/audit-log.entity.ts

@@ -7,6 +7,11 @@ export enum EventType {
   API_KEY_REVOKED = 'KeyRevoked',
   GAS_TRANSACTION = 'GasTransaction',
   GAS_SUBMISSION = 'GasSubmission',
+  // Admin action events
+  CONFIG_UPDATE = 'ConfigUpdate',
+  ROLE_CHANGE = 'RoleChange',
+  TREASURY_OPERATION = 'TreasuryOperation',
+  SYSTEM_ADMIN = 'SystemAdmin',
 }
 
 export enum OutcomeStatus {

apps/api-service/src/audit/services/audit-event-emitter.ts

@@ -91,4 +91,94 @@ export class AuditEventEmitter {
       details: {},
     });
   }
+
+  /**
+   * Emit configuration update event
+   */
+  emitConfigUpdateEvent(
+    adminUser: string,
+    configType: string,
+    changes: Record<string, any>,
+    target?: string, // e.g., chain ID, global, etc.
+  ): void {
+    this.emitAuditEvent({
+      eventType: EventType.CONFIG_UPDATE,
+      user: adminUser,
+      details: {
+        configType,
+        changes,
+        target,
+      },
+      outcome: OutcomeStatus.SUCCESS,
+    });
+  }
+
+  /**
+   * Emit role change event
+   */
+  emitRoleChangeEvent(
+    adminUser: string,
+    targetUser: string,
+    action: 'grant' | 'revoke' | 'update',
+    role: string,
+    previousRole?: string,
+  ): void {
+    this.emitAuditEvent({
+      eventType: EventType.ROLE_CHANGE,
+      user: adminUser,
+      details: {
+        targetUser,
+        action,
+        role,
+        previousRole,
+      },
+      outcome: OutcomeStatus.SUCCESS,
+    });
+  }
+
+  /**
+   * Emit treasury operation event
+   */
+  emitTreasuryOperationEvent(
+    adminUser: string,
+    operation: string,
+    amount?: string,
+    asset?: string,
+    recipient?: string,
+    details?: Record<string, any>,
+  ): void {
+    this.emitAuditEvent({
+      eventType: EventType.TREASURY_OPERATION,
+      user: adminUser,
+      details: {
+        operation,
+        amount,
+        asset,
+        recipient,
+        ...details,
+      },
+      outcome: OutcomeStatus.SUCCESS,
+    });
+  }
+
+  /**
+   * Emit system administration event
+   */
+  emitSystemAdminEvent(
+    adminUser: string,
+    action: string,
+    target: string,
+    details?: Record<string, any>,
+  ): void {
+    this.emitAuditEvent({
+      eventType: EventType.SYSTEM_ADMIN,
+      user: adminUser,
+      details: {
+        action,
+        target,
+        ...details,
+      },
+      outcome: OutcomeStatus.SUCCESS,
+    });
+  }
 }

apps/api-service/src/audit/services/audit-log.service.ts

@@ -196,4 +196,62 @@ export class AuditLogService {
       details,
     );
   }
+
+  /**
+   * Emit configuration update event
+   */
+  emitConfigUpdate(
+    adminUser: string,
+    configType: string,
+    changes: Record<string, any>,
+    target?: string,
+  ): void {
+    this.auditEventEmitter.emitConfigUpdateEvent(adminUser, configType, changes, target);
+  }
+
+  /**
+   * Emit role change event
+   */
+  emitRoleChange(
+    adminUser: string,
+    targetUser: string,
+    action: 'grant' | 'revoke' | 'update',
+    role: string,
+    previousRole?: string,
+  ): void {
+    this.auditEventEmitter.emitRoleChangeEvent(adminUser, targetUser, action, role, previousRole);
+  }
+
+  /**
+   * Emit treasury operation event
+   */
+  emitTreasuryOperation(
+    adminUser: string,
+    operation: string,
+    amount?: string,
+    asset?: string,
+    recipient?: string,
+    details?: Record<string, any>,
+  ): void {
+    this.auditEventEmitter.emitTreasuryOperationEvent(
+      adminUser,
+      operation,
+      amount,
+      asset,
+      recipient,
+      details,
+    );
+  }
+
+  /**
+   * Emit system administration event
+   */
+  emitSystemAdmin(
+    adminUser: string,
+    action: string,
+    target: string,
+    details?: Record<string, any>,
+  ): void {
+    this.auditEventEmitter.emitSystemAdminEvent(adminUser, action, target, details);
+  }
 }

docs/AUDIT_LOGGING_SYSTEM.md

@@ -153,6 +153,106 @@ Logged when gas is submitted for processing (e.g., via subsidy program).
 - `subsidyProgram`: Which subsidy program (if applicable)
 - `status`: Submission status
 
+### 7. Configuration Update (`ConfigUpdate`)
+Logged when system configuration is updated by an administrator.
+
+**Fields in details:**
+- `configType`: Type of configuration being updated (e.g., "rate-limits", "alert-thresholds", "rpc-providers")
+- `changes`: Object containing the configuration changes made
+- `target`: Target of the configuration change (e.g., chain ID, "global", specific component)
+
+**Example:**
+```json
+{
+  "eventType": "ConfigUpdate",
+  "timestamp": "2024-02-23T14:30:00Z",
+  "user": "admin_user_123",
+  "outcome": "success",
+  "details": {
+    "configType": "alert-thresholds",
+    "changes": {
+      "gasSpikeThreshold": 150,
+      "volatilityThreshold": 25
+    },
+    "target": "chain-1"
+  }
+}
+```
+
+### 8. Role Change (`RoleChange`)
+Logged when user roles are modified by an administrator.
+
+**Fields in details:**
+- `targetUser`: User whose role is being changed
+- `action`: Type of role change ("grant", "revoke", "update")
+- `role`: The role being granted/revoked/updated
+- `previousRole`: Previous role (for updates)
+
+**Example:**
+```json
+{
+  "eventType": "RoleChange",
+  "timestamp": "2024-02-23T15:45:00Z",
+  "user": "admin_user_123",
+  "outcome": "success",
+  "details": {
+    "targetUser": "user_456",
+    "action": "grant",
+    "role": "admin",
+    "previousRole": "operator"
+  }
+}
+```
+
+### 9. Treasury Operation (`TreasuryOperation`)
+Logged for treasury-related operations performed by administrators.
+
+**Fields in details:**
+- `operation`: Type of treasury operation (e.g., "withdraw", "deposit", "transfer")
+- `amount`: Amount involved in the operation
+- `asset`: Asset type (e.g., "ETH", "USDC", "gas-tokens")
+- `recipient`: Recipient address or identifier
+- Additional operation-specific details
+
+**Example:**
+```json
+{
+  "eventType": "TreasuryOperation",
+  "timestamp": "2024-02-23T16:20:00Z",
+  "user": "admin_user_123",
+  "outcome": "success",
+  "details": {
+    "operation": "withdraw",
+    "amount": "1000",
+    "asset": "ETH",
+    "recipient": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e"
+  }
+}
+```
+
+### 10. System Administration (`SystemAdmin`)
+Logged for general system administration actions.
+
+**Fields in details:**
+- `action`: Administrative action performed (e.g., "force-refresh", "system-restart", "maintenance-mode")
+- `target`: Target of the administrative action
+- Additional action-specific details
+
+**Example:**
+```json
+{
+  "eventType": "SystemAdmin",
+  "timestamp": "2024-02-23T17:00:00Z",
+  "user": "admin_user_123",
+  "outcome": "success",
+  "details": {
+    "action": "force-refresh",
+    "target": "gas-price-data",
+    "reason": "Manual data refresh requested"
+  }
+}
+```
+
 ## Database Schema
 
 ### audit_logs Table
@@ -201,7 +301,7 @@ Logged when gas is submitted for processing (e.g., via subsidy program).
 Retrieve audit logs with filtering and pagination.
 
 **Query Parameters:**
-- `eventType` (string): Filter by event type (APIRequest, KeyCreated, KeyRotated, KeyRevoked, GasTransaction, GasSubmission)
+- `eventType` (string): Filter by event type (APIRequest, KeyCreated, KeyRotated, KeyRevoked, GasTransaction, GasSubmission, ConfigUpdate, RoleChange, TreasuryOperation, SystemAdmin)
 - `user` (string): Filter by user/merchant ID
 - `apiKey` (string): Filter by API key
 - `chainId` (integer): Filter by blockchain chain ID
@@ -339,7 +439,11 @@ Retrieve high-level audit statistics.
     "GasTransaction": 3000,
     "KeyRotated": 200,
     "KeyRevoked": 50,
-    "GasSubmission": 32
+    "GasSubmission": 32,
+    "ConfigUpdate": 45,
+    "RoleChange": 12,
+    "TreasuryOperation": 8,
+    "SystemAdmin": 23
   }
 }
 ```