Merge pull request #441 from a-malik-gh/feat/423-audit-compliance

feat: audit logging compliance — tamper evidence, JSON export, signed…

Author: DevMuhdishaq

package.json

@@ -141,6 +141,9 @@
       "**/*.(t|j)s"
     ],
     "coverageDirectory": "../coverage",
-    "testEnvironment": "node"
+    "testEnvironment": "node",
+    "moduleNameMapper": {
+      "^src/(.*)$": "<rootDir>/$1"
+    }
   }
 }

src/audit-log/audit-log.controller.spec.ts

@@ -1,20 +1,59 @@
 import { Test, TestingModule } from '@nestjs/testing';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import { AuditLog } from 'src/common/security/audit-log.entity';
 import { AuditLogController } from './audit-log.controller';
 import { AuditLogService } from './audit-log.service';
 
 describe('AuditLogController', () => {
   let controller: AuditLogController;
+  let service: AuditLogService;
 
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       controllers: [AuditLogController],
-      providers: [AuditLogService],
+      providers: [
+        AuditLogService,
+        {
+          provide: getRepositoryToken(AuditLog),
+          useValue: {
+            findOne: jest.fn().mockResolvedValue(null),
+            create: jest.fn((x) => x),
+            save: jest.fn(async (x) => ({ id: 'test-id', ...x })),
+            find: jest.fn().mockResolvedValue([]),
+            findAndCount: jest.fn().mockResolvedValue([[], 0]),
+          },
+        },
+      ],
     }).compile();
 
     controller = module.get<AuditLogController>(AuditLogController);
+    service = module.get<AuditLogService>(AuditLogService);
   });
 
   it('should be defined', () => {
     expect(controller).toBeDefined();
   });
+
+  it('exposes signed export link creation and redemption', async () => {
+    const link = await controller.createSignedExportLink({
+      from: '2024-01-01T00:00:00Z',
+      to: '2024-01-31T23:59:59Z',
+      format: 'json',
+    });
+    expect(link.url).toContain('/admin/audit/export/download?token=');
+
+    const token = new URL(link.url, 'http://x').searchParams.get('token')!;
+    const doc = (await controller.downloadSignedExport(token)) as {
+      filename: string;
+      contentType: string;
+      content: string;
+    } | null;
+    expect(doc).not.toBeNull();
+    expect(doc!.contentType).toContain('application/json');
+  });
+
+  it('returns a rejection payload for tampered tokens', async () => {
+    const res = await controller.downloadSignedExport('abc.def');
+    expect(res).toMatchObject({ statusCode: 403 });
+  });
 });

src/audit-log/audit-log.controller.ts

@@ -73,4 +73,46 @@ export class AuditLogController {
   exportAuditLog(@Body() dateRange: { from: Date; to: Date }) {
     return this.auditLogService.exportAuditLog(dateRange);
   }
+
+  @Post('export/json')
+  @ApiResponse({
+    status: 200,
+    description: 'JSON export with checksum validation',
+  })
+  exportAuditLogJson(@Body() dateRange: { from: Date; to: Date }) {
+    return this.auditLogService.exportAuditLogJson(dateRange);
+  }
+
+  @Post('export/link')
+  @ApiResponse({
+    status: 200,
+    description: 'Time-limited signed download link for a CSV/JSON export',
+  })
+  async createSignedExportLink(
+    @Body()
+    body: {
+      from: string | Date;
+      to: string | Date;
+      format?: 'csv' | 'json';
+      ttlSeconds?: number;
+    },
+  ) {
+    const range = { from: new Date(body.from), to: new Date(body.to) };
+    return this.auditLogService.createSignedExportLink(
+      range,
+      body.format ?? 'csv',
+      body.ttlSeconds ?? 300,
+    );
+  }
+
+  @Get('export/download')
+  @ApiResponse({ status: 200, description: 'Redeems a signed export token' })
+  @ApiQuery({ name: 'token', required: true })
+  async downloadSignedExport(@Query('token') token: string) {
+    const doc = await this.auditLogService.downloadSignedExport(token);
+    if (!doc) {
+      return { statusCode: 403, message: 'Invalid or expired export link' };
+    }
+    return doc;
+  }
 }

src/audit-log/audit-log.module.ts

@@ -1,12 +1,19 @@
 import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
-import { AuditLogService } from './audit-log.service';
+import { AuditLogService, AUDIT_WORM_SINK } from './audit-log.service';
 import { AuditLogController } from './audit-log.controller';
+import { FileWormSink } from './file-worm-sink';
 import { AuditLog } from 'src/common/security/audit-log.entity';
 
 @Module({
   imports: [TypeOrmModule.forFeature([AuditLog])],
-  providers: [AuditLogService],
+  providers: [
+    AuditLogService,
+    {
+      provide: AUDIT_WORM_SINK,
+      useFactory: () => new FileWormSink(),
+    },
+  ],
   controllers: [AuditLogController],
   exports: [AuditLogService],
 })