enclava/backend/app/models/audit_log.py

"""
Audit log model for tracking system events and user actions
"""
from datetime import datetime
from typing import Optional, Dict, Any
from sqlalchemy import (
    Column,
    Integer,
    String,
    DateTime,
    JSON,
    ForeignKey,
    Text,
    Boolean,
)
from sqlalchemy.orm import relationship
from app.db.database import Base
from enum import Enum


class AuditAction(str, Enum):
    """Audit action types"""

    CREATE = "create"
    READ = "read"
    UPDATE = "update"
    DELETE = "delete"
    LOGIN = "login"
    LOGOUT = "logout"
    API_KEY_CREATE = "api_key_create"
    API_KEY_DELETE = "api_key_delete"
    BUDGET_CREATE = "budget_create"
    BUDGET_UPDATE = "budget_update"
    BUDGET_EXCEED = "budget_exceed"
    MODULE_ENABLE = "module_enable"
    MODULE_DISABLE = "module_disable"
    PERMISSION_GRANT = "permission_grant"
    PERMISSION_REVOKE = "permission_revoke"
    SYSTEM_CONFIG = "system_config"
    SECURITY_EVENT = "security_event"


class AuditSeverity(str, Enum):
    """Audit severity levels"""

    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"


class AuditLog(Base):
    """Audit log model for tracking system events and user actions"""

    __tablename__ = "audit_logs"

    id = Column(Integer, primary_key=True, index=True)

    # User relationship (nullable for system events)
    user_id = Column(Integer, ForeignKey("users.id"), nullable=True)
    user = relationship("User", back_populates="audit_logs")

    # Event details
    action = Column(String, nullable=False)
    resource_type = Column(
        String, nullable=False
    )  # user, api_key, budget, module, etc.
    resource_id = Column(String, nullable=True)  # ID of the affected resource

    # Event description and details
    description = Column(Text, nullable=False)
    details = Column(JSON, default=dict)  # Additional event details

    # Request context
    ip_address = Column(String, nullable=True)
    user_agent = Column(String, nullable=True)
    session_id = Column(String, nullable=True)
    request_id = Column(String, nullable=True)

    # Event classification
    severity = Column(String, default=AuditSeverity.LOW)
    category = Column(String, nullable=True)  # security, access, data, system

    # Success/failure tracking
    success = Column(Boolean, default=True)
    error_message = Column(Text, nullable=True)

    # Additional metadata
    tags = Column(JSON, default=list)
    audit_metadata = Column(
        "metadata", JSON, default=dict
    )  # Map to 'metadata' column in DB

    # Before/after values for data changes
    old_values = Column(JSON, nullable=True)
    new_values = Column(JSON, nullable=True)

    # Timestamp
    created_at = Column(DateTime, default=datetime.utcnow, index=True)

    def __repr__(self):
        return (
            f"<AuditLog(id={self.id}, action='{self.action}', user_id={self.user_id})>"
        )

    def to_dict(self):
        """Convert audit log to dictionary for API responses"""
        return {
            "id": self.id,
            "user_id": self.user_id,
            "action": self.action,
            "resource_type": self.resource_type,
            "resource_id": self.resource_id,
            "description": self.description,
            "details": self.details,
            "ip_address": self.ip_address,
            "user_agent": self.user_agent,
            "session_id": self.session_id,
            "request_id": self.request_id,
            "severity": self.severity,
            "category": self.category,
            "success": self.success,
            "error_message": self.error_message,
            "tags": self.tags,
            "metadata": self.audit_metadata,
            "old_values": self.old_values,
            "new_values": self.new_values,
            "created_at": self.created_at.isoformat() if self.created_at else None,
        }

    def is_security_event(self) -> bool:
        """Check if this is a security-related event"""
        security_actions = [
            AuditAction.LOGIN,
            AuditAction.LOGOUT,
            AuditAction.API_KEY_CREATE,
            AuditAction.API_KEY_DELETE,
            AuditAction.PERMISSION_GRANT,
            AuditAction.PERMISSION_REVOKE,
            AuditAction.SECURITY_EVENT,
        ]
        return self.action in security_actions or self.category == "security"

    def is_high_severity(self) -> bool:
        """Check if this is a high severity event"""
        return self.severity in [AuditSeverity.HIGH, AuditSeverity.CRITICAL]

    def add_tag(self, tag: str):
        """Add a tag to the audit log"""
        if tag not in self.tags:
            self.tags.append(tag)

    def remove_tag(self, tag: str):
        """Remove a tag from the audit log"""
        if tag in self.tags:
            self.tags.remove(tag)

    def update_metadata(self, key: str, value: Any):
        """Update metadata"""
        if self.audit_metadata is None:
            self.audit_metadata = {}
        self.audit_metadata[key] = value

    def set_before_after(self, old_values: Dict[str, Any], new_values: Dict[str, Any]):
        """Set before and after values for data changes"""
        self.old_values = old_values
        self.new_values = new_values

    @classmethod
    def create_login_event(
        cls,
        user_id: int,
        success: bool = True,
        ip_address: str = None,
        user_agent: str = None,
        session_id: str = None,
        error_message: str = None,
    ) -> "AuditLog":
        """Create a login audit event"""
        return cls(
            user_id=user_id,
            action=AuditAction.LOGIN,
            resource_type="user",
            resource_id=str(user_id),
            description=f"User login {'successful' if success else 'failed'}",
            details={"login_method": "password", "success": success},
            ip_address=ip_address,
            user_agent=user_agent,
            session_id=session_id,
            severity=AuditSeverity.LOW if success else AuditSeverity.MEDIUM,
            category="security",
            success=success,
            error_message=error_message,
            tags=["authentication", "login"],
        )

    @classmethod
    def create_logout_event(cls, user_id: int, session_id: str = None) -> "AuditLog":
        """Create a logout audit event"""
        return cls(
            user_id=user_id,
            action=AuditAction.LOGOUT,
            resource_type="user",
            resource_id=str(user_id),
            description="User logout",
            details={"logout_method": "manual"},
            session_id=session_id,
            severity=AuditSeverity.LOW,
            category="security",
            success=True,
            tags=["authentication", "logout"],
        )

    @classmethod
    def create_api_key_event(
        cls,
        user_id: int,
        action: str,
        api_key_id: int,
        api_key_name: str,
        success: bool = True,
        error_message: str = None,
    ) -> "AuditLog":
        """Create an API key audit event"""
        return cls(
            user_id=user_id,
            action=action,
            resource_type="api_key",
            resource_id=str(api_key_id),
            description=f"API key {action}: {api_key_name}",
            details={"api_key_name": api_key_name, "action": action},
            severity=AuditSeverity.MEDIUM,
            category="security",
            success=success,
            error_message=error_message,
            tags=["api_key", action],
        )

    @classmethod
    def create_budget_event(
        cls,
        user_id: int,
        action: str,
        budget_id: int,
        budget_name: str,
        details: Dict[str, Any] = None,
        success: bool = True,
    ) -> "AuditLog":
        """Create a budget audit event"""
        return cls(
            user_id=user_id,
            action=action,
            resource_type="budget",
            resource_id=str(budget_id),
            description=f"Budget {action}: {budget_name}",
            details=details or {},
            severity=AuditSeverity.MEDIUM
            if action == AuditAction.BUDGET_EXCEED
            else AuditSeverity.LOW,
            category="financial",
            success=success,
            tags=["budget", action],
        )

    @classmethod
    def create_module_event(
        cls,
        user_id: int,
        action: str,
        module_name: str,
        success: bool = True,
        error_message: str = None,
        details: Dict[str, Any] = None,
    ) -> "AuditLog":
        """Create a module audit event"""
        return cls(
            user_id=user_id,
            action=action,
            resource_type="module",
            resource_id=module_name,
            description=f"Module {action}: {module_name}",
            details=details or {},
            severity=AuditSeverity.MEDIUM,
            category="system",
            success=success,
            error_message=error_message,
            tags=["module", action],
        )

    @classmethod
    def create_permission_event(
        cls,
        user_id: int,
        action: str,
        target_user_id: int,
        permission: str,
        success: bool = True,
    ) -> "AuditLog":
        """Create a permission audit event"""
        return cls(
            user_id=user_id,
            action=action,
            resource_type="permission",
            resource_id=str(target_user_id),
            description=f"Permission {action}: {permission} for user {target_user_id}",
            details={"permission": permission, "target_user_id": target_user_id},
            severity=AuditSeverity.HIGH,
            category="security",
            success=success,
            tags=["permission", action],
        )

    @classmethod
    def create_security_event(
        cls,
        user_id: int,
        event_type: str,
        description: str,
        severity: str = AuditSeverity.HIGH,
        details: Dict[str, Any] = None,
        ip_address: str = None,
    ) -> "AuditLog":
        """Create a security audit event"""
        return cls(
            user_id=user_id,
            action=AuditAction.SECURITY_EVENT,
            resource_type="security",
            resource_id=event_type,
            description=description,
            details=details or {},
            ip_address=ip_address,
            severity=severity,
            category="security",
            success=False,  # Security events are typically failures
            tags=["security", event_type],
        )

    @classmethod
    def create_system_event(
        cls,
        action: str,
        description: str,
        resource_type: str = "system",
        resource_id: str = None,
        severity: str = AuditSeverity.LOW,
        details: Dict[str, Any] = None,
    ) -> "AuditLog":
        """Create a system audit event"""
        return cls(
            user_id=None,  # System events don't have a user
            action=action,
            resource_type=resource_type,
            resource_id=resource_id,
            description=description,
            details=details or {},
            severity=severity,
            category="system",
            success=True,
            tags=["system", action],
        )

    @classmethod
    def create_data_change_event(
        cls,
        user_id: int,
        action: str,
        resource_type: str,
        resource_id: str,
        description: str,
        old_values: Dict[str, Any],
        new_values: Dict[str, Any],
    ) -> "AuditLog":
        """Create a data change audit event"""
        return cls(
            user_id=user_id,
            action=action,
            resource_type=resource_type,
            resource_id=resource_id,
            description=description,
            old_values=old_values,
            new_values=new_values,
            severity=AuditSeverity.LOW,
            category="data",
            success=True,
            tags=["data_change", action],
        )

    def get_summary(self) -> Dict[str, Any]:
        """Get a summary of the audit log"""
        return {
            "id": self.id,
            "action": self.action,
            "resource_type": self.resource_type,
            "description": self.description,
            "severity": self.severity,
            "success": self.success,
            "created_at": self.created_at.isoformat() if self.created_at else None,
            "user_id": self.user_id,
        }