ocroguennec/crowdlending-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Améliroation de la piste d'audit

Browse Source
This commit is contained in:
Olivier
2026-07-03 19:49:14 +02:00
parent e11c767c1c
commit 89190c4561
2 changed files with 196 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/auditLogs.js
+76 -19
View File
@@ -13,6 +13,24 @@ function purgeOldLogs() {
db.prepare("DELETE FROM audit_logs WHERE created_at < datetime('now', '-30 days')").run();
}
// ── Classification succès / avertissement / échec par action ──────────────
// IMPORTANT : garder cette liste synchronisée avec ACTION_STATUS dans
// frontend/src/pages/admin/AuditLogsSection.jsx (icônes + libellés).
const STATUS_ACTIONS = {
success: ['login_success', 'login_2fa_success', 'user_registered', 'user_created', 'email_verified_admin', 'invitation_accepted', 'invitation_sent', '2fa_enabled'],
warning: ['role_changed', 'status_changed', '2fa_disabled', 'user_deleted', 'account_self_deleted'],
failure: ['login_failed'],
};
const STATUS_CASE_SQL = `
CASE
WHEN al.action IN (${STATUS_ACTIONS.success.map(() => '?').join(',')}) THEN 'success'
WHEN al.action IN (${STATUS_ACTIONS.warning.map(() => '?').join(',')}) THEN 'warning'
WHEN al.action IN (${STATUS_ACTIONS.failure.map(() => '?').join(',')}) THEN 'failure'
ELSE NULL
END
`;
const STATUS_CASE_PARAMS = [...STATUS_ACTIONS.success, ...STATUS_ACTIONS.warning, ...STATUS_ACTIONS.failure];
// ── GET / — liste paginée avec filtres ────────────────────────────────────
router.get('/', (req, res, next) => {
try {
@@ -22,37 +40,48 @@ router.get('/', (req, res, next) => {
const limit = Math.min(Number(req.query.limit) || 50, 200);
const offset = (page - 1) * limit;
const category = req.query.category || null;
const status = req.query.status || null; // 'success' | 'warning' | 'failure'
const search = req.query.search || null; // filtre sur email acteur ou cible
const dateFrom = req.query.dateFrom || null;
const dateTo = req.query.dateTo || null;
const userId = req.query.userId ? Number(req.query.userId) : null;
const conditions = [];
const params = [];
// Conditions communes (hors statut) — réutilisées pour les compteurs par statut,
// qui doivent rester visibles/à jour même quand un statut est déjà sélectionné.
const baseConditions = [];
const baseParams = [];
if (category) {
conditions.push('al.category = ?');
params.push(category);
baseConditions.push('al.category = ?');
baseParams.push(category);
}
if (userId) {
conditions.push('(al.actor_id = ? OR al.target_user_id = ?)');
params.push(userId, userId);
baseConditions.push('(al.actor_id = ? OR al.target_user_id = ?)');
baseParams.push(userId, userId);
}
if (search) {
conditions.push('(actor.email LIKE ? OR target.email LIKE ? OR actor.display_name LIKE ? OR target.display_name LIKE ?)');
baseConditions.push('(actor.email LIKE ? OR target.email LIKE ? OR actor.display_name LIKE ? OR target.display_name LIKE ?)');
const like = `%${search}%`;
params.push(like, like, like, like);
baseParams.push(like, like, like, like);
}
if (dateFrom) {
conditions.push('al.created_at >= ?');
params.push(dateFrom);
baseConditions.push('al.created_at >= ?');
baseParams.push(dateFrom);
}
if (dateTo) {
conditions.push('al.created_at <= ?');
params.push(dateTo + ' 23:59:59');
baseConditions.push('al.created_at <= ?');
baseParams.push(dateTo + ' 23:59:59');
}
const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
const conditions = [...baseConditions];
const params = [...baseParams];
if (status) {
conditions.push(`(${STATUS_CASE_SQL}) = ?`);
params.push(...STATUS_CASE_PARAMS, status);
}
const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
const baseWhere = baseConditions.length ? `WHERE ${baseConditions.join(' AND ')}` : '';
const rows = db.prepare(`
SELECT
@@ -85,13 +114,41 @@ router.get('/', (req, res, next) => {
${where}
`).get(...params).n;
// Parser les details JSON
const parsed = rows.map(r => ({
...r,
details: r.details ? (() => { try { return JSON.parse(r.details); } catch { return r.details; } })() : null,
}));
// Compteurs par statut, calculés avec les mêmes filtres (catégorie/recherche/dates)
// mais SANS le filtre statut lui-même, pour permettre de basculer entre statuts.
const statusRows = db.prepare(`
SELECT (${STATUS_CASE_SQL}) AS ev_status, COUNT(*) AS n
FROM audit_logs al
LEFT JOIN users actor ON actor.id = al.actor_id
LEFT JOIN users target ON target.id = al.target_user_id
${baseWhere}
GROUP BY ev_status
`).all(...STATUS_CASE_PARAMS, ...baseParams);
res.json({ total, page, limit, rows: parsed });
const statusCounts = { success: 0, warning: 0, failure: 0 };
for (const r of statusRows) {
if (r.ev_status && statusCounts[r.ev_status] !== undefined) statusCounts[r.ev_status] = r.n;
}
// Parser les details JSON
const parsed = rows.map(r => {
const details = r.details ? (() => { try { return JSON.parse(r.details); } catch { return r.details; } })() : null;
// Repli sur les infos figées dans "details" quand l'utilisateur (acteur et/ou cible)
// a depuis été supprimé — son FK passe à NULL (ON DELETE SET NULL) mais l'email/nom
// saisis au moment de l'action restent lisibles pour les admins.
const fallbackName = details && typeof details === 'object' ? (details.display_name || null) : null;
const fallbackEmail = details && typeof details === 'object' ? (details.email || null) : null;
return {
...r,
details,
actor_name: r.actor_name ?? (r.actor_id == null ? fallbackName : null),
actor_email: r.actor_email ?? (r.actor_id == null ? fallbackEmail : null),
target_name: r.target_name ?? (r.target_id == null ? fallbackName : null),
target_email:r.target_email?? (r.target_id == null ? fallbackEmail: null),
};
});
res.json({ total, page, limit, rows: parsed, statusCounts });
} catch (e) { next(e); }
});