feat(gateway): add accountable admin controls

2026-08-06 12:52:40 +00:00
parent 228fa62f67
commit 3be3e3b307
22 changed files with 1617 additions and 20 deletions
@@ -0,0 +1,68 @@
+import { randomUUID } from 'node:crypto';
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { createGatewayPostgresConnector, type GatewayPrismaClient } from '@sammo-ts/infra';
+
+import { createAdminAuditStore } from '../src/adminAudit.js';
+
+const databaseUrl = process.env.GATEWAY_RUNTIME_ACTION_DATABASE_URL;
+const integration = describe.skipIf(!databaseUrl);
+
+const assertDedicatedSchema = (): void => {
+    const expected = process.env.GATEWAY_RUNTIME_INTEGRATION_SCHEMA;
+    const actual = databaseUrl ? new URL(databaseUrl).searchParams.get('schema') : null;
+    if (!expected || !expected.endsWith('_gateway_runtime_integration') || actual !== expected) {
+        throw new Error('Refusing to mutate a Gateway database outside the runner-owned integration schema.');
+    }
+};
+
+integration('administrator audit PostgreSQL store', () => {
+    let db: GatewayPrismaClient;
+    let closeDb: (() => Promise<void>) | undefined;
+
+    beforeAll(async () => {
+        assertDedicatedSchema();
+        const connector = createGatewayPostgresConnector({ url: databaseUrl! });
+        await connector.connect();
+        db = connector.prisma;
+        closeDb = () => connector.disconnect();
+    });
+
+    afterAll(async () => {
+        await closeDb?.();
+    });
+
+    it('appends and filters immutable target history', async () => {
+        const audit = createAdminAuditStore(db);
+        const correlationId = randomUUID();
+        const targetId = randomUUID();
+        await audit.append({
+            correlationId,
+            actorUserId: randomUUID(),
+            actorUsername: 'integration-admin',
+            capability: 'admin.users.manage',
+            action: 'admin.users.updateSanctions',
+            targetType: 'USER',
+            targetId,
+            reason: 'integration verification',
+            outcome: 'SUCCEEDED',
+            summary: { patch: { warningCount: 1 } },
+        });
+
+        await expect(audit.list({ targetType: 'USER', targetId })).resolves.toEqual([
+            expect.objectContaining({
+                correlationId,
+                actorUsername: 'integration-admin',
+                outcome: 'SUCCEEDED',
+                summary: { patch: { warningCount: 1 } },
+            }),
+        ]);
+        await expect(
+            db.adminAuditEvent.update({
+                where: { id: (await audit.list({ targetId }))[0]!.id },
+                data: { action: 'tampered' },
+            })
+        ).rejects.toThrow(/append-only/);
+    });
+});