feat: Audit and settings

server/internal/api/handlers.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"strconv"
 
 	"github.com/gin-gonic/gin"
 	"github.com/mrhid6/vantage/server/internal/auth"
@@ -11,6 +12,13 @@ import (
 	"github.com/mrhid6/vantage/server/internal/services"
 )
 
+func actorFromCtx(c *gin.Context) string {
+	if sess := auth.GetSessionFromContext(c); sess != nil && sess.Email != "" {
+		return sess.Email
+	}
+	return "admin"
+}
+
 func RegisterRoutes(r *gin.Engine) {
 	r.GET("/install", handleInstallScript)
 	r.GET("/update", handleUpdateScript)
@@ -37,6 +45,11 @@ func RegisterRoutes(r *gin.Engine) {
 
 		apiGroup.GET("/agent/latest-version", getLatestAgentVersion)
 
+		apiGroup.GET("/audit", listAuditEvents)
+
+		apiGroup.GET("/settings", getSettings)
+		apiGroup.PUT("/settings", saveSettings)
+
 		apiGroup.GET("/keys", listKeys)
 		apiGroup.POST("/keys", createKey)
 		apiGroup.GET("/keys/:id", getKey)
@@ -75,6 +88,7 @@ func newServer(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("server.created", actorFromCtx(c), s.ServerID, "", "pre-registration token issued")
 
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {
@@ -120,10 +134,16 @@ func getServer(c *gin.Context) {
 
 func deleteServer(c *gin.Context) {
 	id := c.Param("id")
+	s, _ := services.GetServer(id)
 	if err := services.DeleteServer(id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	hostname := id
+	if s != nil {
+		hostname = s.Hostname
+	}
+	services.LogEvent("server.deleted", actorFromCtx(c), id, "", fmt.Sprintf("server %s deleted", hostname))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
@@ -160,6 +180,7 @@ func generateKey(c *gin.Context) {
 		return
 	}
 
+	services.LogEvent("key.generation_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("key generation dispatched (label=%s type=%s)", body.Label, body.KeyType))
 	c.JSON(http.StatusAccepted, gin.H{
 		"message":    "key generation command sent to agent",
 		"command_id": cmdID,
@@ -192,6 +213,7 @@ func createKey(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("key.uploaded", actorFromCtx(c), "", key.KeyID, fmt.Sprintf("key '%s' uploaded", key.Label))
 	c.JSON(http.StatusCreated, key)
 }
 
@@ -227,10 +249,16 @@ func getKey(c *gin.Context) {
 
 func deleteKey(c *gin.Context) {
 	id := c.Param("id")
+	k, _ := services.GetKey(id)
 	if err := services.DeleteKey(id); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	label := id
+	if k != nil {
+		label = k.Label
+	}
+	services.LogEvent("key.deleted", actorFromCtx(c), "", id, fmt.Sprintf("key '%s' deleted", label))
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
@@ -249,6 +277,7 @@ func assignKey(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("key.assigned", actorFromCtx(c), body.ServerID, keyID, fmt.Sprintf("key %s assigned to server %s", keyID, body.ServerID))
 	c.JSON(http.StatusCreated, a)
 }
 
@@ -260,6 +289,7 @@ func revokeAssignment(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("key.revoked", actorFromCtx(c), serverID, keyID, fmt.Sprintf("key %s revoked from server %s", keyID, serverID))
 	c.JSON(http.StatusOK, gin.H{"revoked": true})
 }
 
@@ -285,6 +315,7 @@ func updateAgent(c *gin.Context) {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("agent.update_dispatched", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("agent update dispatched to %s (version %s)", s.Hostname, version))
 	c.JSON(http.StatusAccepted, gin.H{
 		"message": "update command sent to agent",
 		"version": version,
@@ -303,6 +334,7 @@ func applyUpdates(c *gin.Context) {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
 		return
 	}
+	services.LogEvent("updates.applied", actorFromCtx(c), s.ServerID, "", fmt.Sprintf("package update command dispatched to %s", s.Hostname))
 	c.JSON(http.StatusAccepted, gin.H{"message": "apply updates command sent to agent"})
 }
 
@@ -362,6 +394,47 @@ echo "vantage-agent updated to ${VERSION} and restarted."
 	c.String(http.StatusOK, script)
 }
 
+func listAuditEvents(c *gin.Context) {
+	limit := int64(100)
+	if l := c.Query("limit"); l != "" {
+		if n, err := strconv.ParseInt(l, 10, 64); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	events, err := services.ListAuditEvents(limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, events)
+}
+
+func getSettings(c *gin.Context) {
+	s, err := services.GetSettings()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, s)
+}
+
+func saveSettings(c *gin.Context) {
+	var body struct {
+		Alerts models.AlertSettings `json:"alerts"`
+		Email  models.EmailSettings `json:"email"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := services.SaveSettings(body.Alerts, body.Email); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("settings.updated", actorFromCtx(c), "", "", "alert settings updated")
+	c.JSON(http.StatusOK, gin.H{"saved": true})
+}
+
 func handleInstallScript(c *gin.Context) {
 	serverID := c.Query("server_id")
 	token := c.Query("token")