Refactor database layer and auditing

packages/sshecret-backend/src/sshecret_backend/audit.py

@@ -2,9 +2,10 @@
 
 from collections.abc import Sequence
 from fastapi import Request
-from sqlmodel import Session, select
+from sqlalchemy import select
+from sqlalchemy.orm import Session
 
-from .models import AuditLog, Client, ClientSecret, ClientAccessPolicy
+from .models import AuditLog, Client, ClientSecret, ClientAccessPolicy, Operation, SubSystem
 
 
 def _get_origin(request: Request) -> str | None:
@@ -22,7 +23,7 @@ def _write_audit_log(
     """Write the audit log."""
     origin = _get_origin(request)
     entry.origin = origin
-    entry.subsystem = "backend"
+    entry.subsystem = SubSystem.BACKEND
     session.add(entry)
     if commit:
         session.commit()
@@ -33,7 +34,7 @@ def audit_create_client(
 ) -> None:
     """Log the creation of a client."""
     entry = AuditLog(
-        operation="CREATE",
+        operation=Operation.CREATE,
         client_id=client.id,
         client_name=client.name,
         message="Client Created",
@@ -46,7 +47,7 @@ def audit_delete_client(
 ) -> None:
     """Log the creation of a client."""
     entry = AuditLog(
-        operation="CREATE",
+        operation=Operation.CREATE,
         client_id=client.id,
         client_name=client.name,
         message="Client deleted",
@@ -63,9 +64,9 @@ def audit_create_secret(
 ) -> None:
     """Audit a create secret event."""
     entry = AuditLog(
-        operation="CREATE",
-        object="ClientSecret",
-        object_id=str(secret.id),
+        operation=Operation.CREATE,
+        secret_id=secret.id,
+        secret_name=secret.name,
         client_id=client.id,
         client_name=client.name,
         message="Added secret to client",
@@ -81,13 +82,13 @@ def audit_remove_policy(
     commit: bool = True,
 ) -> None:
     """Audit removal of policy."""
+    data = {"object": "ClientAccessPolicy", "object_id": str(policy.id)}
     entry = AuditLog(
-        operation="DELETE",
-        object="ClientAccessPolicy",
-        object_id=str(policy.id),
+        operation=Operation.DELETE,
         client_id=client.id,
         client_name=client.name,
         message="Deleted client policy",
+        data=data,
     )
     _write_audit_log(session, request, entry, commit)
 
@@ -100,13 +101,13 @@ def audit_update_policy(
     commit: bool = True,
 ) -> None:
     """Audit update of policy."""
+    data: dict[str, str] = {"object": "ClientAccessPolicy", "object_id": str(policy.id)}
     entry = AuditLog(
-        operation="CREATE",
-        object="ClientAccessPolicy",
-        object_id=str(policy.id),
-        client_id=client.id,
+        operation=Operation.CREATE,
         client_name=client.name,
+        client_id=client.id,
         message="Updated client policy",
+        data=data,
     )
     _write_audit_log(session, request, entry, commit)
 
@@ -119,11 +120,10 @@ def audit_update_client(
 ) -> None:
     """Audit an update secret event."""
     entry = AuditLog(
-        operation="UPDATE",
-        object="Client",
+        operation=Operation.UPDATE,
         client_id=client.id,
         client_name=client.name,
-        message="Client updated",
+        message="Client data updated",
     )
     _write_audit_log(session, request, entry, commit)
 
@@ -137,11 +137,11 @@ def audit_update_secret(
 ) -> None:
     """Audit an update secret event."""
     entry = AuditLog(
-        operation="UPDATE",
-        object="ClientSecret",
-        object_id=str(secret.id),
+        operation=Operation.UPDATE,
         client_id=client.id,
         client_name=client.name,
+        secret_name=secret.name,
+        secret_id=secret.id,
         message="Secret value updated",
     )
     _write_audit_log(session, request, entry, commit)
@@ -155,8 +155,7 @@ def audit_invalidate_secrets(
 ) -> None:
     """Audit Invalidate client secrets."""
     entry = AuditLog(
-        operation="INVALIDATE",
-        object="ClientSecret",
+        operation=Operation.UPDATE,
         client_name=client.name,
         client_id=client.id,
         message="Client public-key changed. All secrets invalidated.",
@@ -173,9 +172,9 @@ def audit_delete_secret(
 ) -> None:
     """Audit Delete client secrets."""
     entry = AuditLog(
-        operation="DELETE",
-        object="ClientSecret",
-        object_id=str(secret.id),
+        operation=Operation.DELETE,
+        secret_name=secret.name,
+        secret_id=secret.id,
         client_name=client.name,
         client_id=client.id,
         message="Deleted secret.",
@@ -195,7 +194,7 @@ def audit_access_secrets(
     With no secrets provided, all secrets of the client will be resolved.
     """
     if not secrets:
-        secrets = session.exec(
+        secrets = session.scalars(
             select(ClientSecret).where(ClientSecret.client_id == client.id)
         ).all()
 
@@ -215,37 +214,21 @@ def audit_access_secret(
 ) -> None:
     """Audit that someone accessed one secrets."""
     entry = AuditLog(
-        operation="ACCESS",
+        operation=Operation.READ,
         message="Secret was viewed",
-        object="ClientSecret",
-        object_id=str(secret.id),
+        secret_name=secret.name,
+        secret_id=secret.id,
         client_id=client.id,
         client_name=client.name,
     )
     _write_audit_log(session, request, entry, commit)
 
-
-def audit_access_audit_log(
-    session: Session, request: Request, commit: bool = True
-) -> None:
-    """Audit access to the audit log.
-
-    Because why not...
-    """
-    entry = AuditLog(
-        operation="ACCESS",
-        message="Audit log was viewed",
-        object="AuditLog",
-    )
-    _write_audit_log(session, request, entry, commit)
-
-
 def audit_client_secret_list(
     session: Session, request: Request, commit: bool = True
 ) -> None:
     """Audit a list of all secrets."""
     entry = AuditLog(
-        operation="ACCESS",
+        operation=Operation.READ,
         message="All secret names and their clients was viewed",
     )
     _write_audit_log(session, request, entry, commit)