PUB-2576 - Add functional tests for audit logs

src/functionalTest/java/uk/gov/hmcts/reform/pip/account/management/controllers/AuditCreationTest.java

@@ -0,0 +1,179 @@
+package uk.gov.hmcts.reform.pip.account.management.controllers;
+
+import com.github.dockerjava.zerodep.shaded.org.apache.hc.core5.http.HttpHeaders;
+import io.restassured.response.Response;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.context.junit.jupiter.SpringExtension;
+import uk.gov.hmcts.reform.pip.account.management.model.AuditLog;
+import uk.gov.hmcts.reform.pip.account.management.utils.FunctionalTestBase;
+import uk.gov.hmcts.reform.pip.account.management.utils.OAuthClient;
+
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.ThreadLocalRandom;
+
+import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
+import static org.springframework.http.HttpStatus.NOT_FOUND;
+import static org.springframework.http.HttpStatus.OK;
+
+@ExtendWith(SpringExtension.class)
+@ActiveProfiles(profiles = "functional")
+@SpringBootTest(classes = {OAuthClient.class})
+class AuditCreationTest extends FunctionalTestBase {
+    private static final UUID USER_ID = UUID.randomUUID();
+    private static final String TEST_EMAIL_PREFIX = String.format(
+        "pip-am-test-email-%s", ThreadLocalRandom.current().nextInt(1000, 9999));
+    private static final String TEST_EMAIL = TEST_EMAIL_PREFIX + "@justice.gov.uk";
+    private static final String ROLES = "SYSTEM_ADMIN";
+    private static final String USER_PROVENANCE = "PI_AAD";
+    private static final String ACTION = "PUBLICATION_UPLOAD";
+    private static final String DETAILS = "Publication with artefact id %s successfully uploaded";
+    private static final Integer PAGE_NUMBER = 0;
+    private static final Integer PAGE_SIZE = 2;
+
+    private static final String AUDIT_URL = "/audit";
+    private static final String GET_AUDIT_URL = "/audit/%s";
+    private static final String TESTING_SUPPORT_AUDIT_URL = "/testing-support/audit/";
+    private static final String BEARER = "Bearer ";
+    private static final String CONTENT = "content";
+
+    private Map<String, String> bearer;
+
+    @BeforeAll
+    public void startUp() {
+        bearer = Map.of(HttpHeaders.AUTHORIZATION, BEARER + accessToken);
+    }
+
+    @AfterAll
+    public void teardown() {
+        doDeleteRequest(TESTING_SUPPORT_AUDIT_URL + TEST_EMAIL_PREFIX, bearer);
+    }
+
+    private AuditLog createAuditLog() {
+
+        UUID artefactId = UUID.randomUUID();
+        String responseBody = """
+            {
+                "userId": "%s",
+                "userEmail": "%s",
+                "roles": "%s",
+                "userProvenance": "%s",
+                "action": "%s",
+                "details": "%s"
+            }
+            """.formatted(USER_ID, TEST_EMAIL, ROLES, USER_PROVENANCE, ACTION, String.format(DETAILS, artefactId));
+
+        Response response = doPostRequest(AUDIT_URL, bearer, responseBody);
+
+        assertThat(response.getStatusCode()).isEqualTo(OK.value());
+
+        return response.getBody().as(AuditLog.class);
+    }
+
+    private void deleteAuditLog() {
+        Response response = doDeleteRequest(AUDIT_URL, bearer);
+
+        assertThat(response.getStatusCode()).isEqualTo(OK.value());
+    }
+
+    @Test
+    void shouldBeAbleToCreateAndGetAnAuditRecord() {
+        AuditLog auditLog = createAuditLog();
+
+        Response getResponse = doGetRequest(String.format(GET_AUDIT_URL, auditLog.getId()), bearer);
+        assertThat(getResponse.getStatusCode()).isEqualTo(OK.value());
+
+        AuditLog retrievedAuditLog = getResponse.getBody().as(AuditLog.class);
+        assertThat(retrievedAuditLog.getId()).isEqualTo(auditLog.getId());
+        assertThat(retrievedAuditLog.getUserEmail()).isEqualTo(auditLog.getUserEmail());
+    }
+
+    @Test
+    void shouldBeAbleToGetAllAuditLogsUsingDefaultDisplayParameters() {
+        AuditLog auditLog = createAuditLog();
+
+        Response getResponse = doGetRequestWithQueryParameters(String.format(AUDIT_URL), bearer,
+                                                               "", "", TEST_EMAIL_PREFIX);
+
+        assertThat(getResponse.getStatusCode()).isEqualTo(OK.value());
+        assertThat(getResponse.jsonPath().getInt("pageable.pageNumber")).isEqualTo(0);
+        assertThat(getResponse.jsonPath().getInt("pageable.pageSize")).isEqualTo(25);
+
+        List<AuditLog> retrievedAuditLogs = getResponse.jsonPath().getList(CONTENT, AuditLog.class);
+
+        assertThat(retrievedAuditLogs).isNotNull();
+        assertThat(retrievedAuditLogs.size()).isEqualTo(2);
+        assertThat(retrievedAuditLogs.getFirst().getId()).isEqualTo(auditLog.getId());
+    }
+
+    @Test
+    void shouldBeAbleToGetAllAuditLogsUsingCustomDisplayParameters() {
+        AuditLog auditLog = createAuditLog();
+
+        Response getResponse = doGetRequestWithQueryParameters(String.format(AUDIT_URL), bearer,
+                                                   PAGE_NUMBER.toString(), PAGE_SIZE.toString(), TEST_EMAIL_PREFIX);
+
+        assertThat(getResponse.getStatusCode()).isEqualTo(OK.value());
+        assertThat(getResponse.jsonPath().getInt("pageable.pageNumber")).isEqualTo(0);
+        assertThat(getResponse.jsonPath().getInt("pageable.pageSize")).isEqualTo(2);
+        assertThat(getResponse.jsonPath().getInt("totalPages")).isEqualTo(2);
+        assertThat(getResponse.jsonPath().getInt("totalElements")).isEqualTo(4);
+
+        List<AuditLog> retrievedAuditLogs = getResponse.jsonPath().getList(CONTENT, AuditLog.class);
+
+        assertThat(retrievedAuditLogs).isNotNull();
+        assertThat(retrievedAuditLogs.getFirst().getId()).isEqualTo(auditLog.getId());
+        assertThat(retrievedAuditLogs.size()).isEqualTo(2);
+    }
+
+    @Test
+    void shouldReturnErrorWhenAuditRecordDoesNotExist() {
+        Response getResponse = doGetRequest(String.format(GET_AUDIT_URL, USER_ID), bearer);
+
+        assertThat(getResponse.getStatusCode()).isEqualTo(NOT_FOUND.value());
+    }
+
+    @Test
+    void shouldReturnOkForDeleteAuditLogsIfAllInDate() {
+        AuditLog auditLog = createAuditLog();
+
+        deleteAuditLog();
+
+        Response getResponse = doGetRequestWithQueryParameters(String.format(AUDIT_URL), bearer,
+                                                               "", "", TEST_EMAIL_PREFIX);
+
+        List<AuditLog> retrievedAuditLogs = getResponse.jsonPath().getList(CONTENT, AuditLog.class);
+
+        assertThat(retrievedAuditLogs).isNotNull();
+        assertThat(retrievedAuditLogs.getFirst().getId()).isEqualTo(auditLog.getId());
+        assertThat(retrievedAuditLogs.size()).isEqualTo(3);
+    }
+
+    @Test
+    void shouldBeAbleToDeleteAnOutOfDateAudit() {
+        Response getResponse = doGetRequestWithQueryParameters(String.format(AUDIT_URL), bearer,
+                                                               "", "", TEST_EMAIL_PREFIX);
+        List<AuditLog> retrievedAuditLogs = getResponse.jsonPath().getList(CONTENT, AuditLog.class);
+        assertThat(retrievedAuditLogs.size()).isEqualTo(4);
+
+        AuditLog auditLog = createAuditLog();
+        doPutRequest(TESTING_SUPPORT_AUDIT_URL + auditLog.getId(), bearer);
+
+        getResponse = doGetRequestWithQueryParameters(String.format(AUDIT_URL), bearer, "", "", TEST_EMAIL_PREFIX);
+        retrievedAuditLogs = getResponse.jsonPath().getList(CONTENT, AuditLog.class);
+        assertThat(retrievedAuditLogs.size()).isEqualTo(5);
+
+        deleteAuditLog();
+
+        getResponse = doGetRequestWithQueryParameters(String.format(AUDIT_URL), bearer, "", "", TEST_EMAIL_PREFIX);
+        retrievedAuditLogs = getResponse.jsonPath().getList(CONTENT, AuditLog.class);
+        assertThat(retrievedAuditLogs.size()).isEqualTo(4);
+    }
+
+}

src/functionalTest/java/uk/gov/hmcts/reform/pip/account/management/utils/FunctionalTestBase.java

@@ -51,6 +51,19 @@ protected Response doGetRequest(final String path, final Map<String, String> add
             .thenReturn();
     }
 
+    protected Response doGetRequestWithQueryParameters(final String path, final Map<String, String> additionalHeaders,
+                                                   final String pageNumber, final String pageSize, final String email) {
+        return given()
+            .relaxedHTTPSValidation()
+            .headers(getRequestHeaders(additionalHeaders))
+            .queryParam("pageNumber", pageNumber)
+            .queryParam("pageSize", pageSize)
+            .queryParam("email", email)
+            .when()
+            .get(path)
+            .thenReturn();
+    }
+
     protected Response doGetRequestWithRequestParams(final String path, final Map<String, String> additionalHeaders,
                                                      Map<String, String> params) {
         return given()

src/integrationTest/java/uk/gov/hmcts/reform/pip/account/management/controllers/TestingSupportApiTest.java

@@ -25,6 +25,7 @@
 import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
 import uk.gov.hmcts.reform.pip.account.management.Application;
 import uk.gov.hmcts.reform.pip.account.management.config.ClientConfiguration;
+import uk.gov.hmcts.reform.pip.account.management.model.AuditLog;
 import uk.gov.hmcts.reform.pip.account.management.model.AzureAccount;
 import uk.gov.hmcts.reform.pip.account.management.model.CreationEnum;
 import uk.gov.hmcts.reform.pip.account.management.model.MediaApplication;
@@ -33,8 +34,10 @@
 import uk.gov.hmcts.reform.pip.account.management.utils.IntegrationTestBase;
 import uk.gov.hmcts.reform.pip.model.account.Roles;
 import uk.gov.hmcts.reform.pip.model.account.UserProvenances;
+import uk.gov.hmcts.reform.pip.model.enums.AuditAction;
 
 import java.io.InputStream;
+import java.time.LocalDate;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
@@ -47,21 +50,25 @@
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static uk.gov.hmcts.reform.pip.model.enums.AuditAction.PUBLICATION_UPLOAD;
 
 @SpringBootTest(classes = {Application.class}, webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
 @AutoConfigureMockMvc
 @ActiveProfiles("integration")
 @AutoConfigureEmbeddedDatabase(type = AutoConfigureEmbeddedDatabase.DatabaseType.POSTGRES)
 @WithMockUser(username = "admin", authorities = {"APPROLE_api.request.admin"})
-@SuppressWarnings({"PMD.TooManyMethods", "PMD.ExcessiveImports", "PMD.UnitTestShouldIncludeAssert"})
+@SuppressWarnings({"PMD.TooManyMethods", "PMD.ExcessiveImports", "PMD.UnitTestShouldIncludeAssert",
+    "PMD.CouplingBetweenObjects"})
 class TestingSupportApiTest extends IntegrationTestBase {
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
 
     private static final String TESTING_SUPPORT_BASE_URL = "/testing-support/";
     private static final String TESTING_SUPPORT_ACCOUNT_URL = TESTING_SUPPORT_BASE_URL + "account/";
     private static final String TESTING_SUPPORT_APPLICATION_URL = TESTING_SUPPORT_BASE_URL + "application/";
     private static final String TESTING_SUPPORT_CREATE_ACCOUNT_URL = TESTING_SUPPORT_BASE_URL + "account";
+    private static final String TESTING_SUPPORT_AUDIT_URL = TESTING_SUPPORT_BASE_URL + "audit/";
 
     private static final String ACCOUNT_URL = "/account/";
     private static final String ACCOUNT_ADD_USER_URL = ACCOUNT_URL + "add/pi";
@@ -75,6 +82,7 @@ class TestingSupportApiTest extends IntegrationTestBase {
     private static final String EMAIL = EMAIL_PREFIX + "user123@test.com";
     private static final String PASSWORD = "P@55word11";
     private static final String ID = "1234";
+    private static final UUID USER_ID = UUID.randomUUID();
 
     private static final String PROVENANCE_USER_ID = UUID.randomUUID().toString();
     private static final UserProvenances PROVENANCE = UserProvenances.PI_AAD;
@@ -86,6 +94,10 @@ class TestingSupportApiTest extends IntegrationTestBase {
     private static final String EMPLOYER = "Test employer";
     private static final MediaApplicationStatus PENDING_STATUS = MediaApplicationStatus.PENDING;
 
+    private static final String AUDIT_URL = "/audit";
+    private static final AuditAction ACTION = PUBLICATION_UPLOAD;
+    private static final String DETAILS = "Publication successfully uploaded";
+
     private static final String UNAUTHORIZED_ROLE = "APPROLE_unknown.authorized";
     private static final String UNAUTHORIZED_USERNAME = "unauthorized_isAuthorized";
 
@@ -282,6 +294,42 @@ void testTestingSupportDeleteApplicationsWithEmailPrefix() throws Exception {
             .andExpect(status().isNotFound());
     }
 
+    @Test
+    void testTestingSupportDeleteAuditLogsWithEmailPrefix() throws Exception {
+        AuditLog auditLog = createAuditLog();
+
+        mockMvc.perform(get(AUDIT_URL + "/" + auditLog.getId()))
+            .andExpect(status().isOk());
+
+        MvcResult deleteResponse = mockMvc.perform(delete(TESTING_SUPPORT_AUDIT_URL + EMAIL_PREFIX))
+            .andExpect(status().isOk())
+            .andReturn();
+
+        assertThat(deleteResponse.getResponse().getContentAsString())
+            .as("Audit Log delete response does not match")
+            .isEqualTo("2 audit log(s) deleted with user email starting with " + EMAIL_PREFIX);
+
+        mockMvc.perform(get(AUDIT_URL + "/" + auditLog.getId()))
+            .andExpect(status().isNotFound());
+    }
+
+    @Test
+    void testTestingSupportUpdateAuditLogTimestampWithId() throws Exception {
+        AuditLog auditLog = createAuditLog();
+        LocalDate expiredDate = auditLog.getTimestamp().minusDays(200).toLocalDate();
+
+        mockMvc.perform(get(AUDIT_URL + "/" + auditLog.getId()))
+            .andExpect(status().isOk());
+
+        MvcResult updateAudit = mockMvc.perform(put(TESTING_SUPPORT_AUDIT_URL + auditLog.getId()))
+            .andExpect(status().isOk())
+            .andReturn();
+
+        assertThat(updateAudit.getResponse().getContentAsString())
+            .as("Audit Log update response does not match")
+            .contains("1 audit log(s) updated with timestamp " + expiredDate);
+    }
+
     @Test
     @WithMockUser(username = UNAUTHORIZED_USERNAME, authorities = {UNAUTHORIZED_ROLE})
     void testUnauthorisedTestingSupportDeleteAccounts() throws Exception {
@@ -296,6 +344,13 @@ void testUnauthorisedTestingSupportDeleteApplications() throws Exception {
             .andExpect(status().isForbidden());
     }
 
+    @Test
+    @WithMockUser(username = UNAUTHORIZED_USERNAME, authorities = {UNAUTHORIZED_ROLE})
+    void testUnauthorisedTestingSupportDeleteAudits() throws Exception {
+        mockMvc.perform(delete(TESTING_SUPPORT_AUDIT_URL + EMAIL_PREFIX))
+            .andExpect(status().isForbidden());
+    }
+
     private PiUser createUser() {
         PiUser user = new PiUser();
         user.setEmail(EMAIL);
@@ -318,7 +373,6 @@ private AzureAccount createAccount(String password) {
         return newAccount;
     }
 
-
     @SuppressWarnings("PMD.SignatureDeclareThrowsException")
     private MediaApplication createApplication() throws Exception {
         MediaApplication application = new MediaApplication();
@@ -346,4 +400,29 @@ private MediaApplication createApplication() throws Exception {
             return OBJECT_MAPPER.readValue(mvcResult.getResponse().getContentAsString(), MediaApplication.class);
         }
     }
+
+    @SuppressWarnings("PMD.SignatureDeclareThrowsException")
+    private AuditLog createAuditLog() throws Exception {
+        AuditLog auditLog = new AuditLog();
+        auditLog.setId(USER_ID);
+        auditLog.setUserId(ID);
+        auditLog.setUserEmail(EMAIL);
+        auditLog.setRoles(ROLE);
+        auditLog.setUserProvenance(PROVENANCE);
+        auditLog.setAction(ACTION);
+        auditLog.setDetails(DETAILS);
+
+        MockHttpServletRequestBuilder postRequest = MockMvcRequestBuilders
+            .post(AUDIT_URL)
+            .content(OBJECT_MAPPER.writeValueAsString(auditLog))
+            .header(ISSUER_HEADER, ISSUER_ID)
+            .contentType(MediaType.APPLICATION_JSON);
+
+        MvcResult mvcResult = mockMvc.perform(postRequest)
+            .andExpect(status().isOk())
+            .andReturn();
+
+        return OBJECT_MAPPER.readValue(mvcResult.getResponse().getContentAsString(), AuditLog.class);
+    }
+
 }

src/main/java/uk/gov/hmcts/reform/pip/account/management/controllers/AuditController.java

@@ -5,7 +5,7 @@
 import io.swagger.v3.oas.annotations.security.SecurityRequirement;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.validation.Valid;
-import org.springframework.beans.factory.annotation.Autowired;
+import lombok.AllArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
@@ -34,6 +34,7 @@
 @ApiResponse(responseCode = "401", description = "Invalid access credential")
 @ApiResponse(responseCode = "403", description = "User has not been authorized")
 @IsAdmin
+@AllArgsConstructor
 @SecurityRequirement(name = "bearerAuth")
 public class AuditController {
 
@@ -42,11 +43,6 @@ public class AuditController {
     private static final String OK_ERROR_CODE = "200";
     private static final String NOT_FOUND_ERROR_CODE = "404";
 
-    @Autowired
-    public AuditController(AuditService auditService) {
-        this.auditService = auditService;
-    }
-
     @ApiResponse(responseCode = OK_ERROR_CODE, description = "All audit logs returned as a page with filtering.")
     @Operation(summary = "Get all audit logs returned as a page")
     @GetMapping