Audit Service (recerdo-audit)¶

// Go-style pseudocode

type AuditEntry struct {
    EntryID    string                 `json:"entry_id"`    // UUID
    ActorID    string                 `json:"actor_id"`    // 必須。ユーザーID / サービス名
    ActorType  ActorType              `json:"actor_type"`  // USER / SERVICE / SYSTEM
    Action     AuditAction            `json:"action"`      // READ / WRITE / DELETE / ...
    ResourceType ResourceType         `json:"resource_type"` // USER / ORG / MEDIA / ...
    ResourceID string                 `json:"resource_id"`   // 操作対象リソースのID
    Timestamp  time.Time              `json:"timestamp"`     // 操作の発生時刻
    Result     AuditResult            `json:"result"`        // SUCCESS / FAILURE
    Reason     *string                `json:"reason,omitempty"` // 失敗時の理由
    IPAddress  string                 `json:"ip_address"`    // クライアントIP
    UserAgent  string                 `json:"user_agent"`    // HTTP User-Agent
    Metadata   map[string]interface{} `json:"metadata"`      // 追加情報（JSON）
    CreatedAt  time.Time              `json:"created_at"`    // 記録作成時刻（不変）
    ArchivedAt *time.Time             `json:"archived_at,omitempty"` // S3移行済み時刻
}

func (a *AuditEntry) Validate() error {
    if a.EntryID == "" { return ErrMissingEntryID }
    if a.ActorID == "" { return ErrMissingActorID }
    if err := a.Action.Validate(); err != nil { return err }
    if err := a.ResourceType.Validate(); err != nil { return err }
    if err := a.ActorType.Validate(); err != nil { return err }
    if a.CreatedAt.IsZero() { return ErrMissingCreatedAt }
    return nil
}

func (a *AuditEntry) CanBeArchived(now time.Time, retentionDays int) bool {
    cutoffTime := a.CreatedAt.AddDate(0, 0, retentionDays)
    return now.After(cutoffTime) && a.ArchivedAt == nil
}

type RetentionPolicy struct {
    PolicyID      string    `json:"policy_id"`      // UUID
    ResourceType  string    `json:"resource_type"`  // null = 全リソースタイプ
    Action        string    `json:"action"`         // null = 全操作
    RetentionDays int       `json:"retention_days"` // 保管期間（日数）
    ArchiveAfterDays int    `json:"archive_after_days"` // アーカイブ移行日数
    IsGDPRSensitive bool    `json:"is_gdpr_sensitive"` // GDPR削除対象か
    CreatedAt     time.Time `json:"created_at"`
    UpdatedAt     time.Time `json:"updated_at"`
}

func (r *RetentionPolicy) Validate() error {
    if r.RetentionDays <= 0 { return ErrInvalidRetentionDays }
    if r.ArchiveAfterDays > r.RetentionDays {
        return ErrArchiveDaysExceedsRetention
    }
    return nil
}

type GDPRAnonymization struct {
    AnonymizationID string     `json:"anonymization_id"` // UUID
    UserID          string     `json:"user_id"`
    ResourceIDs     []string   `json:"resource_ids"`     // 関連リソースID
    AnonymizedAt    *time.Time `json:"anonymized_at"`
    Reason          string     `json:"reason"`           // FORGETTING_RIGHT / DATA_LOSS
    OperatorID      string     `json:"operator_id"`      // 実行者（管理者）
    Status          string     `json:"status"`           // QUEUED / PROCESSING / COMPLETED / FAILED
    CreatedAt       time.Time  `json:"created_at"`
    UpdatedAt       time.Time  `json:"updated_at"`
}

func (g *GDPRAnonymization) IsCompleted() bool {
    return g.Status == "COMPLETED"
}

type ArchivalJob struct {
    JobID         string     `json:"job_id"`         // UUID
    ScheduledAt   time.Time  `json:"scheduled_at"`
    StartedAt     *time.Time `json:"started_at"`
    CompletedAt   *time.Time `json:"completed_at"`
    Status        string     `json:"status"`         // PENDING / RUNNING / COMPLETED / FAILED
    RecordCount   int        `json:"record_count"`   // アーカイブされたレコード数
    ArchiveLocation *string  `json:"archive_location"` // object-storage://bucket/prefix/... (Beta: Garage / 本番: OCI Object Storage)
    ErrorMessage  *string    `json:"error_message"`
    CreatedAt     time.Time  `json:"created_at"`
    UpdatedAt     time.Time  `json:"updated_at"`
}

func (a *ArchivalJob) CanStart() bool {
    return a.Status == "PENDING" && time.Now().After(a.ScheduledAt)
}

func (a *ArchivalJob) MarkAsRunning(now time.Time) error {
    if a.Status != "PENDING" { return ErrJobNotPending }
    a.Status = "RUNNING"
    a.StartedAt = &now
    return nil
}

func (a *ArchivalJob) MarkAsCompleted(now time.Time, count int, s3Loc string) error {
    if a.Status != "RUNNING" { return ErrJobNotRunning }
    a.Status = "COMPLETED"
    a.CompletedAt = &now
    a.RecordCount = count
    a.S3Location = &s3Loc
    return nil
}

// Repository Ports
type AuditEntryRepository interface {
    Save(ctx context.Context, entry *AuditEntry) error
    FindByID(ctx context.Context, entryID string) (*AuditEntry, error)
    FindByQuery(ctx context.Context, filter *QueryFilter, limit int, offset int) ([]*AuditEntry, int, error)
    // FindByQuery は total_count を3番目の戻り値で返す（ページネーション用）
    FindOldestUnarchived(ctx context.Context, olderThanDays int, limit int) ([]*AuditEntry, error)
    ArchiveToS3(ctx context.Context, entries []*AuditEntry, s3Location string) error
    AnonymizeByUserID(ctx context.Context, userID string, piiHash map[string]string) error
    // AnonymizeByUserID は user_name/email/phone を piiHash の値で置き換える（不可逆的に）
}

type RetentionPolicyRepository interface {
    FindAll(ctx context.Context) ([]*RetentionPolicy, error)
    FindByResourceType(ctx context.Context, resourceType string) (*RetentionPolicy, error)
    Save(ctx context.Context, policy *RetentionPolicy) error
    Update(ctx context.Context, policy *RetentionPolicy) error
}

type GDPRAnonymizationRepository interface {
    Save(ctx context.Context, anon *GDPRAnonymization) error
    FindByID(ctx context.Context, anonymizationID string) (*GDPRAnonymization, error)
    FindPending(ctx context.Context) ([]*GDPRAnonymization, error)
    Update(ctx context.Context, anon *GDPRAnonymization) error
}

type ArchivalJobRepository interface {
    Save(ctx context.Context, job *ArchivalJob) error
    FindPending(ctx context.Context) ([]*ArchivalJob, error)
    FindByID(ctx context.Context, jobID string) (*ArchivalJob, error)
    Update(ctx context.Context, job *ArchivalJob) error
}

// Service Ports
type QueuePort interface {
    // 監査イベントの受信と発行を抽象化（Beta: Redis+BullMQ/asynq、本番: OCI Queue Service）
    Consume(ctx context.Context, topic string, handler MessageHandler) error
    Publish(ctx context.Context, topic string, payload []byte) error
    Ack(ctx context.Context, messageID string) error
}

type EventPublisherPort interface {
    Publish(ctx context.Context, event DomainEvent) error  // QueuePort 委譲
}

type QueryCachePort interface {
    Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error
    Get(ctx context.Context, key string) (interface{}, error)
    Delete(ctx context.Context, key string) error
}

type ObjectStorageExportPort interface {
    // Garage（Beta）/ OCI Object Storage（本番）どちらも S3 互換 API で実装
    UploadCSV(ctx context.Context, entries []*AuditEntry, bucket, key string) (string, error)
    UploadJSON(ctx context.Context, entries []*AuditEntry, bucket, key string) (string, error)
    ArchiveRecords(ctx context.Context, entries []*AuditEntry, bucket, prefix string) (string, error)  // Parquet / NDJSON アーカイブ
}

type GDPRAnonymizationPort interface {
    AnonymizeEmail(email string) string       // SHA256ハッシュ化
    AnonymizePhoneNumber(phone string) string // SHA256ハッシュ化
    AnonymizeName(name string) string         // SHA256ハッシュ化
}

fx.Provide(
    // Domain
    NewAuditEntryFactory,
    NewRetentionPolicyFactory,

    // Repositories
    NewMySQLAuditRepository,
    NewMySQLRetentionRepository,
    NewMySQLGDPRRepository,
    NewMySQLArchivalRepository,

    // External Services (Feature Flag で Beta / 本番切替)
    NewRedisBullMQAdapter,        // → QueuePort (Beta, Node) / NewAsynqAdapter (Beta, Go)
    NewOCIQueueAdapter,           // → QueuePort (本番)
    NewQueueEventPublisher,       // → EventPublisherPort (QueuePort 委譲)
    NewGarageArchivalAdapter,     // → ObjectStorageExportPort (Beta)
    NewOCIArchivalAdapter,        // → ObjectStorageExportPort (本番)
    NewSHA256Anonymizer,
    NewRedisQueryCache,

    // UseCases
    NewRecordAuditEntryUseCase,
    NewQueryAuditLogsUseCase,
    NewExportAuditLogsUseCase,
    NewArchiveOldLogsUseCase,
    NewAnonymizeGDPRDataUseCase,
    NewScheduleArchivalJobUseCase,

    // Handlers
    NewQueueAuditConsumer,
    NewQueryAuditLogsHandler,
    NewExportAuditLogsHandler,
    NewGDPRAnonymizeHandler,
    NewArchivalJobScheduler,
    NewArchivalJobWorker,
),

fx.Invoke(
    RegisterHTTPRoutes,    // chi ルーターの登録
    StartQueueConsumer,    // QueuePort 購読開始
    StartArchivalScheduler, // Cron スケジューラ開始
)

// Entity Test
func TestAuditEntry_Validate_MissingActorID(t *testing.T) {
    entry := &AuditEntry{
        EntryID:    "test-id-123",
        ActorID:    "", // 空
        Action:     "READ",
        CreatedAt:  time.Now(),
    }
    err := entry.Validate()
    assert.ErrorIs(t, err, ErrMissingActorID)
}

func TestAuditEntry_CanBeArchived(t *testing.T) {
    createdAt := time.Now().AddDate(0, -3, 0) // 3ヶ月前
    entry := &AuditEntry{
        EntryID:    "test-id",
        CreatedAt:  createdAt,
        ArchivedAt: nil,
    }
    assert.True(t, entry.CanBeArchived(time.Now(), 60)) // 60日保管ポリシー
}

func TestRetentionPolicy_Validate_ArchiveDaysExceeded(t *testing.T) {
    policy := &RetentionPolicy{
        RetentionDays:    100,
        ArchiveAfterDays: 150, // 異常値
    }
    err := policy.Validate()
    assert.ErrorIs(t, err, ErrArchiveDaysExceedsRetention)
}

// UseCase Test
func TestRecordAuditEntry_Success(t *testing.T) {
    mockRepo := new(MockAuditRepository)
    mockRepo.On("Save", mock.Anything, mock.MatchedBy(func(e *AuditEntry) bool {
        return e.ActorID == "user-123" && e.Action == "WRITE"
    })).Return(nil)

    mockPublisher := new(MockEventPublisher)
    mockPublisher.On("Publish", mock.Anything, mock.MatchedBy(func(e DomainEvent) bool {
        return e.EventType() == "AuditEntryRecorded"
    })).Return(nil)

    uc := NewRecordAuditEntryUseCase(mockRepo, mockPublisher)
    input := RecordAuditEntryInput{
        ActorID:      "user-123",
        Action:       "WRITE",
        ResourceType: "MEDIA",
        ResourceID:   "media-456",
        Result:       "SUCCESS",
    }

    output, err := uc.Execute(context.Background(), input)

    assert.NoError(t, err)
    assert.NotEmpty(t, output.EntryID)
    mockRepo.AssertCalled(t, "Save", mock.Anything, mock.Anything)
    mockPublisher.AssertCalled(t, "Publish", mock.Anything, mock.Anything)
}

func TestQueryAuditLogs_WithFilters(t *testing.T) {
    mockRepo := new(MockAuditRepository)
    expectedEntries := []*AuditEntry{
        {EntryID: "id-1", ActorID: "user-123", Action: "READ"},
        {EntryID: "id-2", ActorID: "user-123", Action: "WRITE"},
    }
    mockRepo.On("FindByQuery", mock.Anything, mock.MatchedBy(func(f *QueryFilter) bool {
        return f.ActorID == "user-123"
    }), 10, 0).Return(expectedEntries, 2, nil)

    mockCache := new(MockQueryCache)
    mockCache.On("Get", mock.Anything, mock.Anything).Return(nil, errors.New("cache miss"))
    mockCache.On("Set", mock.Anything, mock.Anything, mock.Anything, 5*time.Minute).Return(nil)

    uc := NewQueryAuditLogsUseCase(mockRepo, mockCache)
    input := QueryAuditLogsInput{
        ActorID: "user-123",
        Limit:   10,
        Offset:  0,
    }

    output, err := uc.Execute(context.Background(), input)

    assert.NoError(t, err)
    assert.Len(t, output.Entries, 2)
    assert.Equal(t, 2, output.TotalCount)
}

// Adapter Test (HTTP)
func TestQueryAuditLogsHandler_UnauthorizedAccess(t *testing.T) {
    handler := NewQueryAuditLogsHandler(nil) // usecase mock

    req := httptest.NewRequest("POST", "/admin/audit/query", nil)
    req.Header.Set("Authorization", "") // ヘッダー無し
    w := httptest.NewRecorder()

    handler.ServeHTTP(w, req)

    assert.Equal(t, http.StatusUnauthorized, w.Code)
}

// Integration Test (MySQL + testcontainers)
func TestArchiveOldLogs_MigratesRecordToS3(t *testing.T) {
    if testing.Short() {
        t.Skip("Skipping integration test")
    }

    ctx := context.Background()
    pgContainer, db := setupMySQL(ctx, t) // testcontainers-go
    defer pgContainer.Terminate(ctx)

    // 古いログ挿入（2年以上前）
    oldEntry := &AuditEntry{
        EntryID:   uuid.New().String(),
        ActorID:   "user-old",
        Action:    "READ",
        CreatedAt: time.Now().AddDate(-2, -1, 0),
    }

    repo := NewMySQLAuditRepository(db)
    err := repo.Save(ctx, oldEntry)
    assert.NoError(t, err)

    // アーカイブジョブ実行
    archiveAdapter := &MockObjectStorageExportAdapter{}  // Beta: Garage / 本番: OCI Object Storage
    archiveAdapter.On("ArchiveRecords", mock.Anything, mock.Anything, mock.Anything, mock.Anything).
        Return("object-storage://recerdo-audit-exports/2026-04/archived.parquet", nil)

    job := &ArchivalJob{
        JobID:       uuid.New().String(),
        Status:      "PENDING",
        ScheduledAt: time.Now(),
    }

    uc := NewArchiveOldLogsUseCase(repo, archiveAdapter, 730) // 2年
    output, err := uc.Execute(ctx, ArchiveOldLogsInput{BatchSize: 1000})

    assert.NoError(t, err)
    assert.Greater(t, output.ArchivedCount, 0)
    archiveAdapter.AssertCalled(t, "ArchiveRecords", mock.Anything, mock.Anything, mock.Anything, mock.Anything)
}

// GDPR Compliance Test
func TestGDPRAnonymization_ReplacesPersonalInfo(t *testing.T) {
    ctx := context.Background()
    pgContainer, db := setupMySQL(ctx, t)
    defer pgContainer.Terminate(ctx)

    // ユーザーのログを複数挿入（メール・名前含む）
    entry := &AuditEntry{
        EntryID:    uuid.New().String(),
        ActorID:    "user-to-delete",
        Metadata:   map[string]interface{}{"email": "john@example.com", "name": "John Doe"},
        CreatedAt:  time.Now(),
    }
    repo := NewMySQLAuditRepository(db)
    repo.Save(ctx, entry)

    // GDPR匿名化実行
    anonymizer := NewSHA256Anonymizer()
    uc := NewAnonymizeGDPRDataUseCase(repo, anonymizer)
    output, err := uc.Execute(ctx, AnonymizeGDPRDataInput{
        UserID: "user-to-delete",
        Reason: "FORGETTING_RIGHT",
    })

    assert.NoError(t, err)
    assert.Greater(t, output.AnonymizedCount, 0)

    // 匿名化後、メールと名前がハッシュに置き換わっているか確認
    retrievedEntry, _ := repo.FindByID(ctx, entry.EntryID)
    assert.NotEqual(t, "john@example.com", retrievedEntry.Metadata["email"])
    assert.NotEqual(t, "John Doe", retrievedEntry.Metadata["name"])
    // ハッシュ値は 64 文字（SHA256）
    assert.Equal(t, 64, len(retrievedEntry.Metadata["email"].(string)))
}