define audit log schema + add login action (#1669)

* add audit log schema

* add audit util + login audit log

* move audit-log imports to top

* Add test to ensure login succeeds even if audit logging fails + minor util and schema changes

* change audit file names

* fix audit import names

* fix audit import names (2)

* remove unnecessary audit details

* move login audit log tests to correct file and update helper functions

* remove async from audit log at login endpoint

* fix merge conflicts

* remove audit util function + fix file names

Author: pxtrickhoxng

api/main_endpoints/models/AuditLog.js

@@ -0,0 +1,29 @@
+const mongoose = require('mongoose');
+const Schema = mongoose.Schema;
+const AuditLogActions = require('../util/auditLogActions');
+
+const AuditLogSchema = new Schema(
+  {
+    userId: {
+      type: Schema.Types.ObjectId,
+      ref: 'User',
+      required: true,
+    },
+    action: {
+      type: String,
+      enum: Object.keys(AuditLogActions),
+      required: true,
+    },
+    documentId: {
+      type: Schema.Types.ObjectId,
+      default: null,
+    },
+    details: {
+      type: Schema.Types.Mixed,
+      default: {},
+    },
+  },
+  { timestamps: { createdAt: true, updatedAt: false } }
+);
+
+module.exports = mongoose.model('AuditLog', AuditLogSchema);

api/main_endpoints/routes/Auth.js

@@ -30,6 +30,9 @@ const PASSWORD_RESET_EXPIRATION = require('../../util/constants').PASSWORD_RESET
 const { sendVerificationEmail, sendPasswordReset } = require('../util/emailHelpers');
 const { userWithEmailExists, checkIfPageCountResets, findPasswordReset } = require('../util/userHelpers');
 
+const AuditLogActions = require('../util/auditLogActions.js');
+const AuditLog = require('../models/AuditLog.js');
+
 // Register a member
 router.post('/register', async (req, res) => {
   const registrationStatus = await registerUser(req.body);
@@ -177,6 +180,13 @@ router.post('/login', function(req, res) {
                 const token = jwt.sign(
                   userToBeSigned, config.secretKey, jwtOptions
                 );
+                // Create audit log on successful sign-in
+                AuditLog.create({
+                  userId: user._id,
+                  action: AuditLogActions.LOG_IN,
+                  details: { email: user.email }
+                }).catch(logger.error);
+
                 res.json({ token: 'JWT ' + token });
               })
               .catch((error) => {

api/main_endpoints/util/auditLogActions.js

@@ -0,0 +1,12 @@
+const AuditLogActions = {
+  LOG_IN: 'LOG_IN',
+  UPDATE_USER: 'UPDATE_USER',
+  PRINT_PAGE: 'PRINT_PAGE',
+  SIGN_UP: 'SIGN_UP',
+  VERIFY_EMAIL: 'VERIFY_EMAIL',
+  EMAIL_SENT: 'EMAIL_SENT',
+  CHANGE_PW: 'CHANGE_PW',
+  RESET_PW: 'RESET_PW',
+};
+
+module.exports = AuditLogActions;

test/api/Auth.js

@@ -34,8 +34,11 @@ const {
 const { checkIfPageCountResets } = require('../../api/main_endpoints/util/userHelpers.js');
 const { mockDayMonthAndYear, revertClock } = require('../util/mocks/Date.js');
 const { MEMBERSHIP_STATE } = require('../../api/util/constants');
-chai.should();
 
+const AuditLogActions = require('../../api/main_endpoints/util/auditLogActions.js');
+const AuditLog = require('../../api/main_endpoints/models/AuditLog.js');
+
+chai.should();
 chai.use(chaiHttp);
 
 // Our parent block
@@ -141,39 +144,6 @@ describe('Auth', () => {
       expect(verificationArgs).to.eql([user.firstName + ' ' + user.lastName, user.email]);
       expect(result).to.have.status(OK);
     });
-  });
-
-  describe('/POST login', () => {
-    it('Should return statusCode 400 if an email and/or ' +
-      'password is not provided', async () => {
-      const user = {};
-      const result = await test.sendPostRequest(
-        '/api/Auth/login', user);
-      expect(result).to.have.status(BAD_REQUEST);
-    });
-
-    it('Should return statusCode 401 if an email/pass combo ' +
-      'does not match a record in the DB', async () => {
-      const user = {
-        email: 'nota@b.c',
-        password: 'Passwd'
-      };
-      const result = await test.sendPostRequest(
-        '/api/Auth/login', user);
-      expect(result).to.have.status(UNAUTHORIZED);
-    });
-
-    it('Should return statusCode 401 if the email exists ' +
-      'but password is incorrect', async () => {
-      const user = {
-        email: 'a@b.c',
-        password: 'password'
-      };
-      const result = await test.sendPostRequest(
-        '/api/Auth/login', user);
-      expect(result).to.have.status(UNAUTHORIZED);
-    });
-
     it('Should allow login with correct credentials after registering a user', async () => {
       const user = {
         email: 'logintest@gmail.com',
@@ -228,6 +198,114 @@ describe('Auth', () => {
     });
   });
 
+  describe('/POST login', () => {
+    it('Should return statusCode 400 if an email and/or ' +
+      'password is not provided', async () => {
+      const user = {};
+      const result = await test.sendPostRequest(
+        '/api/Auth/login', user);
+      expect(result).to.have.status(BAD_REQUEST);
+    });
+
+    it('Should return statusCode 401 if an email/pass combo ' +
+      'does not match a record in the DB', async () => {
+      const user = {
+        email: 'nota@b.c',
+        password: 'Passwd'
+      };
+      const result = await test.sendPostRequest(
+        '/api/Auth/login', user);
+      expect(result).to.have.status(UNAUTHORIZED);
+    });
+
+    it('Should return statusCode 401 if the email exists ' +
+      'but password is incorrect', async () => {
+      const user = {
+        email: 'a@b.c',
+        password: 'password'
+      };
+      const result = await test.sendPostRequest(
+        '/api/Auth/login', user);
+      expect(result).to.have.status(UNAUTHORIZED);
+    });
+
+    describe('with an existing user', () => {
+      let user;
+
+      before(async () => {
+        user = new User({
+          _id: new mongoose.Types.ObjectId(),
+          firstName: 'Test',
+          lastName: 'User',
+          email: 'logintest@gmail.com',
+          password: 'Passw0rd',
+          emailVerified: true,
+          accessLevel: MEMBERSHIP_STATE.MEMBER,
+          apiKey: null
+        });
+        await user.save();
+      });
+
+      after(async () => {
+        await User.deleteOne({ email: 'logintest@gmail.com' });
+      });
+
+      beforeEach(async () => {
+        await AuditLog.deleteMany({});
+      });
+
+      afterEach(async () => {
+        await AuditLog.deleteMany({});
+        sinon.restore();
+      });
+
+      it('Should create an audit log entry on successful login', async () => {
+        const loginPayload = {
+          email: 'logintest@gmail.com',
+          password: 'Passw0rd',
+        };
+
+        const res = await test.sendPostRequest('/api/Auth/login', loginPayload);
+        expect(res).to.have.status(OK);
+        expect(res.body).to.have.property('token');
+
+        const auditEntry = await AuditLog.findOne({
+          action: AuditLogActions.LOG_IN,
+          details: {email: loginPayload.email},
+        });
+
+        expect(auditEntry).to.exist;
+        expect(auditEntry).to.have.property('userId');
+        expect(auditEntry.details).to.have.property('email', loginPayload.email);
+      });
+
+      it('Should return 200 even if audit logging fails', async () => {
+        const auditStub = sinon.stub(AuditLog, 'create').rejects(new Error('Simulated audit log failure'));
+
+        const loginPayload = {
+          email: 'logintest@gmail.com',
+          password: 'Passw0rd',
+        };
+
+        try {
+
+          const res = await test.sendPostRequest('/api/Auth/login', loginPayload);
+          expect(res).to.have.status(OK);
+          expect(res.body).to.have.property('token');
+
+          const auditEntry = await AuditLog.findOne({
+            action: AuditLogActions.LOG_IN,
+            'details.email': loginPayload.email,
+          });
+
+          expect(auditEntry).to.not.exist;
+        } finally {
+          auditStub.restore();
+        }
+      });
+    });
+  });
+
   describe('/POST sendPasswordReset', () => {
     it('Should return statusCode 401 if the email is invalid', async () => {
       const data = {
@@ -427,5 +505,4 @@ describe('Auth', () => {
       expect(result).to.be.false;
     });
   });
-
 });