feat(backend): Audit-Log-Abfrage (Modul 19)

AuditModule um GET /audit-log?entityType=&entityId= erweitert
(nur Administrator). Zusaetzlich Jest-E2E-Parallelitaet begrenzt
(maxWorkers: 4), um wiederkehrende Verbindungsengpaesse gegen
Postgres unter vielen parallelen Testsuiten zu vermeiden.

ApiCore-Backend/src/audit/audit-log.service.spec.ts

@@ -0,0 +1,55 @@
+import { AuditLogService } from './audit-log.service';
+import { PrismaService } from '../prisma/prisma.service';
+
+describe('AuditLogService', () => {
+  let service: AuditLogService;
+  let prisma: {
+    auditLog: { create: jest.Mock; findMany: jest.Mock };
+  };
+
+  beforeEach(() => {
+    prisma = {
+      auditLog: {
+        create: jest.fn(),
+        findMany: jest.fn().mockResolvedValue([]),
+      },
+    };
+    service = new AuditLogService(prisma as unknown as PrismaService);
+  });
+
+  it('record writes the entity type, action, and actor', async () => {
+    await service.record({
+      entityType: 'Colony',
+      entityId: 'colony-1',
+      action: 'CREATE',
+      userId: 'user-1',
+    });
+
+    const [[createArg]] = prisma.auditLog.create.mock.calls as [
+      [
+        {
+          data: {
+            entityType: string;
+            entityId: string;
+            action: string;
+            userId?: string;
+          };
+        },
+      ],
+    ];
+    expect(createArg.data.entityType).toBe('Colony');
+    expect(createArg.data.entityId).toBe('colony-1');
+    expect(createArg.data.action).toBe('CREATE');
+    expect(createArg.data.userId).toBe('user-1');
+  });
+
+  it('findAll filters by entity type and id', async () => {
+    await service.findAll({ entityType: 'Colony', entityId: 'colony-1' });
+
+    const [[queryArg]] = prisma.auditLog.findMany.mock.calls as [
+      [{ where: { entityType?: string; entityId?: string } }],
+    ];
+    expect(queryArg.where.entityType).toBe('Colony');
+    expect(queryArg.where.entityId).toBe('colony-1');
+  });
+});

ApiCore-Backend/src/audit/audit-log.service.ts

@@ -1,6 +1,6 @@
 import { Injectable } from '@nestjs/common';
 import { PrismaService } from '../prisma/prisma.service';
-import { AuditAction, Prisma } from '../../generated/prisma';
+import { AuditAction, AuditLog, Prisma } from '../../generated/prisma';
 
 interface RecordAuditLogInput {
   entityType: string;
@@ -11,6 +11,11 @@ interface RecordAuditLogInput {
   afterData?: unknown;
 }
 
+export interface AuditLogFilter {
+  entityType?: string;
+  entityId?: string;
+}
+
 @Injectable()
 export class AuditLogService {
   constructor(private readonly prisma: PrismaService) {}
@@ -27,4 +32,12 @@ export class AuditLogService {
       },
     });
   }
+
+  async findAll(filter: AuditLogFilter = {}): Promise<AuditLog[]> {
+    return this.prisma.auditLog.findMany({
+      where: { entityType: filter.entityType, entityId: filter.entityId },
+      orderBy: { timestamp: 'desc' },
+      take: 200,
+    });
+  }
 }

ApiCore-Backend/src/audit/audit.controller.ts

@@ -0,0 +1,21 @@
+import { Controller, Get, Query } from '@nestjs/common';
+import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { Role } from '../../generated/prisma';
+import { Roles } from '../auth/decorators/roles.decorator';
+import { AuditLogService } from './audit-log.service';
+
+@ApiTags('audit-log')
+@ApiBearerAuth()
+@Controller('audit-log')
+export class AuditController {
+  constructor(private readonly auditLogService: AuditLogService) {}
+
+  @Roles(Role.ADMIN)
+  @Get()
+  findAll(
+    @Query('entityType') entityType?: string,
+    @Query('entityId') entityId?: string,
+  ) {
+    return this.auditLogService.findAll({ entityType, entityId });
+  }
+}

ApiCore-Backend/src/audit/audit.module.ts

@@ -1,8 +1,10 @@
 import { Global, Module } from '@nestjs/common';
+import { AuditController } from './audit.controller';
 import { AuditLogService } from './audit-log.service';
 
 @Global()
 @Module({
+  controllers: [AuditController],
   providers: [AuditLogService],
   exports: [AuditLogService],
 })

ApiCore-Backend/test/audit-log.e2e-spec.ts

@@ -0,0 +1,95 @@
+import { INestApplication } from '@nestjs/common';
+import * as bcrypt from 'bcryptjs';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { PrismaService } from '../src/prisma/prisma.service';
+import { createTestApp } from './utils/create-test-app';
+import { login } from './utils/api';
+
+interface AuditLogEntryBody {
+  entityType: string;
+  entityId: string;
+  action: string;
+}
+
+describe('Audit log (e2e)', () => {
+  let app: INestApplication<App>;
+  let prisma: PrismaService;
+  const adminEmail = `audit-e2e-admin-${Date.now()}@example.com`;
+  const beekeeperEmail = `audit-e2e-beekeeper-${Date.now()}@example.com`;
+  const password = 'SuperSecret123!';
+  let adminId: string;
+  let beekeeperId: string;
+  let adminToken: string;
+  let beekeeperToken: string;
+  let apiaryId: string;
+
+  beforeAll(async () => {
+    app = await createTestApp();
+    prisma = app.get(PrismaService);
+
+    const passwordHash = await bcrypt.hash(password, 12);
+    const admin = await prisma.user.create({
+      data: { email: adminEmail, passwordHash, name: 'Admin', role: 'ADMIN' },
+    });
+    adminId = admin.id;
+    const beekeeper = await prisma.user.create({
+      data: {
+        email: beekeeperEmail,
+        passwordHash,
+        name: 'Beekeeper',
+        role: 'BEEKEEPER',
+      },
+    });
+    beekeeperId = beekeeper.id;
+    adminToken = (await login(app, adminEmail, password)).accessToken;
+    beekeeperToken = (await login(app, beekeeperEmail, password)).accessToken;
+  });
+
+  afterAll(async () => {
+    if (apiaryId) {
+      await prisma.apiary.deleteMany({ where: { id: apiaryId } });
+    }
+    await prisma.auditLog.deleteMany({
+      where: { userId: { in: [adminId, beekeeperId] } },
+    });
+    await prisma.refreshToken.deleteMany({
+      where: { userId: { in: [adminId, beekeeperId] } },
+    });
+    await prisma.user.deleteMany({
+      where: { id: { in: [adminId, beekeeperId] } },
+    });
+    await app.close();
+  });
+
+  it('rejects the query for a non-admin user', () => {
+    return request(app.getHttpServer())
+      .get('/api/v1/audit-log')
+      .set('Authorization', `Bearer ${beekeeperToken}`)
+      .expect(403);
+  });
+
+  it('lets an ADMIN query the audit log for a created apiary', async () => {
+    const createResponse = await request(app.getHttpServer())
+      .post('/api/v1/apiaries')
+      .set('Authorization', `Bearer ${beekeeperToken}`)
+      .send({ name: `Stand ${Date.now()}` })
+      .expect(201);
+    const apiary = createResponse.body as { id: string };
+    apiaryId = apiary.id;
+
+    const response = await request(app.getHttpServer())
+      .get(`/api/v1/audit-log?entityType=Apiary&entityId=${apiaryId}`)
+      .set('Authorization', `Bearer ${adminToken}`)
+      .expect(200);
+    const entries = response.body as AuditLogEntryBody[];
+    expect(
+      entries.some(
+        (entry) =>
+          entry.entityType === 'Apiary' &&
+          entry.entityId === apiaryId &&
+          entry.action === 'CREATE',
+      ),
+    ).toBe(true);
+  });
+});

ApiCore-Backend/test/jest-e2e.json

@@ -4,6 +4,7 @@
   "testEnvironment": "node",
   "testRegex": ".e2e-spec.ts$",
   "setupFiles": ["<rootDir>/setup-env.ts"],
+  "maxWorkers": 4,
   "transform": {
     "^.+\\.(t|j)s$": "ts-jest"
   }

TASKS.md

@@ -139,7 +139,7 @@ Abgeleitet aus [`docs/lastenheft.md`](docs/lastenheft.md) Abschnitt 26. Reihenfo
 - Backend: `AuditModule` erweitert um Abfrage-Endpunkte (Grundstruktur bereits in Schritt 1 gebaut, hier UI + Query-API)
 - Endpunkte: `GET /api/v1/audit-log?entityType=&entityId=`
 - Frontend: `/settings/audit-log` (nur Administrator)
-- [ ] Backend-Modul fertig, getestet, grün, committet
+- [x] Backend-Modul fertig, getestet, grün, committet
 - [ ] Frontend-Views fertig, getestet, grün, committet
 
 ### 20. Backupfähigkeit