Record audit events for API token authorization

api/server_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"git.julianfamily.org/keepassgo/apiaudit"
 	"git.julianfamily.org/keepassgo/apiapproval"
 	"git.julianfamily.org/keepassgo/apitokens"
 	"git.julianfamily.org/keepassgo/passwords"
@@ -238,6 +239,42 @@ func TestVaultServiceTimesOutPendingApproval(t *testing.T) {
 	}
 }
 
+func TestVaultServiceRecordsApprovalAuditEvents(t *testing.T) {
+	t.Parallel()
+
+	model := vault.Model{
+		Entries: []vault.Entry{
+			{ID: "vault-console", Title: "Vault Console", Path: []string{"Root", "Internet"}},
+			testAPITokenEntry(t),
+		},
+	}
+	client, _, service, cleanup := newTestHarnessForModel(t, model)
+	defer cleanup()
+	service.approvals = apiapproval.NewBroker(time.Minute)
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := client.ListEntries(tokenContext(defaultTestTokenSecret), &keepassgov1.ListEntriesRequest{Path: []string{"Root", "Internet"}})
+		errCh <- err
+	}()
+
+	pending := waitForServerPendingApproval(t, service, 1)[0]
+	if _, err := service.ResolveApproval(pending.ID, apiapproval.OutcomeAllowPermanent); err != nil {
+		t.Fatalf("ResolveApproval(allow permanent) error = %v", err)
+	}
+	if err := <-errCh; err != nil {
+		t.Fatalf("ListEntries() error = %v", err)
+	}
+
+	events := service.AuditLog().Events()
+	if len(events) < 2 {
+		t.Fatalf("len(AuditLog().Events()) = %d, want at least 2", len(events))
+	}
+	if events[0].Type != apiaudit.EventApprovalAllowed || events[1].Type != apiaudit.EventApprovalRequested {
+		t.Fatalf("AuditLog().Events() = %#v, want allowed then requested", events[:2])
+	}
+}
+
 func TestVaultServiceReportsSessionStatusAndSupportsLockUnlock(t *testing.T) {
 	t.Parallel()