Record audit events for API token authorization

apiaudit/audit_test.go

@@ -0,0 +1,49 @@
+package apiaudit
+
+import (
+	"testing"
+	"time"
+
+	"git.julianfamily.org/keepassgo/apitokens"
+)
+
+func TestLogKeepsNewestEventsWithinBound(t *testing.T) {
+	t.Parallel()
+
+	log := New(2)
+	log.now = func() time.Time { return time.Date(2026, 3, 29, 12, 0, 0, 0, time.UTC) }
+	log.Record(Event{Type: EventApprovalRequested, TokenID: "token-1"})
+	log.Record(Event{Type: EventApprovalAllowed, TokenID: "token-2"})
+	log.Record(Event{Type: EventApprovalDenied, TokenID: "token-3"})
+
+	events := log.Events()
+	if len(events) != 2 {
+		t.Fatalf("len(Events()) = %d, want 2", len(events))
+	}
+	if events[0].TokenID != "token-3" || events[1].TokenID != "token-2" {
+		t.Fatalf("Events() = %#v, want newest-first bounded list", events)
+	}
+}
+
+func TestLogPreservesRecordedMetadata(t *testing.T) {
+	t.Parallel()
+
+	log := New(5)
+	log.Record(Event{
+		Type:       EventApprovalRequested,
+		TokenID:    "token-1",
+		TokenName:  "CLI",
+		ClientName: "grpc-cli",
+		Operation:  apitokens.OperationListEntries,
+		Resource:   apitokens.Resource{Kind: apitokens.ResourceGroup, Path: []string{"Root", "Internet"}},
+		Message:    "prompted for access",
+	})
+
+	events := log.Events()
+	if len(events) != 1 {
+		t.Fatalf("len(Events()) = %d, want 1", len(events))
+	}
+	if events[0].Operation != apitokens.OperationListEntries || events[0].Message != "prompted for access" {
+		t.Fatalf("Events()[0] = %#v, want preserved metadata", events[0])
+	}
+}